From d19bcef326c13dbd0e3c453d81d2f1c5d41333d8 Mon Sep 17 00:00:00 2001 From: Crowdin Bot Date: Thu, 7 Mar 2024 05:31:17 +0000 Subject: [PATCH] New Crowdin translations by GitHub Action --- i18n/ar/advanced/payments.md | 11 ++- i18n/ar/advanced/tor-overview.md | 15 ++-- i18n/ar/basics/account-creation.md | 7 +- i18n/ar/basics/common-misconceptions.md | 15 ++-- i18n/ar/basics/common-threats.md | 62 ++++++++++------ i18n/ar/basics/multi-factor-authentication.md | 7 +- i18n/ar/basics/passwords-overview.md | 69 +++++++++++------- i18n/ar/basics/vpn-overview.md | 7 +- i18n/ar/os/android-overview.md | 14 +++- i18n/ar/os/ios-overview.md | 7 +- i18n/ar/os/macos-overview.md | 14 +++- i18n/ar/os/qubes-overview.md | 14 +++- i18n/bn-IN/advanced/payments.md | 11 ++- i18n/bn-IN/advanced/tor-overview.md | 15 ++-- i18n/bn-IN/basics/account-creation.md | 7 +- i18n/bn-IN/basics/common-misconceptions.md | 15 ++-- i18n/bn-IN/basics/common-threats.md | 62 ++++++++++------ .../basics/multi-factor-authentication.md | 7 +- i18n/bn-IN/basics/passwords-overview.md | 69 +++++++++++------- i18n/bn-IN/basics/vpn-overview.md | 7 +- i18n/bn-IN/os/android-overview.md | 16 ++-- i18n/bn-IN/os/ios-overview.md | 7 +- i18n/bn-IN/os/macos-overview.md | 14 +++- i18n/bn-IN/os/qubes-overview.md | 14 +++- i18n/bn/advanced/payments.md | 11 ++- i18n/bn/advanced/tor-overview.md | 15 ++-- i18n/bn/basics/account-creation.md | 7 +- i18n/bn/basics/common-misconceptions.md | 15 ++-- i18n/bn/basics/common-threats.md | 62 ++++++++++------ i18n/bn/basics/multi-factor-authentication.md | 7 +- i18n/bn/basics/passwords-overview.md | 69 +++++++++++------- i18n/bn/basics/vpn-overview.md | 7 +- i18n/bn/os/android-overview.md | 14 +++- i18n/bn/os/ios-overview.md | 7 +- i18n/bn/os/macos-overview.md | 14 +++- i18n/bn/os/qubes-overview.md | 14 +++- i18n/cs/advanced/payments.md | 11 ++- i18n/cs/advanced/tor-overview.md | 15 ++-- i18n/cs/basics/account-creation.md | 7 +- i18n/cs/basics/common-misconceptions.md | 15 ++-- i18n/cs/basics/common-threats.md | 62 ++++++++++------ i18n/cs/basics/multi-factor-authentication.md | 7 +- i18n/cs/basics/passwords-overview.md | 69 +++++++++++------- i18n/cs/basics/vpn-overview.md | 7 +- i18n/cs/os/android-overview.md | 14 +++- i18n/cs/os/ios-overview.md | 7 +- i18n/cs/os/macos-overview.md | 14 +++- i18n/cs/os/qubes-overview.md | 14 +++- i18n/de/advanced/payments.md | 13 ++-- i18n/de/advanced/tor-overview.md | 15 ++-- i18n/de/basics/account-creation.md | 9 ++- i18n/de/basics/common-misconceptions.md | 15 ++-- i18n/de/basics/common-threats.md | 62 ++++++++++------ i18n/de/basics/multi-factor-authentication.md | 7 +- i18n/de/basics/passwords-overview.md | 71 +++++++++++------- i18n/de/basics/vpn-overview.md | 7 +- i18n/de/os/android-overview.md | 14 +++- i18n/de/os/ios-overview.md | 7 +- i18n/de/os/macos-overview.md | 14 +++- i18n/de/os/qubes-overview.md | 14 +++- i18n/el/advanced/payments.md | 11 ++- i18n/el/advanced/tor-overview.md | 15 ++-- i18n/el/basics/account-creation.md | 7 +- i18n/el/basics/common-misconceptions.md | 17 +++-- i18n/el/basics/common-threats.md | 62 ++++++++++------ i18n/el/basics/multi-factor-authentication.md | 7 +- i18n/el/basics/passwords-overview.md | 69 +++++++++++------- i18n/el/basics/vpn-overview.md | 7 +- i18n/el/os/android-overview.md | 14 +++- i18n/el/os/ios-overview.md | 7 +- i18n/el/os/macos-overview.md | 14 +++- i18n/el/os/qubes-overview.md | 14 +++- i18n/eo/advanced/payments.md | 11 ++- i18n/eo/advanced/tor-overview.md | 15 ++-- i18n/eo/basics/account-creation.md | 7 +- i18n/eo/basics/common-misconceptions.md | 15 ++-- i18n/eo/basics/common-threats.md | 62 ++++++++++------ i18n/eo/basics/multi-factor-authentication.md | 7 +- i18n/eo/basics/passwords-overview.md | 69 +++++++++++------- i18n/eo/basics/vpn-overview.md | 7 +- i18n/eo/os/android-overview.md | 14 +++- i18n/eo/os/ios-overview.md | 7 +- i18n/eo/os/macos-overview.md | 14 +++- i18n/eo/os/qubes-overview.md | 14 +++- i18n/es/advanced/payments.md | 13 ++-- i18n/es/advanced/tor-overview.md | 15 ++-- i18n/es/basics/account-creation.md | 13 ++-- i18n/es/basics/common-misconceptions.md | 17 +++-- i18n/es/basics/common-threats.md | 62 ++++++++++------ i18n/es/basics/multi-factor-authentication.md | 7 +- i18n/es/basics/passwords-overview.md | 73 +++++++++++-------- i18n/es/basics/vpn-overview.md | 13 ++-- i18n/es/os/android-overview.md | 18 +++-- i18n/es/os/ios-overview.md | 11 ++- i18n/es/os/macos-overview.md | 18 +++-- i18n/es/os/qubes-overview.md | 14 +++- i18n/fa/advanced/payments.md | 11 ++- i18n/fa/advanced/tor-overview.md | 15 ++-- i18n/fa/basics/account-creation.md | 7 +- i18n/fa/basics/common-misconceptions.md | 15 ++-- i18n/fa/basics/common-threats.md | 62 ++++++++++------ i18n/fa/basics/multi-factor-authentication.md | 7 +- i18n/fa/basics/passwords-overview.md | 69 +++++++++++------- i18n/fa/basics/vpn-overview.md | 7 +- i18n/fa/os/android-overview.md | 14 +++- i18n/fa/os/ios-overview.md | 7 +- i18n/fa/os/macos-overview.md | 14 +++- i18n/fa/os/qubes-overview.md | 14 +++- i18n/fr/advanced/payments.md | 13 ++-- i18n/fr/advanced/tor-overview.md | 15 ++-- i18n/fr/basics/account-creation.md | 13 ++-- i18n/fr/basics/common-misconceptions.md | 17 +++-- i18n/fr/basics/common-threats.md | 62 ++++++++++------ i18n/fr/basics/multi-factor-authentication.md | 7 +- i18n/fr/basics/passwords-overview.md | 73 +++++++++++-------- i18n/fr/basics/vpn-overview.md | 13 ++-- i18n/fr/os/android-overview.md | 18 +++-- i18n/fr/os/ios-overview.md | 11 ++- i18n/fr/os/macos-overview.md | 18 +++-- i18n/fr/os/qubes-overview.md | 14 +++- i18n/he/advanced/payments.md | 13 ++-- i18n/he/advanced/tor-overview.md | 15 ++-- i18n/he/basics/account-creation.md | 13 ++-- i18n/he/basics/common-misconceptions.md | 17 +++-- i18n/he/basics/common-threats.md | 62 ++++++++++------ i18n/he/basics/multi-factor-authentication.md | 7 +- i18n/he/basics/passwords-overview.md | 73 +++++++++++-------- i18n/he/basics/vpn-overview.md | 13 ++-- i18n/he/os/android-overview.md | 18 +++-- i18n/he/os/ios-overview.md | 11 ++- i18n/he/os/macos-overview.md | 18 +++-- i18n/he/os/qubes-overview.md | 14 +++- i18n/hi/advanced/payments.md | 11 ++- i18n/hi/advanced/tor-overview.md | 15 ++-- i18n/hi/basics/account-creation.md | 7 +- i18n/hi/basics/common-misconceptions.md | 15 ++-- i18n/hi/basics/common-threats.md | 62 ++++++++++------ i18n/hi/basics/multi-factor-authentication.md | 7 +- i18n/hi/basics/passwords-overview.md | 69 +++++++++++------- i18n/hi/basics/vpn-overview.md | 7 +- i18n/hi/os/android-overview.md | 14 +++- i18n/hi/os/ios-overview.md | 7 +- i18n/hi/os/macos-overview.md | 14 +++- i18n/hi/os/qubes-overview.md | 14 +++- i18n/hu/advanced/payments.md | 11 ++- i18n/hu/advanced/tor-overview.md | 15 ++-- i18n/hu/basics/account-creation.md | 7 +- i18n/hu/basics/common-misconceptions.md | 15 ++-- i18n/hu/basics/common-threats.md | 62 ++++++++++------ i18n/hu/basics/multi-factor-authentication.md | 7 +- i18n/hu/basics/passwords-overview.md | 69 +++++++++++------- i18n/hu/basics/vpn-overview.md | 7 +- i18n/hu/os/android-overview.md | 18 +++-- i18n/hu/os/ios-overview.md | 7 +- i18n/hu/os/macos-overview.md | 14 +++- i18n/hu/os/qubes-overview.md | 14 +++- i18n/id/advanced/payments.md | 13 ++-- i18n/id/advanced/tor-overview.md | 15 ++-- i18n/id/basics/account-creation.md | 11 ++- i18n/id/basics/common-misconceptions.md | 17 +++-- i18n/id/basics/common-threats.md | 62 ++++++++++------ i18n/id/basics/multi-factor-authentication.md | 7 +- i18n/id/basics/passwords-overview.md | 73 +++++++++++-------- i18n/id/basics/vpn-overview.md | 13 ++-- i18n/id/os/android-overview.md | 16 ++-- i18n/id/os/ios-overview.md | 7 +- i18n/id/os/macos-overview.md | 14 +++- i18n/id/os/qubes-overview.md | 14 +++- i18n/it/advanced/payments.md | 13 ++-- i18n/it/advanced/tor-overview.md | 15 ++-- i18n/it/basics/account-creation.md | 13 ++-- i18n/it/basics/common-misconceptions.md | 17 +++-- i18n/it/basics/common-threats.md | 62 ++++++++++------ i18n/it/basics/multi-factor-authentication.md | 7 +- i18n/it/basics/passwords-overview.md | 73 +++++++++++-------- i18n/it/basics/vpn-overview.md | 13 ++-- i18n/it/os/android-overview.md | 18 +++-- i18n/it/os/ios-overview.md | 11 ++- i18n/it/os/macos-overview.md | 18 +++-- i18n/it/os/qubes-overview.md | 14 +++- i18n/ja/advanced/payments.md | 13 ++-- i18n/ja/advanced/tor-overview.md | 15 ++-- i18n/ja/basics/account-creation.md | 9 ++- i18n/ja/basics/common-misconceptions.md | 15 ++-- i18n/ja/basics/common-threats.md | 62 ++++++++++------ i18n/ja/basics/multi-factor-authentication.md | 7 +- i18n/ja/basics/passwords-overview.md | 71 +++++++++++------- i18n/ja/basics/vpn-overview.md | 11 ++- i18n/ja/os/android-overview.md | 18 +++-- i18n/ja/os/ios-overview.md | 9 ++- i18n/ja/os/macos-overview.md | 18 +++-- i18n/ja/os/qubes-overview.md | 14 +++- i18n/ko/advanced/payments.md | 13 ++-- i18n/ko/advanced/tor-overview.md | 15 ++-- i18n/ko/basics/account-creation.md | 13 ++-- i18n/ko/basics/common-misconceptions.md | 15 ++-- i18n/ko/basics/common-threats.md | 62 ++++++++++------ i18n/ko/basics/multi-factor-authentication.md | 7 +- i18n/ko/basics/passwords-overview.md | 73 +++++++++++-------- i18n/ko/basics/vpn-overview.md | 11 ++- i18n/ko/os/android-overview.md | 18 +++-- i18n/ko/os/ios-overview.md | 7 +- i18n/ko/os/macos-overview.md | 16 ++-- i18n/ko/os/qubes-overview.md | 14 +++- i18n/ku-IQ/advanced/payments.md | 11 ++- i18n/ku-IQ/advanced/tor-overview.md | 15 ++-- i18n/ku-IQ/basics/account-creation.md | 7 +- i18n/ku-IQ/basics/common-misconceptions.md | 15 ++-- i18n/ku-IQ/basics/common-threats.md | 62 ++++++++++------ .../basics/multi-factor-authentication.md | 7 +- i18n/ku-IQ/basics/passwords-overview.md | 69 +++++++++++------- i18n/ku-IQ/basics/vpn-overview.md | 7 +- i18n/ku-IQ/os/android-overview.md | 14 +++- i18n/ku-IQ/os/ios-overview.md | 7 +- i18n/ku-IQ/os/macos-overview.md | 14 +++- i18n/ku-IQ/os/qubes-overview.md | 14 +++- i18n/nl/advanced/payments.md | 13 ++-- i18n/nl/advanced/tor-overview.md | 15 ++-- i18n/nl/basics/account-creation.md | 13 ++-- i18n/nl/basics/common-misconceptions.md | 17 +++-- i18n/nl/basics/common-threats.md | 62 ++++++++++------ i18n/nl/basics/multi-factor-authentication.md | 8 +- i18n/nl/basics/passwords-overview.md | 73 +++++++++++-------- i18n/nl/basics/vpn-overview.md | 13 ++-- i18n/nl/os/android-overview.md | 18 +++-- i18n/nl/os/ios-overview.md | 7 +- i18n/nl/os/macos-overview.md | 16 ++-- i18n/nl/os/qubes-overview.md | 14 +++- i18n/pl/advanced/payments.md | 11 ++- i18n/pl/advanced/tor-overview.md | 15 ++-- i18n/pl/basics/account-creation.md | 7 +- i18n/pl/basics/common-misconceptions.md | 15 ++-- i18n/pl/basics/common-threats.md | 62 ++++++++++------ i18n/pl/basics/multi-factor-authentication.md | 7 +- i18n/pl/basics/passwords-overview.md | 69 +++++++++++------- i18n/pl/basics/vpn-overview.md | 7 +- i18n/pl/os/android-overview.md | 14 +++- i18n/pl/os/ios-overview.md | 7 +- i18n/pl/os/macos-overview.md | 14 +++- i18n/pl/os/qubes-overview.md | 14 +++- i18n/pt-BR/advanced/payments.md | 11 ++- i18n/pt-BR/advanced/tor-overview.md | 15 ++-- i18n/pt-BR/basics/account-creation.md | 9 ++- i18n/pt-BR/basics/common-misconceptions.md | 15 ++-- i18n/pt-BR/basics/common-threats.md | 62 ++++++++++------ .../basics/multi-factor-authentication.md | 7 +- i18n/pt-BR/basics/passwords-overview.md | 69 +++++++++++------- i18n/pt-BR/basics/vpn-overview.md | 13 ++-- i18n/pt-BR/os/android-overview.md | 16 ++-- i18n/pt-BR/os/ios-overview.md | 7 +- i18n/pt-BR/os/macos-overview.md | 14 +++- i18n/pt-BR/os/qubes-overview.md | 14 +++- i18n/pt/advanced/payments.md | 13 ++-- i18n/pt/advanced/tor-overview.md | 15 ++-- i18n/pt/basics/account-creation.md | 14 ++-- i18n/pt/basics/common-misconceptions.md | 17 +++-- i18n/pt/basics/common-threats.md | 62 ++++++++++------ i18n/pt/basics/multi-factor-authentication.md | 9 ++- i18n/pt/basics/passwords-overview.md | 69 +++++++++++------- i18n/pt/basics/vpn-overview.md | 7 +- i18n/pt/os/android-overview.md | 14 +++- i18n/pt/os/ios-overview.md | 7 +- i18n/pt/os/macos-overview.md | 14 +++- i18n/pt/os/qubes-overview.md | 14 +++- i18n/ru/advanced/payments.md | 13 ++-- i18n/ru/advanced/tor-overview.md | 15 ++-- i18n/ru/basics/account-creation.md | 13 ++-- i18n/ru/basics/common-misconceptions.md | 17 +++-- i18n/ru/basics/common-threats.md | 62 ++++++++++------ i18n/ru/basics/multi-factor-authentication.md | 7 +- i18n/ru/basics/passwords-overview.md | 73 +++++++++++-------- i18n/ru/basics/vpn-overview.md | 13 ++-- i18n/ru/os/android-overview.md | 18 +++-- i18n/ru/os/ios-overview.md | 7 +- i18n/ru/os/macos-overview.md | 16 ++-- i18n/ru/os/qubes-overview.md | 14 +++- i18n/sv/advanced/payments.md | 11 ++- i18n/sv/advanced/tor-overview.md | 15 ++-- i18n/sv/basics/account-creation.md | 7 +- i18n/sv/basics/common-misconceptions.md | 15 ++-- i18n/sv/basics/common-threats.md | 62 ++++++++++------ i18n/sv/basics/multi-factor-authentication.md | 7 +- i18n/sv/basics/passwords-overview.md | 69 +++++++++++------- i18n/sv/basics/vpn-overview.md | 9 ++- i18n/sv/os/android-overview.md | 14 +++- i18n/sv/os/ios-overview.md | 7 +- i18n/sv/os/macos-overview.md | 14 +++- i18n/sv/os/qubes-overview.md | 14 +++- i18n/tr/advanced/payments.md | 11 ++- i18n/tr/advanced/tor-overview.md | 15 ++-- i18n/tr/basics/account-creation.md | 13 ++-- i18n/tr/basics/common-misconceptions.md | 15 ++-- i18n/tr/basics/common-threats.md | 62 ++++++++++------ i18n/tr/basics/multi-factor-authentication.md | 7 +- i18n/tr/basics/passwords-overview.md | 69 +++++++++++------- i18n/tr/basics/vpn-overview.md | 13 ++-- i18n/tr/os/android-overview.md | 18 +++-- i18n/tr/os/ios-overview.md | 7 +- i18n/tr/os/macos-overview.md | 14 +++- i18n/tr/os/qubes-overview.md | 14 +++- i18n/uk/advanced/payments.md | 11 ++- i18n/uk/advanced/tor-overview.md | 15 ++-- i18n/uk/basics/account-creation.md | 7 +- i18n/uk/basics/common-misconceptions.md | 17 +++-- i18n/uk/basics/common-threats.md | 62 ++++++++++------ i18n/uk/basics/multi-factor-authentication.md | 7 +- i18n/uk/basics/passwords-overview.md | 73 +++++++++++-------- i18n/uk/basics/vpn-overview.md | 7 +- i18n/uk/os/android-overview.md | 16 ++-- i18n/uk/os/ios-overview.md | 7 +- i18n/uk/os/macos-overview.md | 14 +++- i18n/uk/os/qubes-overview.md | 14 +++- i18n/vi/advanced/payments.md | 11 ++- i18n/vi/advanced/tor-overview.md | 15 ++-- i18n/vi/basics/account-creation.md | 7 +- i18n/vi/basics/common-misconceptions.md | 15 ++-- i18n/vi/basics/common-threats.md | 62 ++++++++++------ i18n/vi/basics/multi-factor-authentication.md | 7 +- i18n/vi/basics/passwords-overview.md | 69 +++++++++++------- i18n/vi/basics/vpn-overview.md | 7 +- i18n/vi/os/android-overview.md | 14 +++- i18n/vi/os/ios-overview.md | 7 +- i18n/vi/os/macos-overview.md | 14 +++- i18n/vi/os/qubes-overview.md | 14 +++- i18n/zh-Hant/advanced/payments.md | 13 ++-- i18n/zh-Hant/advanced/tor-overview.md | 16 ++-- i18n/zh-Hant/basics/account-creation.md | 13 ++-- i18n/zh-Hant/basics/common-misconceptions.md | 17 +++-- i18n/zh-Hant/basics/common-threats.md | 62 ++++++++++------ .../basics/multi-factor-authentication.md | 7 +- i18n/zh-Hant/basics/passwords-overview.md | 73 +++++++++++-------- i18n/zh-Hant/basics/vpn-overview.md | 13 ++-- i18n/zh-Hant/os/android-overview.md | 18 +++-- i18n/zh-Hant/os/ios-overview.md | 11 ++- i18n/zh-Hant/os/macos-overview.md | 18 +++-- i18n/zh-Hant/os/qubes-overview.md | 14 +++- i18n/zh/advanced/payments.md | 11 ++- i18n/zh/advanced/tor-overview.md | 15 ++-- i18n/zh/basics/account-creation.md | 13 ++-- i18n/zh/basics/common-misconceptions.md | 17 +++-- i18n/zh/basics/common-threats.md | 62 ++++++++++------ i18n/zh/basics/multi-factor-authentication.md | 7 +- i18n/zh/basics/passwords-overview.md | 71 +++++++++++------- i18n/zh/basics/vpn-overview.md | 11 ++- i18n/zh/os/android-overview.md | 16 ++-- i18n/zh/os/ios-overview.md | 7 +- i18n/zh/os/macos-overview.md | 14 +++- i18n/zh/os/qubes-overview.md | 14 +++- i18n/zh/vpn.md | 2 +- 349 files changed, 4728 insertions(+), 2647 deletions(-) diff --git a/i18n/ar/advanced/payments.md b/i18n/ar/advanced/payments.md index 58e45a81..df356a03 100644 --- a/i18n/ar/advanced/payments.md +++ b/i18n/ar/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! خطر +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/ar/advanced/tor-overview.md b/i18n/ar/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/ar/advanced/tor-overview.md +++ b/i18n/ar/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/ar/basics/account-creation.md b/i18n/ar/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/ar/basics/account-creation.md +++ b/i18n/ar/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/ar/basics/common-misconceptions.md b/i18n/ar/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/ar/basics/common-misconceptions.md +++ b/i18n/ar/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/ar/basics/common-threats.md b/i18n/ar/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/ar/basics/common-threats.md +++ b/i18n/ar/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/ar/basics/multi-factor-authentication.md b/i18n/ar/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/ar/basics/multi-factor-authentication.md +++ b/i18n/ar/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/ar/basics/passwords-overview.md b/i18n/ar/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/ar/basics/passwords-overview.md +++ b/i18n/ar/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/ar/basics/vpn-overview.md b/i18n/ar/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/ar/basics/vpn-overview.md +++ b/i18n/ar/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/ar/os/android-overview.md b/i18n/ar/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/ar/os/android-overview.md +++ b/i18n/ar/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/ar/os/ios-overview.md b/i18n/ar/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/ar/os/ios-overview.md +++ b/i18n/ar/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/ar/os/macos-overview.md b/i18n/ar/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/ar/os/macos-overview.md +++ b/i18n/ar/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/ar/os/qubes-overview.md b/i18n/ar/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/ar/os/qubes-overview.md +++ b/i18n/ar/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/bn-IN/advanced/payments.md b/i18n/bn-IN/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/bn-IN/advanced/payments.md +++ b/i18n/bn-IN/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/bn-IN/advanced/tor-overview.md b/i18n/bn-IN/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/bn-IN/advanced/tor-overview.md +++ b/i18n/bn-IN/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/bn-IN/basics/account-creation.md b/i18n/bn-IN/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/bn-IN/basics/account-creation.md +++ b/i18n/bn-IN/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/bn-IN/basics/common-misconceptions.md b/i18n/bn-IN/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/bn-IN/basics/common-misconceptions.md +++ b/i18n/bn-IN/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/bn-IN/basics/common-threats.md b/i18n/bn-IN/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/bn-IN/basics/common-threats.md +++ b/i18n/bn-IN/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/bn-IN/basics/multi-factor-authentication.md b/i18n/bn-IN/basics/multi-factor-authentication.md index 78659d10..fb7d2b0e 100644 --- a/i18n/bn-IN/basics/multi-factor-authentication.md +++ b/i18n/bn-IN/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/bn-IN/basics/passwords-overview.md b/i18n/bn-IN/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/bn-IN/basics/passwords-overview.md +++ b/i18n/bn-IN/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/bn-IN/basics/vpn-overview.md b/i18n/bn-IN/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/bn-IN/basics/vpn-overview.md +++ b/i18n/bn-IN/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/bn-IN/os/android-overview.md b/i18n/bn-IN/os/android-overview.md index 35ab9024..1ffa3cdc 100644 --- a/i18n/bn-IN/os/android-overview.md +++ b/i18n/bn-IN/os/android-overview.md @@ -1,6 +1,6 @@ --- title: Android Overview -icon: ফন্টঅ্যাওসাম/ ব্র্যান্ড / অ্যান্ড্রয়েড +icon: simple/android description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/bn-IN/os/ios-overview.md b/i18n/bn-IN/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/bn-IN/os/ios-overview.md +++ b/i18n/bn-IN/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/bn-IN/os/macos-overview.md b/i18n/bn-IN/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/bn-IN/os/macos-overview.md +++ b/i18n/bn-IN/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/bn-IN/os/qubes-overview.md b/i18n/bn-IN/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/bn-IN/os/qubes-overview.md +++ b/i18n/bn-IN/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/bn/advanced/payments.md b/i18n/bn/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/bn/advanced/payments.md +++ b/i18n/bn/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/bn/advanced/tor-overview.md b/i18n/bn/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/bn/advanced/tor-overview.md +++ b/i18n/bn/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/bn/basics/account-creation.md b/i18n/bn/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/bn/basics/account-creation.md +++ b/i18n/bn/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/bn/basics/common-misconceptions.md b/i18n/bn/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/bn/basics/common-misconceptions.md +++ b/i18n/bn/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/bn/basics/common-threats.md b/i18n/bn/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/bn/basics/common-threats.md +++ b/i18n/bn/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/bn/basics/multi-factor-authentication.md b/i18n/bn/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/bn/basics/multi-factor-authentication.md +++ b/i18n/bn/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/bn/basics/passwords-overview.md b/i18n/bn/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/bn/basics/passwords-overview.md +++ b/i18n/bn/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/bn/basics/vpn-overview.md b/i18n/bn/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/bn/basics/vpn-overview.md +++ b/i18n/bn/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/bn/os/android-overview.md b/i18n/bn/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/bn/os/android-overview.md +++ b/i18n/bn/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/bn/os/ios-overview.md b/i18n/bn/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/bn/os/ios-overview.md +++ b/i18n/bn/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/bn/os/macos-overview.md b/i18n/bn/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/bn/os/macos-overview.md +++ b/i18n/bn/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/bn/os/qubes-overview.md b/i18n/bn/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/bn/os/qubes-overview.md +++ b/i18n/bn/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/cs/advanced/payments.md b/i18n/cs/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/cs/advanced/payments.md +++ b/i18n/cs/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/cs/advanced/tor-overview.md b/i18n/cs/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/cs/advanced/tor-overview.md +++ b/i18n/cs/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/cs/basics/account-creation.md b/i18n/cs/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/cs/basics/account-creation.md +++ b/i18n/cs/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/cs/basics/common-misconceptions.md b/i18n/cs/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/cs/basics/common-misconceptions.md +++ b/i18n/cs/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/cs/basics/common-threats.md b/i18n/cs/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/cs/basics/common-threats.md +++ b/i18n/cs/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/cs/basics/multi-factor-authentication.md b/i18n/cs/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/cs/basics/multi-factor-authentication.md +++ b/i18n/cs/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/cs/basics/passwords-overview.md b/i18n/cs/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/cs/basics/passwords-overview.md +++ b/i18n/cs/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/cs/basics/vpn-overview.md b/i18n/cs/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/cs/basics/vpn-overview.md +++ b/i18n/cs/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/cs/os/android-overview.md b/i18n/cs/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/cs/os/android-overview.md +++ b/i18n/cs/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/cs/os/ios-overview.md b/i18n/cs/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/cs/os/ios-overview.md +++ b/i18n/cs/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/cs/os/macos-overview.md b/i18n/cs/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/cs/os/macos-overview.md +++ b/i18n/cs/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/cs/os/qubes-overview.md b/i18n/cs/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/cs/os/qubes-overview.md +++ b/i18n/cs/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/de/advanced/payments.md b/i18n/de/advanced/payments.md index 7bd4602a..df356a03 100644 --- a/i18n/de/advanced/payments.md +++ b/i18n/de/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Private Zahlungsmethoden +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! !!! danger "Achtung" +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/de/advanced/tor-overview.md b/i18n/de/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/de/advanced/tor-overview.md +++ b/i18n/de/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/de/basics/account-creation.md b/i18n/de/basics/account-creation.md index a1f7aa5b..354b1633 100644 --- a/i18n/de/basics/account-creation.md +++ b/i18n/de/basics/account-creation.md @@ -1,6 +1,6 @@ --- meta_title: "How to Create Internet Accounts Privately - Privacy Guides" -title: "Benutzerkontenerstellung" +title: "Account Creation" icon: 'material/account-plus' description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/de/basics/common-misconceptions.md b/i18n/de/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/de/basics/common-misconceptions.md +++ b/i18n/de/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/de/basics/common-threats.md b/i18n/de/basics/common-threats.md index 419f02b4..30cbdd92 100644 --- a/i18n/de/basics/common-threats.md +++ b/i18n/de/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/de/basics/multi-factor-authentication.md b/i18n/de/basics/multi-factor-authentication.md index ce8f9530..6aa21122 100644 --- a/i18n/de/basics/multi-factor-authentication.md +++ b/i18n/de/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/de/basics/passwords-overview.md b/i18n/de/basics/passwords-overview.md index 08574123..d814fc19 100644 --- a/i18n/de/basics/passwords-overview.md +++ b/i18n/de/basics/passwords-overview.md @@ -1,5 +1,5 @@ --- -title: "Einführung in Passwörter" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/de/basics/vpn-overview.md b/i18n/de/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/de/basics/vpn-overview.md +++ b/i18n/de/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/de/os/android-overview.md b/i18n/de/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/de/os/android-overview.md +++ b/i18n/de/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/de/os/ios-overview.md b/i18n/de/os/ios-overview.md index bcd8923a..e6ee4ff5 100644 --- a/i18n/de/os/ios-overview.md +++ b/i18n/de/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/de/os/macos-overview.md b/i18n/de/os/macos-overview.md index b4ce915b..5e50277f 100644 --- a/i18n/de/os/macos-overview.md +++ b/i18n/de/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/de/os/qubes-overview.md b/i18n/de/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/de/os/qubes-overview.md +++ b/i18n/de/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/el/advanced/payments.md b/i18n/el/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/el/advanced/payments.md +++ b/i18n/el/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/el/advanced/tor-overview.md b/i18n/el/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/el/advanced/tor-overview.md +++ b/i18n/el/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/el/basics/account-creation.md b/i18n/el/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/el/basics/account-creation.md +++ b/i18n/el/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/el/basics/common-misconceptions.md b/i18n/el/basics/common-misconceptions.md index 5fbb5235..19b5a881 100644 --- a/i18n/el/basics/common-misconceptions.md +++ b/i18n/el/basics/common-misconceptions.md @@ -75,20 +75,23 @@ schema: Ένα από τα πιο ξεκάθαρα μοντέλα απειλών είναι εκείνο, όπου οι άνθρωποι *γνωρίζουν ποιος είστε* και εκείνο όπου δε γνωρίζουν. Πάντα θα υπάρχουν περιπτώσεις, στις οποίες θα πρέπει να δηλώσετε το νόμιμο όνομά σας και άλλες στις οποίες δε χρειάζεται να το κάνετε αυτό. -1. **Πραγματική ταυτότητα** - Η πραγματική ταυτότητα χρησιμοποιείται για πράγματα στα οποία πρέπει να δηλώσετε το όνομά σας. Υπάρχουν πολλά νομικά έγγραφα και συμβόλαια, όπου απαιτείται μία νομική ταυτότητα. Μεταξύ άλλων απαιτείται για το άνοιγμα ενός τραπεζικού λογαριασμού, την υπογραφή ενός μισθωτηρίου ακινήτου, την απόκτηση διαβατηρίου, τις τελωνειακές δηλώσεις, όταν εισαγάγετε αντικείμενα ή για οποιαδήποτε άλλη συναλλαγή με την κυβέρνηση. Αυτά τα πράγματα συνήθως οδηγούν σε διαπιστευτήρια όπως πιστωτικές κάρτες, ελέγχους πιστοληπτικής ικανότητας, αριθμούς λογαριασμών και ενδεχομένως φυσικές διευθύνσεις. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Δεν προτείνουμε τη χρήση VPN ή Tor για κανένα από αυτά τα πράγματα, καθώς η ταυτότητά σας είναι ήδη γνωστή μέσα από άλλα μέσα. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! συμβουλή - - Όταν κάνετε ηλεκτρονικές αγορές, η χρήση μίας[θυρίδας δεμάτων] (https://en.wikipedia.org/wiki/Parcel_locker) μπορεί να σας βοηθήσει να διατηρήσετε τη φυσική σας διεύθυνση ιδιωτική. +
+

Tip

+ +Όταν κάνετε ηλεκτρονικές αγορές, η χρήση μίας[θυρίδας δεμάτων] (https://en.wikipedia.org/wiki/Parcel_locker) μπορεί να σας βοηθήσει να διατηρήσετε τη φυσική σας διεύθυνση ιδιωτική. + +
2. **Άγνωστη ταυτότητα** - Μια άγνωστη ταυτότητα θα μπορούσε να είναι ένα σταθερό ψευδώνυμο, που χρησιμοποιείτε τακτικά. Δεν είναι ανώνυμο, διότι δεν αλλάζει. Αν είστε μέλος μιας διαδικτυακής κοινότητας, ίσως είναι σκόπιμο να διατηρείτε μια persona, την οποία γνωρίζουν οι άλλοι. Αυτό το ψευδώνυμο δεν είναι ανώνυμο, διότι, αν παρακολουθείται για αρκετό χρονικό διάστημα, λεπτομέρειες σχετικά με τον ιδιοκτήτη μπορούν να αποκαλύψουν περαιτέρω πληροφορίες, όπως ο τρόπος που γράφει, οι γενικές γνώσεις του για θέματα, που τον ενδιαφέρουν κ. λ. π. - Ίσως, είναι εύλογο να χρησιμοποιήσετε ένα VPN γι' αυτό, προκειμένου να αποκρύψετε τη διεύθυνση IP σας. Οι οικονομικές συναλλαγές είναι πιο δύσκολο να συγκαλυφθούν: Θα μπορούσατε να εξετάσετε τη χρήση ανώνυμων κρυπτονομισμάτων, όπως το [Monero](https://www.getmonero.org/). Η χρήση altcoin shifting μπορεί επίσης να σας βοηθήσει, να αποκρύψετε την προέλευση των νομισμάτων σας. Συνήθως, τα ανταλλακτήρια απαιτούν την ολοκλήρωση του KYC (know your customer), προτού σας επιτρέψουν να ανταλλάξετε παραστατικό χρήμα( fiat currency) σε οποιοδήποτε είδος κρυπτονομίσματος. Οι επιλογές συνάντησης σε τοπικό επίπεδο μπορούν επίσης να αποτελέσουν μια λύση. Ωστόσο, αυτές είναι συχνά πιο ακριβές και ενδέχεται σε ορισμένες περιπτώσεις να απαιτούν KYC. +Ίσως, είναι εύλογο να χρησιμοποιήσετε ένα VPN γι' αυτό, προκειμένου να αποκρύψετε τη διεύθυνση IP σας. Οι οικονομικές συναλλαγές είναι πιο δύσκολο να συγκαλυφθούν: Θα μπορούσατε να εξετάσετε τη χρήση ανώνυμων κρυπτονομισμάτων, όπως το [Monero](https://www.getmonero.org/). Η χρήση altcoin shifting μπορεί επίσης να σας βοηθήσει, να αποκρύψετε την προέλευση των νομισμάτων σας. Συνήθως, τα ανταλλακτήρια απαιτούν την ολοκλήρωση του KYC (know your customer), προτού σας επιτρέψουν να ανταλλάξετε παραστατικό χρήμα( fiat currency) σε οποιοδήποτε είδος κρυπτονομίσματος. Οι επιλογές συνάντησης σε τοπικό επίπεδο μπορούν επίσης να αποτελέσουν μια λύση. Ωστόσο, αυτές είναι συχνά πιο ακριβές και ενδέχεται σε ορισμένες περιπτώσεις να απαιτούν KYC. 3. **Ανώνυμη ταυτότητα** - Ακόμα και όταν υπάρχει εμπειρία, οι ανώνυμες ταυτότητες είναι δύσκολο να διατηρηθούν για μεγάλα χρονικά διαστήματα. Θα πρέπει να είναι βραχυπρόθεσμες και βραχύβιες ταυτότητες, οι οποίες εναλλάσσονται τακτικά. - Η χρήση του Tor μπορεί να βοηθήσει με αυτό. Αξίζει επίσης να σημειωθεί ότι η επίτευξη μεγαλύτερης ανωνυμίας είναι δυνατή μέσω της ασύγχρονης επικοινωνίας: Η επικοινωνία σε πραγματικό χρόνο είναι ευάλωτη έναντι μιας ενδεχόμενης ανάλυσης των μοτίβων πληκτρολόγησης (π.χ. περισσότερο κείμενο από μια παράγραφο, το οποίο διανέμεται σε ένα φόρουμ, μέσω ηλεκτρονικού ταχυδρομείου κ.λπ.) +Η χρήση του Tor μπορεί να βοηθήσει με αυτό. Αξίζει επίσης να σημειωθεί ότι η επίτευξη μεγαλύτερης ανωνυμίας είναι δυνατή μέσω της ασύγχρονης επικοινωνίας: Η επικοινωνία σε πραγματικό χρόνο είναι ευάλωτη έναντι μιας ενδεχόμενης ανάλυσης των μοτίβων πληκτρολόγησης (π.χ. περισσότερο κείμενο από μια παράγραφο, το οποίο διανέμεται σε ένα φόρουμ, μέσω ηλεκτρονικού ταχυδρομείου κ.λπ.) [^1]: Ένα αξιοσημείωτο παράδειγμα αυτού, είναι το περιστατικό [2021, όπου ερευνητές του Πανεπιστημίου της Μινεσότα εισήγαγαν τρία τρωτά σημεία στο έργο ανάπτυξης του πυρήνα Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/el/basics/common-threats.md b/i18n/el/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/el/basics/common-threats.md +++ b/i18n/el/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/el/basics/multi-factor-authentication.md b/i18n/el/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/el/basics/multi-factor-authentication.md +++ b/i18n/el/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/el/basics/passwords-overview.md b/i18n/el/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/el/basics/passwords-overview.md +++ b/i18n/el/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/el/basics/vpn-overview.md b/i18n/el/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/el/basics/vpn-overview.md +++ b/i18n/el/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/el/os/android-overview.md b/i18n/el/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/el/os/android-overview.md +++ b/i18n/el/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/el/os/ios-overview.md b/i18n/el/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/el/os/ios-overview.md +++ b/i18n/el/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/el/os/macos-overview.md b/i18n/el/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/el/os/macos-overview.md +++ b/i18n/el/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/el/os/qubes-overview.md b/i18n/el/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/el/os/qubes-overview.md +++ b/i18n/el/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/eo/advanced/payments.md b/i18n/eo/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/eo/advanced/payments.md +++ b/i18n/eo/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/eo/advanced/tor-overview.md b/i18n/eo/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/eo/advanced/tor-overview.md +++ b/i18n/eo/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/eo/basics/account-creation.md b/i18n/eo/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/eo/basics/account-creation.md +++ b/i18n/eo/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/eo/basics/common-misconceptions.md b/i18n/eo/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/eo/basics/common-misconceptions.md +++ b/i18n/eo/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/eo/basics/common-threats.md b/i18n/eo/basics/common-threats.md index e46d7d45..6391c97a 100644 --- a/i18n/eo/basics/common-threats.md +++ b/i18n/eo/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/eo/basics/multi-factor-authentication.md b/i18n/eo/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/eo/basics/multi-factor-authentication.md +++ b/i18n/eo/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/eo/basics/passwords-overview.md b/i18n/eo/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/eo/basics/passwords-overview.md +++ b/i18n/eo/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/eo/basics/vpn-overview.md b/i18n/eo/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/eo/basics/vpn-overview.md +++ b/i18n/eo/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/eo/os/android-overview.md b/i18n/eo/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/eo/os/android-overview.md +++ b/i18n/eo/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/eo/os/ios-overview.md b/i18n/eo/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/eo/os/ios-overview.md +++ b/i18n/eo/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/eo/os/macos-overview.md b/i18n/eo/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/eo/os/macos-overview.md +++ b/i18n/eo/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/eo/os/qubes-overview.md b/i18n/eo/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/eo/os/qubes-overview.md +++ b/i18n/eo/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/es/advanced/payments.md b/i18n/es/advanced/payments.md index 69b2ed02..772f2976 100644 --- a/i18n/es/advanced/payments.md +++ b/i18n/es/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Pagos Privados +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ Estas tienden a ser buenas opciones para pagos recurrentes/de suscripción en l Las criptomonedas son una forma digital de moneda diseñada para funcionar sin autoridades centrales como un gobierno o un banco. Mientras que *algunos* proyectos de criptodivisas pueden permitirle realizar transacciones privadas en línea, muchos utilizan una blockchain pública que no proporciona ninguna privacidad en las transacciones. Las criptomonedas también tienden a ser activos muy volátiles, lo que significa que su valor puede cambiar rápida y significativamente en cualquier momento. Por ello, en general no recomendamos utilizar criptomonedas como depósito de valor a largo plazo. Si decides utilizar criptomoneda en línea, asegúrate de conocer bien sus aspectos de privacidad de antemano, y sólo invierte cantidades cuya pérdida no sea desastrosa. -!!! peligro +
+

Peligro

- La gran mayoría de las criptomonedas operan en una cadena de bloques **pública**, lo que significa que cada transacción es de dominio público. Esto incluye incluso las criptomonedas más conocidas, como Bitcoin y Ethereum. Las transacciones con estas criptomonedas no deben considerarse privadas y no protegerán tu anonimato. - - Además, muchas criptomonedas, si no la mayoría, son estafas. Únicamente realice transacciones con los proyectos en los que confíe. +La gran mayoría de las criptomonedas operan en una cadena de bloques **pública**, lo que significa que cada transacción es de dominio público. Esto incluye incluso las criptomonedas más conocidas, como Bitcoin y Ethereum. Las transacciones con estas criptomonedas no deben considerarse privadas y no protegerán tu anonimato. + +Además, muchas criptomonedas, si no la mayoría, son estafas. Únicamente realice transacciones con los proyectos en los que confíe. + +
### Monedas de Privacidad diff --git a/i18n/es/advanced/tor-overview.md b/i18n/es/advanced/tor-overview.md index ede797d1..6e7a9229 100644 --- a/i18n/es/advanced/tor-overview.md +++ b/i18n/es/advanced/tor-overview.md @@ -45,13 +45,16 @@ Es difícil establecer malas configuraciones como estas accidentalmente, porque --- -!!! info "Huella digital VPN/SSH" +
+

VPN/SSH Fingerprinting

- El Proyecto Tor [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) que *teóricamente* usar una VPN para ocultar las actividades Tor de tu ISP puede no ser infalible. Se ha descubierto que las VPN son vulnerables a las huellas digitales de tráfico de sitios web, en las que un adversario puede adivinar qué sitio web se está visitando, ya que todos los sitios web tienen patrones de tráfico específicos. - - Por lo tanto, no es descabellado creer que el tráfico Tor encriptado oculto por una VPN también podría ser detectado mediante métodos similares. No existen trabajos de investigación sobre este tema, y seguimos considerando que las ventajas de utilizar una VPN superan con creces estos riesgos, pero es algo a tener en cuenta. - - Si todavía crees que los "pluggable transports" (puentes) proporcionan una protección adicional contra la huella digital del tráfico del sitio web que una VPN no proporciona, siempre tienes la opción de utilizar un puente **y** una VPN conjuntamente. +El Proyecto Tor [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) que *teóricamente* usar una VPN para ocultar las actividades Tor de tu ISP puede no ser infalible. Se ha descubierto que las VPN son vulnerables a las huellas digitales de tráfico de sitios web, en las que un adversario puede adivinar qué sitio web se está visitando, ya que todos los sitios web tienen patrones de tráfico específicos. + +Por lo tanto, no es descabellado creer que el tráfico Tor encriptado oculto por una VPN también podría ser detectado mediante métodos similares. No existen trabajos de investigación sobre este tema, y seguimos considerando que las ventajas de utilizar una VPN superan con creces estos riesgos, pero es algo a tener en cuenta. + +Si todavía crees que los "pluggable transports" (puentes) proporcionan una protección adicional contra la huella digital del tráfico del sitio web que una VPN no proporciona, siempre tienes la opción de utilizar un puente **y** una VPN conjuntamente. + +
Determinar si deberías usar primero una VPN para conectarte a la red Tor requerirá algo de sentido común y conocimiento de las políticas de tu propio gobierno e ISP en relación a lo que te estás conectando. Sin embargo, de nuevo, en la mayoría de los casos será mejor que te vean conectándose a una red VPN comercial que directamente a la red Tor. Si los proveedores VPN están censurados en tu área, entonces también puedes considerar usar "pluggable transports" Tor (p.e. Snowflake o meek bridges) como alternativa, pero usar estos puentes puede levantar más sospechas que los túneles estándar WireGuard/OpenVPN. diff --git a/i18n/es/basics/account-creation.md b/i18n/es/basics/account-creation.md index 60d5caf2..7b284652 100644 --- a/i18n/es/basics/account-creation.md +++ b/i18n/es/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Cómo Crear Cuentas de Internet Privadas - Privacy Guides" -title: "Creación de cuenta" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: Crear cuentas en línea es prácticamente una necesidad en Internet, sigue estos pasos para asegurarte de mantener tu privacidad. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- A menudo la gente se inscribe en servicios sin pensar. Tal vez sea un servicio de streaming para que puedas ver ese nuevo show del que todo el mundo habla, o una cuenta que te da un descuento para tu lugar de comida rápida favorito. Sea cual sea el caso, debes tener en cuenta las implicaciones que tednrá para tus datos ahora y más adelante. @@ -29,9 +29,12 @@ Usualmente hay varias maneras para registrarse, cada una tiene sus propias venta La manera más común de crear una nueva cuenta es utilizando una dirección de correo electrónico y una contraseña. Cuando se utiliza este método, se debe utilizar un gestor de contraseñas y seguir las [mejores prácticas](passwords-overview.md) respecto a las contraseñas. -!!! tip "Consejo" +
+

Consejo

- ¡También puedes usar un gestor de contraseñas para organizar otros métodos de autenticación! Solo añade la nueva entrada y completa los espacios apropiados, puedes agregar notas para cosas como las preguntas de seguridad o una llave de respaldo. +¡También puedes usar un gestor de contraseñas para organizar otros métodos de autenticación! Solo añade la nueva entrada y completa los espacios apropiados, puedes agregar notas para cosas como las preguntas de seguridad o una llave de respaldo. + +
Usted es responsable de gestionar sus credenciales de ingreso. Para mayor seguridad, se puede configurar la [autenticación multifactor](multi-factor-authentication.md) en las cuentas. diff --git a/i18n/es/basics/common-misconceptions.md b/i18n/es/basics/common-misconceptions.md index 3d7e03f9..b55365dc 100644 --- a/i18n/es/basics/common-misconceptions.md +++ b/i18n/es/basics/common-misconceptions.md @@ -75,20 +75,23 @@ Así que, ¿cómo podría verse esto? Uno de los modelos de amenaza más claros es aquel en el que la gente *sabe quién eres* y otro en el que no. Siempre habrá situaciones en las que debes declarar tu nombre legal y otras en las que no es necesario. -1. **Identidad conocida** - Una identidad conocida se utiliza para cosas en las que debes declarar tu nombre. Hay muchos documentos legales y contratos en los que se requiere una identidad legal. Esto puede abarcar desde la apertura de una cuenta bancaria, la firma de un contrato de arrendamiento de una propiedad, la obtención de un pasaporte, las declaraciones de aduana al importar artículos o cualquier otro trámite con tu Gobierno. Por lo general, estas cosas conducirán a credenciales como tarjetas de crédito, controles de calificación crediticia, números de cuenta y, posiblemente, direcciones físicas. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - No sugerimos usar una VPN o Tor para ninguna de estas cosas, ya que tu identidad ya es conocida por otros medios. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "Consejo" - - Al comprar en línea, el uso de un [casillero de paquetes](https://en.wikipedia.org/wiki/Parcel_locker) puede ayudar a mantener la privacidad de tu dirección física. +
+

Consejo

+ +Al comprar en línea, el uso de un [casillero de paquetes](https://en.wikipedia.org/wiki/Parcel_locker) puede ayudar a mantener la privacidad de tu dirección física. + +
2. **Identidad desconocida** - Una identidad desconocida podría ser un seudónimo estable que utilizas con regularidad. No es anónimo porque no cambia. Si formas parte de una comunidad en línea, es posible que desees mantener un personaje que los demás conozcan. Este seudónimo no es anónimo porque, si se vigila durante el tiempo suficiente, los detalles sobre el propietario pueden revelar más información, como su forma de escribir, sus conocimientos generales sobre temas de interés, etc. - Es posible que desees utilizar una VPN para esto, para enmascarar tu dirección IP. Las transacciones financieras son más difíciles de enmascarar: Podrías considerar el uso de criptomonedas anónimas, como [Monero](https://www.getmonero.org/). El cambio a una moneda alternativa también puede ayudar a disfrazar dónde se originó tu moneda. Por lo general, los intercambios requieren que el KYC (conoce a tu cliente) se complete antes de que te permitan cambiar moneda fiduciaria a cualquier tipo de criptomoneda. Las opciones de encuentros locales también pueden ser una solución; sin embargo, suelen ser más caras y, a veces, también requieren KYC. +Es posible que desees utilizar una VPN para esto, para enmascarar tu dirección IP. Las transacciones financieras son más difíciles de enmascarar: Podrías considerar el uso de criptomonedas anónimas, como [Monero](https://www.getmonero.org/). El cambio a una moneda alternativa también puede ayudar a disfrazar dónde se originó tu moneda. Por lo general, los intercambios requieren que el KYC (conoce a tu cliente) se complete antes de que te permitan cambiar moneda fiduciaria a cualquier tipo de criptomoneda. Las opciones de encuentros locales también pueden ser una solución; sin embargo, suelen ser más caras y, a veces, también requieren KYC. 3. **Identidad anónima** - Incluso con experiencia, las identidades anónimas son difíciles de mantener durante largos periodos de tiempo. Deben ser identidades a corto plazo y de corta duración que roten regularmente. - Usar Tor puede ayudar con esto. También cabe destacar que es posible un mayor anonimato mediante la comunicación asíncrona: La comunicación en tiempo real es vulnerable al análisis de los patrones de escritura (es decir, más de un párrafo de texto, distribuido en un foro, por correo electrónico, etc.) +Usar Tor puede ayudar con esto. También cabe destacar que es posible un mayor anonimato mediante la comunicación asíncrona: La comunicación en tiempo real es vulnerable al análisis de los patrones de escritura (es decir, más de un párrafo de texto, distribuido en un foro, por correo electrónico, etc.) [^1]: Un ejemplo notable de esto es [el incidente de 2021 en el que investigadores de la Universidad de Minnesota introdujeron tres vulnerabilidades en el proyecto de desarrollo del kernel de Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/es/basics/common-threats.md b/i18n/es/basics/common-threats.md index 1ce58576..c8f381a4 100644 --- a/i18n/es/basics/common-threats.md +++ b/i18n/es/basics/common-threats.md @@ -35,19 +35,25 @@ En lo que respecta a la seguridad de las aplicaciones, generalmente no sabemos ( Para minimizar el daño que una pieza maliciosa de software *podría hacer*, deberías emplear la seguridad por compartimentación. Por ejemplo, esto podría darse en la forma de usar diferentes ordenadores para diferentes trabajos, usar máquinas virtuales para separar diferentes grupos de aplicaciones relacionadas, o usar un sistema operativo seguro con un fuerte enfoque en el aislamiento de aplicaciones y el control de acceso obligatorio. -!!! tip "Consejo" +
+

Consejo

- Los sistemas operativos móviles suelen tener un mejor aislamiento de aplicaciones que los sistemas operativos de escritorio: Las aplicaciones no pueden obtener acceso a la raíz y requieren permiso para acceder a los recursos del sistema. - - Los sistemas operativos de escritorio generalmente se retrasan en el aislamiento adecuado. ChromeOS tiene capacidades de aislamiento similares a las de Android, y macOS tiene un control total de los permisos del sistema (y los desarrolladores pueden optar por el aislamiento para las aplicaciones). Sin embargo, estos sistemas operativos transmiten información de identificación a sus respectivos OEM. Linux tiende a no enviar información a los proveedores de sistemas, pero tiene poca protección contra los exploits y las aplicaciones maliciosas. Esto puede mitigarse un poco con distribuciones especializadas que hagan un uso significativo de máquinas virtuales o contenedores, como [Qubes OS](../desktop.md#qubes-os). +Los sistemas operativos móviles suelen tener un mejor aislamiento de aplicaciones que los sistemas operativos de escritorio: Las aplicaciones no pueden obtener acceso a la raíz y requieren permiso para acceder a los recursos del sistema. + +Los sistemas operativos de escritorio generalmente se retrasan en el aislamiento adecuado. ChromeOS tiene capacidades de aislamiento similares a las de Android, y macOS tiene un control total de los permisos del sistema (y los desarrolladores pueden optar por el aislamiento para las aplicaciones). Sin embargo, estos sistemas operativos transmiten información de identificación a sus respectivos OEM. Linux tiende a no enviar información a los proveedores de sistemas, pero tiene poca protección contra los exploits y las aplicaciones maliciosas. Esto puede mitigarse un poco con distribuciones especializadas que hagan un uso significativo de máquinas virtuales o contenedores, como [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Ataques dirigidos Los ataques dirigidos contra una persona concreta son más problemáticos de tratar. Los ataques más comunes son el envío de documentos maliciosos por correo electrónico, la explotación de vulnerabilidades (por ejemplo, en los navegadores y sistemas operativos) y los ataques físicos. Si esto te preocupa, deberías emplear estrategias de mitigación de amenazas más avanzadas. -!!! tip "Consejo" +
+

Consejo

- Por su diseño, los **navegadores web**, los **clientes de correo electrónico** y las **aplicaciones de oficina** suelen ejecutar código no fiable, enviado por terceros. Ejecutar múltiples máquinas virtuales -para separar aplicaciones como estas de su sistema anfitrión, así como entre sí- es una técnica que puedes utilizar para mitigar la posibilidad de que un exploit en estas aplicaciones comprometa el resto de tu sistema. Por ejemplo, tecnologías como Qubes OS o Microsoft Defender Application Guard en Windows proporcionan métodos convenientes para hacerlo. +Por su diseño, los **navegadores web**, los **clientes de correo electrónico** y las **aplicaciones de oficina** suelen ejecutar código no fiable, enviado por terceros. Ejecutar múltiples máquinas virtuales -para separar aplicaciones como estas de su sistema anfitrión, así como entre sí- es una técnica que puedes utilizar para mitigar la posibilidad de que un exploit en estas aplicaciones comprometa el resto de tu sistema. Por ejemplo, tecnologías como Qubes OS o Microsoft Defender Application Guard en Windows proporcionan métodos convenientes para hacerlo. + +
Si te preocupan los **ataques físicos** deberías utilizar un sistema operativo con una implementación de arranque seguro verificado, como Android, iOS, macOS o [Windows (con TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). También deberías asegurarte de que tu disco esté encriptado y de que el sistema operativo utiliza un TPM o Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) o [Element](https://developers.google.com/android/security/android-ready-se) para limitar los intentos de introducir la frase de contraseña de encriptación. Deberías evitar compartir tu ordenador con personas que no sean de tu confianza, ya que la mayoría de los sistemas operativos de escritorio no cifran los datos por separado para cada usuario. @@ -61,13 +67,16 @@ El problema obvio de esto es que el proveedor de servicios (o un hacker que haya Afortunadamente, E2EE puede aliviar este problema encriptando las comunicaciones entre tú y los destinatarios deseados antes de que se envíen al servidor. La confidencialidad de tus mensajes está garantizada, suponiendo que el proveedor de servicios no tenga acceso a las claves privadas de ninguna de las partes. -!!! note "Nota sobre el cifrado basado en la web" +
+

Note on Web-based Encryption

- En la práctica, la eficacia de las diferentes implementaciones de E2EE varía. Las aplicaciones, como [Signal](../real-time-communication.md#signal), se ejecutan de forma nativa en tu dispositivo, y cada copia de la aplicación es la misma en diferentes instalaciones. Si el proveedor de servicios introdujera un [backdoor](https://es.wikipedia.org/wiki/Puerta_trasera) en su aplicación -en un intento de robar tus claves privadas- podría ser detectado posteriormente con [ingeniería inversa](https://es.wikipedia.org/wiki/Ingenier%C3%Ada_inversa). - - Por otro lado, las implementaciones E2EE basadas en la web, como el webmail de Proton Mail o *Web Vault* de Bitwarden, dependen de que el servidor sirva dinámicamente código JavaScript al navegador para manejar la criptografía. Un servidor malicioso puede dirigirse a ti y enviarte un código JavaScript malicioso para robar tu clave de cifrado (y sería extremadamente difícil de notar). Dado que el servidor puede elegir servir diferentes clientes de la web a diferentes personas -incluso si te diste cuenta del ataque- sería increíblemente difícil probar la culpabilidad del proveedor. - - Por lo tanto, siempre que sea posible, hay que utilizar aplicaciones nativas en lugar de clientes web. +En la práctica, la eficacia de las diferentes implementaciones de E2EE varía. Las aplicaciones, como [Signal](../real-time-communication.md#signal), se ejecutan de forma nativa en tu dispositivo, y cada copia de la aplicación es la misma en diferentes instalaciones. Si el proveedor de servicios introdujera un [backdoor](https://es.wikipedia.org/wiki/Puerta_trasera) en su aplicación -en un intento de robar tus claves privadas- podría ser detectado posteriormente con [ingeniería inversa](https://es.wikipedia.org/wiki/Ingenier%C3%Ada_inversa). + +Por otro lado, las implementaciones E2EE basadas en la web, como el webmail de Proton Mail o *Web Vault* de Bitwarden, dependen de que el servidor sirva dinámicamente código JavaScript al navegador para manejar la criptografía. Un servidor malicioso puede dirigirse a ti y enviarte un código JavaScript malicioso para robar tu clave de cifrado (y sería extremadamente difícil de notar). Dado que el servidor puede elegir servir diferentes clientes de la web a diferentes personas -incluso si te diste cuenta del ataque- sería increíblemente difícil probar la culpabilidad del proveedor. + +Por lo tanto, siempre que sea posible, hay que utilizar aplicaciones nativas en lugar de clientes web. + +
Incluso con E2EE, los proveedores de servicios aún pueden hacerte un perfil basado en **metadatos**, que generalmente no están protegidos. Aunque el proveedor de servicios no puede leer tus mensajes, sí puede observar cosas importantes, como con quién hablas, la frecuencia con la que les envías mensajes y cuándo sueles estar activo. La protección de los metadatos es bastante infrecuente, y -si está dentro de tu [modelo de amenazas](threat-modeling.md)- deberías prestar mucha atención a la documentación técnica del software que estás utilizando para ver si hay alguna minimización o protección de los metadatos. @@ -77,17 +86,23 @@ Incluso con E2EE, los proveedores de servicios aún pueden hacerte un perfil bas La vigilancia masiva es el intrincado esfuerzo por controlar el "comportamiento, muchas actividades o información" de toda una población (o de una fracción sustancial de ella).[^1] Suele referirse a programas gubernamentales, como los que [reveló Edward Snowden en 2013](https://es.wikipedia.org/wiki/Revelaciones_sobre_la_red_de_vigilancia_mundial_(2013-2015)). Sin embargo, también puede ser llevada a cabo por empresas, ya sea en nombre de organismos gubernamentales o por iniciativa propia. -!!! abstract "Atlas de Vigilancia" +
+

Atlas of Surveillance

- Si quiere saber más sobre los métodos de vigilancia y cómo se aplican en su ciudad, también puede echar un vistazo al [Atlas of Surveillance](https://atlasofsurveillance.org/) de la [Electronic Frontier Foundation](https://www.eff.org/). - - En Francia puede consultar el sitio [Technolopolice website](https://technopolice.fr/villes/), mantenido por la asociación sin ánimo de lucro La Quadrature du Net. +Si quiere saber más sobre los métodos de vigilancia y cómo se aplican en su ciudad, también puede echar un vistazo al [Atlas of Surveillance](https://atlasofsurveillance.org/) de la [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Los gobiernos suelen justificar los programas de vigilancia masiva como medios necesarios para combatir el terrorismo y prevenir la delincuencia. Sin embargo, al vulnerar los derechos humanos, se utiliza con mayor frecuencia para atacar desproporcionadamente a grupos minoritarios y disidentes políticos, entre otros. -!!! quote "ACLU: [*La lección de privacidad del 11 de septiembre: La vigilancia masiva no es el camino a seguir*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Ante [las revelaciones de Edward Snowden sobre programas gubernamentales como [PRISM](https://es.wikipedia.org/wiki/PRISM) y [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], los funcionarios de inteligencia también admitieron que la NSA llevaba años recopilando en secreto registros sobre prácticamente todas las llamadas telefónicas de los estadounidenses: quién llama a quién, cuándo se hacen esas llamadas y cuánto duran. Este tipo de información, cuando es recopilada por la NSA día tras día, puede revelar detalles increíblemente sensibles sobre la vida y las asociaciones de las personas, como si han llamado a un pastor, a un proveedor de aborto, a un consejero de adicciones o a una línea directa de suicidio. +Ante [las revelaciones de Edward Snowden sobre programas gubernamentales como [PRISM](https://es.wikipedia.org/wiki/PRISM) y [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], los funcionarios de inteligencia también admitieron que la NSA llevaba años recopilando en secreto registros sobre prácticamente todas las llamadas telefónicas de los estadounidenses: quién llama a quién, cuándo se hacen esas llamadas y cuánto duran. Este tipo de información, cuando es recopilada por la NSA día tras día, puede revelar detalles increíblemente sensibles sobre la vida y las asociaciones de las personas, como si han llamado a un pastor, a un proveedor de aborto, a un consejero de adicciones o a una línea directa de suicidio. + +
A pesar de la creciente vigilancia masiva en Estados Unidos, el gobierno ha descubierto que los programas de vigilancia masiva como Section 215 han tenido "poco valor único" con respecto a la detención de delitos reales o complots terroristas, con esfuerzos que duplican en gran medida los propios programas de vigilancia selectiva del FBI.[^2] @@ -133,11 +148,14 @@ La censura en las plataformas corporativas es cada vez más común, ya que plata Las personas preocupadas por la amenaza de la censura pueden utilizar tecnologías como [Tor](../advanced/tor-overview.md) para eludirla, y apoyar plataformas de comunicación resistentes a la censura como [Matrix](../real-time-communication.md#element), que no tiene una autoridad de cuentas centralizada que pueda cerrar cuentas arbitrariamente. -!!! tip "Consejo" +
+

Consejo

- Si bien evadir la censura en sí misma puede ser fácil, ocultar el hecho de que lo estás haciendo puede ser muy problemático. - - Deberías considerar qué aspectos de la red puede observar tu adversario y si tienes una justificación verosímil para tus acciones. Por ejemplo, el uso de [DNS cifrado](../advanced/dns-overview.md#what-is-encrypted-dns) puede ayudarte a eludir sistemas de censura rudimentarios basados en DNS, pero no puede ocultar realmente lo que visitas a tu ISP. Una VPN o Tor puede ayudar a ocultar lo que estás visitando de los administradores de red, pero no puede ocultar que estás utilizando esas redes en primer lugar. Los transportes conectables (como Obfs4proxy, Meek, o Shadowsocks) pueden ayudarte a evadir cortafuegos que bloquean protocolos VPN comunes o Tor, pero tus intentos de evasión aún pueden ser detectados por métodos como sondeo o [inspección profunda de paquetes](https://es.wikipedia.org/wiki/Inspección_profunda_de_paquete). +Si bien evadir la censura en sí misma puede ser fácil, ocultar el hecho de que lo estás haciendo puede ser muy problemático. + +Deberías considerar qué aspectos de la red puede observar tu adversario y si tienes una justificación verosímil para tus acciones. Por ejemplo, el uso de [DNS cifrado](../advanced/dns-overview.md#what-is-encrypted-dns) puede ayudarte a eludir sistemas de censura rudimentarios basados en DNS, pero no puede ocultar realmente lo que visitas a tu ISP. Una VPN o Tor puede ayudar a ocultar lo que estás visitando de los administradores de red, pero no puede ocultar que estás utilizando esas redes en primer lugar. Los transportes conectables (como Obfs4proxy, Meek, o Shadowsocks) pueden ayudarte a evadir cortafuegos que bloquean protocolos VPN comunes o Tor, pero tus intentos de evasión aún pueden ser detectados por métodos como sondeo o [inspección profunda de paquetes](https://es.wikipedia.org/wiki/Inspección_profunda_de_paquete). + +
Siempre debes tener en cuenta los riesgos de intentar saltarse la censura, las posibles consecuencias y lo sofisticado que puede ser el adversario. Debe ser precavido con la selección del software y tener un plan de respaldo en caso de que te pillen. diff --git a/i18n/es/basics/multi-factor-authentication.md b/i18n/es/basics/multi-factor-authentication.md index d8f44d5c..09ccbf1c 100644 --- a/i18n/es/basics/multi-factor-authentication.md +++ b/i18n/es/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ El comando evitará que un adversario se salte la MFA al arrancar el ordenador. ### Linux -!!! warning "Advertencia" +
+

Advertencia

- Si el nombre de host de tu sistema cambia (por ejemplo, debido al DHCP), no podrás iniciar sesión. Es vital que configures un nombre de host adecuado para tu ordenador antes de seguir esta guía. +Si el nombre de host de tu sistema cambia (por ejemplo, debido al DHCP), no podrás iniciar sesión. Es vital que configures un nombre de host adecuado para tu ordenador antes de seguir esta guía. + +
El módulo `pam_u2f` en Linux puede proporcionar autenticación de dos factores para iniciar sesión en las distribuciones Linux más populares. Si tienes una llave de seguridad de hardware compatible con U2F, puedes configurar la autenticación MFA para tu inicio de sesión. Yubico tiene una guía [Guía de inicio de sesión en Ubuntu Linux - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) que debería funcionar en cualquier distribución. Sin embargo, los comandos del gestor de paquetes—como `"apt-get"`—y los nombres de los paquetes pueden ser diferentes. Esta guía **no** le aplica a Qubes OS. diff --git a/i18n/es/basics/passwords-overview.md b/i18n/es/basics/passwords-overview.md index e2ef3236..822fa708 100644 --- a/i18n/es/basics/passwords-overview.md +++ b/i18n/es/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Introducción a las contraseñas" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Estos son algunos consejos y trucos para crear las contraseñas más seguras y mantener a salvo tus cuentas. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Las contraseñas son una parte esencial de nuestra vida digital cotidiana. Las utilizamos para proteger nuestras cuentas, nuestros dispositivos y nuestros secretos. A pesar de ser a menudo lo único que nos separa de un adversario que busca nuestra información privada, no se piensa mucho en ellas, lo que a menudo lleva a la gente a utilizar contraseñas que pueden ser fácilmente adivinadas o forzadas. @@ -26,9 +26,12 @@ Debes evitar cambiar frecuentemente las contraseñas que debes recordar (como la Cuando se trata de contraseñas que no tienes que recordar (como las contraseñas almacenadas en tu gestor de contraseñas), si tu [modelo de amenazas](threat-modeling.md) lo requiere, recomendamos revisar las cuentas importantes (especialmente las cuentas que no utilizan autenticación multifactor) y cambiar tu contraseña cada dos meses, en caso de que se hayan visto comprometidas en una filtración de datos que aún no se haya hecho pública. La mayoría de los gestores de contraseñas permiten fijar una fecha de caducidad para facilitar su gestión. -!!! tip "Comprobando violaciones de datos" +
+

Checking for data breaches

- Si su gestor de contraseñas te permite comprobar si hay contraseñas comprometidas, asegúrate de hacerlo y cambia inmediatamente cualquier contraseña que pueda haber quedado expuesta en una filtración de datos. Alternativamente, podrías seguir el [feed de Últimos Alcances de Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) con la ayuda de un [agregador de noticias](../news-aggregators.md). +Si su gestor de contraseñas te permite comprobar si hay contraseñas comprometidas, asegúrate de hacerlo y cambia inmediatamente cualquier contraseña que pueda haber quedado expuesta en una filtración de datos. Alternativamente, podrías seguir el [feed de Últimos Alcances de Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) con la ayuda de un [agregador de noticias](../news-aggregators.md). + +
## Creando contraseñas fuertes @@ -48,9 +51,12 @@ Un ejemplo de una frase de contraseña de diceware es `lápiz blando diecisiete Para generar una frase de contraseña diceware utilizando dados reales, sigue estos pasos: -!!! note "Nota" +
+

Nota

- Estas instrucciones asumen que estás usando [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) para generar la frase de contraseña, que requiere cinco tiradas de dados por palabra. Otras listas de palabras pueden requerir más o menos tiradas por palabra, y pueden necesitar una cantidad diferente de palabras para alcanzar la misma entropía. +Estas instrucciones asumen que estás usando [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) para generar la frase de contraseña, que requiere cinco tiradas de dados por palabra. Otras listas de palabras pueden requerir más o menos tiradas por palabra, y pueden necesitar una cantidad diferente de palabras para alcanzar la misma entropía. + +
1. Tira un dado de seis caras cinco veces y anota el número después de cada tirada. @@ -60,31 +66,37 @@ Para generar una frase de contraseña diceware utilizando dados reales, sigue es 4. Repite este proceso hasta que tu frase de contraseña tenga tantas palabras como necesites, que deberás separar con un espacio. -!!! warning "Importante" +
+

Important

- **No** debes volver a tirar las palabras hasta que consigas una combinación que te guste. El proceso debe ser completamente aleatorio. +**No** debes volver a tirar las palabras hasta que consigas una combinación que te guste. El proceso debe ser completamente aleatorio. + +
Si no tienes acceso a dados reales o prefieres no utilizarlos, puedes utilizar el generador de contraseñas integrado en tu gestor de contraseñas, ya que la mayoría de ellos tienen la opción de generar frases de contraseña diceware además de contraseñas normales. Te recomendamos que utilices la gran lista de palabras de [EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) para generar tus frases de contraseña diceware, ya que ofrece exactamente la misma seguridad que la lista original, a la vez que contiene palabras más fáciles de memorizar. También hay [otras listas de palabras en diferentes idiomas](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), si no quieres que tu frase de contraseña esté en inglés. -??? note "Explicación de la entropía y la fuerza de las frases de contraseña diceware" +
+Explanation of entropy and strength of diceware passphrases - Para demostrar lo fuertes que son las frases de contraseña diceware, utilizaremos la frase de contraseña de siete palabras antes mencionada (`viewable fastness reluctant squishy seventeen shown pencil`) y [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) como ejemplo. - - Una métrica para determinar la fuerza de una frase de contraseña diceware es cuánta entropía tiene. La entropía por palabra en una frase de contraseña diceware se calcula como $\text{log}_2(\text{WordsInList})$ y la entropía global de la frase de contraseña se calcula como $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Por lo tanto, cada palabra de la lista mencionada da como resultado ~12,9 bits de entropía ($\text{log}_2(7776)$), y una frase de contraseña de siete palabras derivada de ella tiene ~90,47 bits de entropía ($\text{log}_2(7776^7)$). - - La [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contiene 7776 palabras únicas. Para calcular la cantidad de frases de contraseña posibles, todo lo que tenemos que hacer es $\text{WordsInList}^\text{WordsInPhrase}$, o en nuestro caso, $7776^7$. - - Pongamos todo esto en perspectiva: Una frase de siete palabras utilizando la gran lista de palabras de la EFF (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) es una de las ~1.719.070.799.748.422.500.000.000.000 frases posibles. - - Por término medio, se necesita probar el 50% de todas las combinaciones posibles para adivinar su frase. Teniendo esto en cuenta, incluso si tu adversario es capaz de realizar ~1.000.000.000.000 de intentos por segundo, aún tardaría ~27.255.689 años en adivinar tu frase de contraseña. Esto es así incluso si las siguientes cosas son ciertas: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Tu adversario sabe que has utilizado el método diceware. - - Tu adversario conoce la lista de palabras específica que utilizaste. - - Tu adversario sabe cuántas palabras contiene tu frase de contraseña. +Una métrica para determinar la fuerza de una frase de contraseña diceware es cuánta entropía tiene. La entropía por palabra en una frase de contraseña diceware se calcula como $\text{log}_2(\text{WordsInList})$ y la entropía global de la frase de contraseña se calcula como $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Por lo tanto, cada palabra de la lista mencionada da como resultado ~12,9 bits de entropía ($\text{log}_2(7776)$), y una frase de contraseña de siete palabras derivada de ella tiene ~90,47 bits de entropía ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. Para calcular la cantidad de frases de contraseña posibles, todo lo que tenemos que hacer es $\text{WordsInList}^\text{WordsInPhrase}$, o en nuestro caso, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +Por término medio, se necesita probar el 50% de todas las combinaciones posibles para adivinar su frase. Teniendo esto en cuenta, incluso si tu adversario es capaz de realizar ~1.000.000.000.000 de intentos por segundo, aún tardaría ~27.255.689 años en adivinar tu frase de contraseña. Esto es así incluso si las siguientes cosas son ciertas: + +- Tu adversario sabe que has utilizado el método diceware. +- Tu adversario conoce la lista de palabras específica que utilizaste. +- Tu adversario sabe cuántas palabras contiene tu frase de contraseña. + +
En resumen, las frases de contraseña diceware son tu mejor opción cuando necesitas algo que sea fácil de recordar *y* excepcionalmente fuerte. @@ -98,13 +110,16 @@ Hay muchas buenas opciones para elegir, tanto basadas en la nube como locales. E [Lista de gestores de contraseñas recomendados](../passwords.md ""){.md-button} -!!! warning "No coloques tus contraseñas y tokens TOTP dentro del mismo gestor de contraseñas" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- Cuando utilices códigos TOTP como [autenticación multifactor](../multi-factor-authentication.md), la mejor práctica de seguridad es mantener tus códigos TOTP en una [app separada](../multi-factor-authentication.md#authenticator-apps). - - Almacenar tus tokens TOTP en el mismo lugar que tus contraseñas, aunque cómodo, reduce las cuentas a un único factor en caso de que un adversario acceda a tu gestor de contraseñas. - - Además, no recomendamos almacenar códigos de recuperación de un solo uso en su gestor de contraseñas. Deberían almacenarse por separado, por ejemplo en un contenedor cifrado en un dispositivo de almacenamiento fuera de línea. +Cuando utilices códigos TOTP como [autenticación multifactor](../multi-factor-authentication.md), la mejor práctica de seguridad es mantener tus códigos TOTP en una [app separada](../multi-factor-authentication.md#authenticator-apps). + +Almacenar tus tokens TOTP en el mismo lugar que tus contraseñas, aunque cómodo, reduce las cuentas a un único factor en caso de que un adversario acceda a tu gestor de contraseñas. + +Además, no recomendamos almacenar códigos de recuperación de un solo uso en su gestor de contraseñas. Deberían almacenarse por separado, por ejemplo en un contenedor cifrado en un dispositivo de almacenamiento fuera de línea. + +
### Copias de seguridad diff --git a/i18n/es/basics/vpn-overview.md b/i18n/es/basics/vpn-overview.md index 8a75e7f4..351fea8e 100644 --- a/i18n/es/basics/vpn-overview.md +++ b/i18n/es/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "¿Cómo Protegen Tu Privacidad las VPN? Nuestra Vista General de las VPN - Privacy Guides" -title: Vista general de VPN +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Las Redes Privadas Virtuales desplazan el riesgo de tu proveedor de Internet a un tercero quien confías. Debes tener en cuenta estas cosas. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Las Redes Privadas Virtuales son una forma de ampliar el extremo de tu red para que salga por otro lugar en el mundo. @@ -11,9 +11,12 @@ Normalmente, un ISP puede ver el flujo de tráfico de Internet que entra y sale El uso de una VPN oculta incluso esta información a tu ISP, al trasladar la confianza que depositas en tu red a un servidor situado en otro lugar del mundo. Como resultado, el ISP solo ve que estás conectado a una VPN y nada sobre la actividad que estás pasando a través de ella. -!!! note "Nota" +
+

Nota

- Cuando hablamos de "Redes Privadas Virtuales" en este sitio web, normalmente nos referimos a [proveedores de VPN](../vpn.md) **comerciales**, a los que usted paga una cuota mensual a cambio de enrutar tu tráfico de Internet de forma segura a través de sus servidores públicos. Existen muchas otras formas de VPN, como las que alojas tú mismo o las que gestionan los centros de trabajo, que te permiten conectarte de forma segura a los recursos de red internos o de los empleados; sin embargo, estas VPN suelen estar diseñadas para acceder de forma segura a redes remotas, en lugar de para proteger la privacidad de tu conexión a Internet. +Cuando hablamos de "Redes Privadas Virtuales" en este sitio web, normalmente nos referimos a [proveedores de VPN](../vpn.md) **comerciales**, a los que usted paga una cuota mensual a cambio de enrutar tu tráfico de Internet de forma segura a través de sus servidores públicos. Existen muchas otras formas de VPN, como las que alojas tú mismo o las que gestionan los centros de trabajo, que te permiten conectarte de forma segura a los recursos de red internos o de los empleados; sin embargo, estas VPN suelen estar diseñadas para acceder de forma segura a redes remotas, en lugar de para proteger la privacidad de tu conexión a Internet. + +
## ¿Cómo funciona una VPN? diff --git a/i18n/es/os/android-overview.md b/i18n/es/os/android-overview.md index 7c4ca6bd..ad9b445b 100644 --- a/i18n/es/os/android-overview.md +++ b/i18n/es/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Vista general de Android +title: Android Overview icon: simple/android -description: Android es un sistema operativo de código abierto con fuertes medidas de seguridad, lo que lo convierte en nuestra primera opción para teléfonos. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Logotipo de Android](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Una aplicación puede solicitar un permiso para una función específica que ten [Exodus](https://exodus-privacy.eu.org/) puede ser útil para comparar aplicaciones con fines similares. Si una aplicación requiere muchos permisos y tiene un montón de publicidad y analíticas, probablemente sea un mal signo. Recomendamos consultar cada uno de los rastreadores y leer sus descripciones, en lugar de limitarse a **contar el total** y asumir que todos los elementos enumerados son iguales. -!!! warning "Advertencia" +
+

Advertencia

- Si una aplicación es principalmente un servicio basado en web, el seguimiento puede producirse en el lado del servidor. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) indica que "no hay rastreadores", pero lo cierto es que sí rastrea los intereses y el comportamiento de los usuarios en todo el sitio. Las aplicaciones pueden eludir la detección si no utilizan las bibliotecas de código estándar producidas por la industria publicitaria, aunque esto es poco probable. +Si una aplicación es principalmente un servicio basado en web, el seguimiento puede producirse en el lado del servidor. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) indica que "no hay rastreadores", pero lo cierto es que sí rastrea los intereses y el comportamiento de los usuarios en todo el sitio. Las aplicaciones pueden eludir la detección si no utilizan las bibliotecas de código estándar producidas por la industria publicitaria, aunque esto es poco probable. -!!! note "Nota" +
- Las aplicaciones que respetan la privacidad, como [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/), pueden mostrar algunos rastreadores como [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). Esta biblioteca incluye [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) que puede proporcionar [notificaciones push](https://es.wikipedia.org/wiki/Tecnología_push) en las aplicaciones. Este [es el caso](https://fosstodon.org/@bitwarden/109636825700482007) con Bitwarden. Esto no significa que Bitwarden utilice todas las funciones analíticas que ofrece Google Firebase Analytics. +
+

Nota

+ +Las aplicaciones que respetan la privacidad, como [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/), pueden mostrar algunos rastreadores como [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). Esta biblioteca incluye [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) que puede proporcionar [notificaciones push](https://es.wikipedia.org/wiki/Tecnología_push) en las aplicaciones. Este [es el caso](https://fosstodon.org/@bitwarden/109636825700482007) con Bitwarden. Esto no significa que Bitwarden utilice todas las funciones analíticas que ofrece Google Firebase Analytics. + +
## Funciones de Privacidad diff --git a/i18n/es/os/ios-overview.md b/i18n/es/os/ios-overview.md index edbebc99..781580dd 100644 --- a/i18n/es/os/ios-overview.md +++ b/i18n/es/os/ios-overview.md @@ -1,7 +1,7 @@ --- -title: Vista general de iOS +title: iOS Overview icon: simple/apple -description: iOS es un sistema operativo móvil desarrollado por Apple para el iPhone. +description: iOS is a mobile operating system developed by Apple for the iPhone. --- **iOS** y **iPadOS** son sistemas operativos móviles patentados desarrollados por Apple para sus productos iPhone y iPad, respectivamente. Si tienes un dispositivo móvil de Apple, puedes aumentar tu privacidad desactivando algunas funciones de telemetría integradas y reforzando algunos ajustes de privacidad y seguridad integrados en el sistema. @@ -146,9 +146,12 @@ Después de activar la protección de datos robados, [ciertas acciones](https:// Los iPhones ya son resistentes a los ataques de fuerza bruta, ya que te hacen esperar largos periodos de tiempo después de varios intentos fallidos; sin embargo, históricamente ha habido exploits para sortear esto. Para mayor seguridad, puedes configurar tu teléfono para que se borre automáticamente después de 10 intentos fallidos. -!!! warning "Advertencia" +
+

Advertencia

- Con esta opción activada, alguien podría borrar intencionadamente tu teléfono introduciendo muchas veces una contraseña incorrecta. Asegúrate de tener copias de seguridad adecuadas y activa esta configuración sólo si te sientes cómodo con ella. +Con esta opción activada, alguien podría borrar intencionadamente tu teléfono introduciendo muchas veces una contraseña incorrecta. Asegúrate de tener copias de seguridad adecuadas y activa esta configuración sólo si te sientes cómodo con ella. + +
- [x] Activa **Borrar Datos** diff --git a/i18n/es/os/macos-overview.md b/i18n/es/os/macos-overview.md index a1d9d6e5..c372a7ca 100644 --- a/i18n/es/os/macos-overview.md +++ b/i18n/es/os/macos-overview.md @@ -1,7 +1,7 @@ --- -title: Vista general de macOS +title: macOS Overview icon: material/apple-finder -description: macOS es el sistema operativo de escritorio de Apple que trabaja con su hardware para ofrecer una seguridad sólida. +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- **macOS** es un sistema operativo Unix desarrollado por Apple para sus ordenadores Mac. Para mejorar la privacidad en macOS, puedes desactivar las funciones de telemetría y reforzar los ajustes de privacidad y seguridad existentes. @@ -156,9 +156,12 @@ macOS utiliza la defensa en profundidad, confiando en múltiples capas de protec ### Seguridad del software -!!! warning "Advertencia" +
+

Advertencia

- macOS permite instalar actualizaciones de prueba. Estas son inestables y pueden incluir telemetría adicional, porque son para fines de prueba. Debido a esto, recomendamos evitar las actualizaciones de prueba del software en general. +macOS permite instalar actualizaciones de prueba. Estas son inestables y pueden incluir telemetría adicional, porque son para fines de prueba. Debido a esto, recomendamos evitar las actualizaciones de prueba del software en general. + +
#### Volumen firmado del sistema @@ -178,9 +181,12 @@ La Protección de la integridad del sistema hace que las ubicaciones de los arch Para las aplicaciones de macOS descargadas desde App Store, es necesario que estas se encuentren virtualizadas utilizando el [Sandbox de aplicaciones](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning "Advertencia" +
+

Advertencia

- El software descargado desde fuera de la App Store oficial no necesita ser virtualizado. Debes evitar en la medida de lo posible el software que no se encuentre en la App Store. +El software descargado desde fuera de la App Store oficial no necesita ser virtualizado. Debes evitar en la medida de lo posible el software que no se encuentre en la App Store. + +
##### Antivirus diff --git a/i18n/es/os/qubes-overview.md b/i18n/es/os/qubes-overview.md index ea53214a..b5f0cd83 100644 --- a/i18n/es/os/qubes-overview.md +++ b/i18n/es/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes es un sistema operativo basado en el aislamiento de aplicacio Qubes utiliza la [compartimentación](https://www.qubes-os.org/intro/) para mantener el sistema seguro. Qubes son creados de plantillas, las predeterminadas siendo para Fedora, Debian y [Whonix](../desktop.md#whonix). Qubes OS también permite crear *qubes* [desechables](https://www.qubes-os.org/doc/how-to-use-disposables/) de un solo uso. -??? "El término *qubes* es actualizado gradualmente para evitar las referencias a estos como "máquinas virtuales"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Parte de la información que se encuentra aquí y en la documentación de Qubes OS puede contener lenguaje contradictorio, debido a que el término de "appVM" es gradualmente cambiado a "qube". Los Qubes no son máquinas virtuales completas, pero pueden contener funciones similares a las máquinas virtuales. +Parte de la información que se encuentra aquí y en la documentación de Qubes OS puede contener lenguaje contradictorio, debido a que el término de "appVM" es gradualmente cambiado a "qube". Los Qubes no son máquinas virtuales completas, pero pueden contener funciones similares a las máquinas virtuales. + +
![Arquitectura Qubes](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Arquitectura, Crédito: Qué es Qubes OS Introducción
@@ -41,9 +44,12 @@ Puedes [copiar y pegar texto](https://www.qubes-os.org/doc/how-to-copy-and-paste Para copiar y pegar archivos y directorios (carpetas) entre un *qube* y otro, puedes usar la opción **Copiar a otro AppVM...** o **Mover a otro AppVM...**. La diferencia es que la opción **Mover** borrará el archivo original. Cualquier opción protegerá al portapapeles de ser filtrado a cualquier otro *qube*. Esto es más seguro que la transferencia de archivos guardados. Una computadora con tapón de aire puede ser forzada a analizar particiones o sistemas de archivos. Esto no es necesario con el sistema de copia inter-qube. -??? "Los Qubes no tienen sus propios sistemas de archivos." +
+Qubes do not have their own filesystems. - Puedes [copiar y mover archivos](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) entre *qubes*. Al hacerlo, los cambios no son inmediatos y pueden deshacerse fácilmente en caso de accidente. Cuando ejecutas un *qube*, este no tiene un sistema de archivos persistente. Puedes crear y eliminar archivos, pero los cambios son efímeros. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Al hacerlo, los cambios no son inmediatos y pueden deshacerse fácilmente en caso de accidente. When you run a *qube*, it does not have a persistent filesystem. Puedes crear y eliminar archivos, pero los cambios son efímeros. + +
### Interacciones inter-VM diff --git a/i18n/fa/advanced/payments.md b/i18n/fa/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/fa/advanced/payments.md +++ b/i18n/fa/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/fa/advanced/tor-overview.md b/i18n/fa/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/fa/advanced/tor-overview.md +++ b/i18n/fa/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/fa/basics/account-creation.md b/i18n/fa/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/fa/basics/account-creation.md +++ b/i18n/fa/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/fa/basics/common-misconceptions.md b/i18n/fa/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/fa/basics/common-misconceptions.md +++ b/i18n/fa/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/fa/basics/common-threats.md b/i18n/fa/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/fa/basics/common-threats.md +++ b/i18n/fa/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/fa/basics/multi-factor-authentication.md b/i18n/fa/basics/multi-factor-authentication.md index 2f6a7b55..e71b2157 100644 --- a/i18n/fa/basics/multi-factor-authentication.md +++ b/i18n/fa/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/fa/basics/passwords-overview.md b/i18n/fa/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/fa/basics/passwords-overview.md +++ b/i18n/fa/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/fa/basics/vpn-overview.md b/i18n/fa/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/fa/basics/vpn-overview.md +++ b/i18n/fa/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/fa/os/android-overview.md b/i18n/fa/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/fa/os/android-overview.md +++ b/i18n/fa/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/fa/os/ios-overview.md b/i18n/fa/os/ios-overview.md index d8fb4800..fc21c954 100644 --- a/i18n/fa/os/ios-overview.md +++ b/i18n/fa/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/fa/os/macos-overview.md b/i18n/fa/os/macos-overview.md index 54c33e22..e2d0998d 100644 --- a/i18n/fa/os/macos-overview.md +++ b/i18n/fa/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/fa/os/qubes-overview.md b/i18n/fa/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/fa/os/qubes-overview.md +++ b/i18n/fa/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/fr/advanced/payments.md b/i18n/fr/advanced/payments.md index c3fe69c7..1a8b1578 100644 --- a/i18n/fr/advanced/payments.md +++ b/i18n/fr/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Paiements privés +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ Ce sont généralement de bonnes options pour les paiements récurrents/abonneme Les crypto-monnaies sont une forme numérique de monnaie conçue pour fonctionner sans autorités centrales telles qu'un gouvernement ou une banque. Bien que *certains* projets de crypto-monnaie vous permettent d'effectuer des transactions privées en ligne, beaucoup d'entre eux utilisent une chaîne de blocs publique qui ne garantit pas la confidentialité des transactions. Les crypto-monnaies ont également tendance à être des actifs très volatils, ce qui signifie que leur valeur peut changer rapidement et de manière significative à tout moment. C'est pourquoi nous ne recommandons généralement pas d'utiliser les crypto-monnaies comme réserve de valeur à long terme. Si vous décidez d'utiliser des crypto-monnaies en ligne, assurez-vous au préalable de bien comprendre les aspects liés à la protection de la vie privée et n'investissez que des montants qu'il ne serait pas désastreux de perdre. -!!! danger "Danger" +
+

Danger

- La grande majorité des crypto-monnaies fonctionnent sur une chaîne de blocs **publique**, ce qui signifie que chaque transaction est connue de tous. Cela inclut même les crypto-monnaies les plus connues comme le Bitcoin et l'Ethereum. Les transactions avec ces crypto-monnaies ne doivent pas être considérées comme privées et ne protégeront pas votre anonymat. - - En outre, de nombreuses crypto-monnaies, si ce n'est la plupart, sont des escroqueries. Effectuez des transactions avec prudence, uniquement avec des projets auxquels vous faites confiance. +La grande majorité des crypto-monnaies fonctionnent sur une chaîne de blocs **publique**, ce qui signifie que chaque transaction est connue de tous. Cela inclut même les crypto-monnaies les plus connues comme le Bitcoin et l'Ethereum. Les transactions avec ces crypto-monnaies ne doivent pas être considérées comme privées et ne protégeront pas votre anonymat. + +En outre, de nombreuses crypto-monnaies, si ce n'est la plupart, sont des escroqueries. Effectuez des transactions avec prudence, uniquement avec des projets auxquels vous faites confiance. + +
### Crypto-monnaies privées diff --git a/i18n/fr/advanced/tor-overview.md b/i18n/fr/advanced/tor-overview.md index abbafefb..8b91ef2a 100644 --- a/i18n/fr/advanced/tor-overview.md +++ b/i18n/fr/advanced/tor-overview.md @@ -45,13 +45,16 @@ Il est difficile de mettre en place de mauvaises configurations comme celles-ci --- -!!! info "Empreinte numérique VPN/SSH" +
+

VPN/SSH Fingerprinting

- Le Tor Project [mentionne](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) que *théoriquement* l'utilisation d'un VPN pour cacher à votre FAI les activités Tor n'est pas forcément infaillible. Les VPNs se sont révélés vulnérables à la prise d'empreinte numérique du trafic des sites web, un adversaire pouvant toujours deviner quel site web est visité, car tous les sites web ont des schémas de trafic spécifiques. - - Il n'est donc pas déraisonnable de penser que le trafic Tor chiffré caché par un VPN pourrait également être détecté par des méthodes similaires. Il n'existe aucun document de recherche sur ce sujet, et nous considérons toujours que les avantages de l'utilisation d'un VPN l'emportent largement sur ces risques, mais il s'agit d'un élément à garder à l'esprit. - - Si vous pensez toujours que les transports enfichables (ponts) offrent une protection supplémentaire contre la prise d'empreinte numérique du trafic de site web qu'un VPN n'offre pas, vous avez toujours la possibilité d'utiliser un pont **et** un VPN en même temps. +Le Tor Project [mentionne](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) que *théoriquement* l'utilisation d'un VPN pour cacher à votre FAI les activités Tor n'est pas forcément infaillible. Les VPNs se sont révélés vulnérables à la prise d'empreinte numérique du trafic des sites web, un adversaire pouvant toujours deviner quel site web est visité, car tous les sites web ont des schémas de trafic spécifiques. + +Il n'est donc pas déraisonnable de penser que le trafic Tor chiffré caché par un VPN pourrait également être détecté par des méthodes similaires. Il n'existe aucun document de recherche sur ce sujet, et nous considérons toujours que les avantages de l'utilisation d'un VPN l'emportent largement sur ces risques, mais il s'agit d'un élément à garder à l'esprit. + +Si vous pensez toujours que les transports enfichables (ponts) offrent une protection supplémentaire contre la prise d'empreinte numérique du trafic de site web qu'un VPN n'offre pas, vous avez toujours la possibilité d'utiliser un pont **et** un VPN en même temps. + +
Pour déterminer si vous devez d'abord utiliser un VPN pour vous connecter au réseau Tor, il vous faudra faire preuve de bon sens et connaître les politiques de votre gouvernement et de votre FAI relatives à ce à quoi vous vous connectez. Cependant, encore une fois et dans la plupart des cas, il est préférable que vous soyez vu comme connecté à un réseau VPN commercial plutôt que directement au réseau Tor. Si les fournisseurs de VPN sont censurés dans votre région, vous pouvez également envisager d'utiliser des transports enfichables Tor (par exemple les ponts Snowflake ou meek) comme alternative, mais l'utilisation de ces ponts peut susciter plus de suspicion que les tunnels WireGuard/OpenVPN standard. diff --git a/i18n/fr/basics/account-creation.md b/i18n/fr/basics/account-creation.md index b81ca205..12d4da19 100644 --- a/i18n/fr/basics/account-creation.md +++ b/i18n/fr/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Comment créer des comptes internet de façon privée - Privacy Guides" -title: "Création de compte" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: La création de comptes en ligne est pratiquement une nécessité sur internet, prenez ces mesures pour vous assurer de rester privé. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Souvent, les gens s'inscrivent à des services sans réfléchir. Il s'agit peut-être d'un service de streaming qui vous permet de regarder la nouvelle émission dont tout le monde parle, ou d'un compte qui vous permet de bénéficier d'une réduction dans votre fast-food préféré. Quoi qu'il en soit, vous devez tenir compte des implications pour vos données, maintenant et plus tard. @@ -29,9 +29,12 @@ Il existe généralement plusieurs façons de créer un compte, chacune ayant se Le moyen le plus courant de créer un nouveau compte est d'utiliser une adresse e-mail et un mot de passe. Lorsque vous utilisez cette méthode, vous devriez utiliser un gestionnaire de mots de passe et suivre les [bonnes pratiques](passwords-overview.md) concernant les mots de passe. -!!! tip "Conseil" +
+

Tip

- Vous pouvez également utiliser votre gestionnaire de mots de passe pour gérer d'autres méthodes d'authentification ! Il suffit d'ajouter la nouvelle entrée et de remplir les champs appropriés. Vous pouvez ajouter des notes pour des choses comme des questions de sécurité ou une clé de secours. +Vous pouvez également utiliser votre gestionnaire de mots de passe pour gérer d'autres méthodes d'authentification ! Il suffit d'ajouter la nouvelle entrée et de remplir les champs appropriés. Vous pouvez ajouter des notes pour des choses comme des questions de sécurité ou une clé de secours. + +
Vous serez responsable de la gestion de vos identifiants de connexion. Pour plus de sécurité, vous pouvez configurer [MFA](multi-factor-authentication.md) sur vos comptes. diff --git a/i18n/fr/basics/common-misconceptions.md b/i18n/fr/basics/common-misconceptions.md index c67adb86..3f40a497 100644 --- a/i18n/fr/basics/common-misconceptions.md +++ b/i18n/fr/basics/common-misconceptions.md @@ -75,20 +75,23 @@ Alors, à quoi ça pourrait ressembler ? Les modèles de menace les plus clairs sont ceux où les gens *savent qui vous êtes* et ceux où ils ne le savent pas. Il y aura toujours des situations où vous devrez déclarer votre nom légal et d'autres où vous n'aurez pas à le faire. -1. **Identité connue** - Une identité connue est utilisée pour les endroits où vous devez déclarer votre nom. Il existe de nombreux documents juridiques et contrats de ce type pour lesquels une identité légale est requise. Il peut s'agir de l'ouverture d'un compte bancaire, de la signature d'un bail immobilier, de l'obtention d'un passeport, de déclarations douanières lors de l'importation d'articles ou de toute autre démarche auprès de votre gouvernement. Ces éléments conduisent généralement à des informations d'identification telles que des cartes de crédit, des vérifications de la solvabilité, des numéros de compte et éventuellement des adresses physiques. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Nous ne suggérons pas l'utilisation d'un VPN ou de Tor pour toutes ces choses, car votre identité est déjà connue par d'autres moyens. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "Conseil" - - Lorsque vous effectuez des achats en ligne, l'utilisation d'une [consigne à colis](https://en.wikipedia.org/wiki/Parcel_locker) peut contribuer à préserver la confidentialité de votre adresse physique. +
+

Tip

+ +Lorsque vous effectuez des achats en ligne, l'utilisation d'une [consigne à colis](https://en.wikipedia.org/wiki/Parcel_locker) peut contribuer à préserver la confidentialité de votre adresse physique. + +
2. **Identité inconnue** - Une identité inconnue pourrait être un pseudonyme stable que vous utilisez régulièrement. Il n'est pas anonyme car il ne change pas. Si vous faites partie d'une communauté en ligne, vous souhaiterez peut-être conserver un personnage que les autres connaissent. Ce pseudonyme n'est pas anonyme car, s'il est surveillé suffisamment longtemps, les détails concernant le propriétaire peuvent révéler d'autres informations, telles que sa façon d'écrire, ses connaissances générales sur des sujets d'intérêt, etc. - Vous pouvez utiliser un VPN pour masquer votre adresse IP. Les transactions financières sont plus difficiles à masquer : Vous pouvez envisager d'utiliser des crypto-monnaies anonymes, comme [Monero](https://www.getmonero.org/). L'utilisation de monnaies alternatives peut également contribuer à masquer l'origine de votre monnaie. En règle générale, les centres d'échange exigent que le processus [KYC](https://fr.wikipedia.org/wiki/Know_your_customer) (connaissance du client) soit complété avant de vous autoriser à échanger de la monnaie fiduciaire contre tout type de cryptomonnaie. Les options de rencontres locales peuvent également être une solution, mais elles sont souvent plus coûteuses et nécessitent parfois un processus KYC. +Vous pouvez utiliser un VPN pour masquer votre adresse IP. Les transactions financières sont plus difficiles à masquer : Vous pouvez envisager d'utiliser des crypto-monnaies anonymes, comme [Monero](https://www.getmonero.org/). L'utilisation de monnaies alternatives peut également contribuer à masquer l'origine de votre monnaie. En règle générale, les centres d'échange exigent que le processus [KYC](https://fr.wikipedia.org/wiki/Know_your_customer) (connaissance du client) soit complété avant de vous autoriser à échanger de la monnaie fiduciaire contre tout type de cryptomonnaie. Les options de rencontres locales peuvent également être une solution, mais elles sont souvent plus coûteuses et nécessitent parfois un processus KYC. 3. **Identité anonyme** - Même avec de l'expérience, les identités anonymes sont difficiles à maintenir sur de longues périodes. Il doit s'agir d'identités à court terme et de courte durée qui font l'objet d'une rotation régulière. - L'utilisation de Tor peut y contribuer. Il convient également de noter qu'un plus grand anonymat est possible grâce à la communication asynchrone : La communication en temps réel est vulnérable à l'analyse des habitudes de frappe (c'est-à-dire plus d'un paragraphe de texte, diffusé sur un forum, par e-mail, etc.) +L'utilisation de Tor peut y contribuer. Il convient également de noter qu'un plus grand anonymat est possible grâce à la communication asynchrone : La communication en temps réel est vulnérable à l'analyse des habitudes de frappe (c'est-à-dire plus d'un paragraphe de texte, diffusé sur un forum, par e-mail, etc.) [^1]: Un exemple notable est l'[incident de 2021 dans lequel des chercheurs de l'Université du Minnesota ont introduit trois vulnérabilités dans le projet de développement du noyau Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/fr/basics/common-threats.md b/i18n/fr/basics/common-threats.md index 4512b076..47150162 100644 --- a/i18n/fr/basics/common-threats.md +++ b/i18n/fr/basics/common-threats.md @@ -35,19 +35,25 @@ En matière de sécurité des applications, nous ne savons généralement pas (e Pour minimiser les dommages potentiels qu'un logiciel malveillant peut causer, vous devez employer la sécurité par compartimentation. Il peut s'agir d'utiliser des ordinateurs différents pour des tâches différentes, d'utiliser des machines virtuelles pour séparer différents groupes d'applications connexes ou d'utiliser un système d'exploitation sécurisé mettant l'accent sur le principe de [sandboxing](https://fr.wikipedia.org/wiki/Sandbox_(s%C3%A9curit%C3%A9_informatique)) (ou « bac à sable » en français) des applications et du [mandatory access control](https://fr.wikipedia.org/wiki/Contr%C3%B4le_d'acc%C3%A8s_obligatoire) (ou « Contrôle d'accès obligatoire » en français). -!!! tip "Conseil" +
+

Tip

- Les systèmes d'exploitation mobiles sont généralement plus sûrs que les systèmes d'exploitation de bureau en ce qui concerne le sandboxing des applications. - - Les systèmes d'exploitation de bureau sont généralement à la traîne en ce qui concerne le sandboxing. ChromeOS possède des capacités de sandboxing similaires à celles d'Android, et macOS dispose d'un contrôle complet des autorisations système (et les développeurs peuvent opter pour le sandboxing pour les applications). Cependant, ces systèmes d'exploitation transmettent des informations d'identification à leurs constructeurs respectifs. Linux a tendance à ne pas soumettre d'informations aux fournisseurs de systèmes, mais il a une mauvaise protection contre les exploits et les applications malveillantes. Ce problème peut être quelque peu atténué avec des distributions spécialisées qui font un usage intensif des machines virtuelles ou des conteneurs, comme [Qubes OS](../desktop.md#qubes-os). +Les systèmes d'exploitation mobiles sont généralement plus sûrs que les systèmes d'exploitation de bureau en ce qui concerne le sandboxing des applications. + +Les systèmes d'exploitation de bureau sont généralement à la traîne en ce qui concerne le sandboxing. ChromeOS possède des capacités de sandboxing similaires à celles d'Android, et macOS dispose d'un contrôle complet des autorisations système (et les développeurs peuvent opter pour le sandboxing pour les applications). Cependant, ces systèmes d'exploitation transmettent des informations d'identification à leurs constructeurs respectifs. Linux a tendance à ne pas soumettre d'informations aux fournisseurs de systèmes, mais il a une mauvaise protection contre les exploits et les applications malveillantes. Ce problème peut être quelque peu atténué avec des distributions spécialisées qui font un usage intensif des machines virtuelles ou des conteneurs, comme [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Attaques ciblées Les attaques ciblées contre une personne spécifique sont plus difficiles à gérer. Les voies d'attaque les plus courantes sont l'envoi de documents malveillants par courrier électronique, l'exploitation de vulnérabilités dans le navigateur et les systèmes d'exploitation, et les attaques physiques. Si cela vous préoccupe, il vous sera nécessaire de recourir à des stratégies plus avancées d'atténuation des menaces. -!!! tip "Conseil" +
+

Tip

- **Les navigateurs web**, **les clients de messagerie électronique** et **les applications de bureautique** exécutent généralement volontairement, et par conception, du code non fiable qui vous est envoyé par des tiers. L'exécution de plusieurs machines virtuelles pour séparer les applications de ce type de votre système hôte ainsi que les unes des autres est une technique que vous pouvez utiliser pour éviter qu'un code d'exploitation dans ces applications ne compromette le reste de votre système. Les technologies comme Qubes OS ou Microsoft Defender Application Guard sur Windows fournissent des méthodes pratiques pour le faire de manière transparente, par exemple. +**Les navigateurs web**, **les clients de messagerie électronique** et **les applications de bureautique** exécutent généralement volontairement, et par conception, du code non fiable qui vous est envoyé par des tiers. L'exécution de plusieurs machines virtuelles pour séparer les applications de ce type de votre système hôte ainsi que les unes des autres est une technique que vous pouvez utiliser pour éviter qu'un code d'exploitation dans ces applications ne compromette le reste de votre système. Les technologies comme Qubes OS ou Microsoft Defender Application Guard sur Windows fournissent des méthodes pratiques pour le faire de manière transparente, par exemple. + +
Si vous êtes préoccupé par les **attaques physiques** vous devriez utiliser un système d'exploitation avec une implémentation de démarrage vérifié sécurisé, à la manière d'Android, d'iOS, de macOS ou de [Windows (avec TPM)](https://docs.microsoft.com/fr-fr/windows/security/information-protection/secure-the-windows-10-boot-process). Vous devriez également vous assurer que votre disque est chiffré et que le système d'exploitation utilise un TPM, une [Enclave sécurisée](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) ou un [Element sécurisé](https://developers.google.com/android/security/android-ready-se) pour limiter le taux de tentatives de saisie de la phrase de passe. Vous devriez éviter de partager votre ordinateur avec des personnes en qui vous n'avez pas confiance, car la plupart des systèmes d'exploitation de bureau ne chiffrent pas les données séparément par utilisateur. @@ -61,13 +67,16 @@ Le problème évident avec cela est que le fournisseur de services (ou un pirate Heureusement, le chiffrement de bout en bout peut atténuer ce problème en rendant illisibles les communications entre vous et vos destinataires avant même qu'elles ne soient envoyées au serveur. La confidentialité de vos messages est garantie, tant que le prestataire de services n'a pas accès aux clés privées d'une des deux personnes. -!!! note "Note sur le chiffrement basé sur le web" +
+

Note on Web-based Encryption

- Dans la pratique, l'efficacité des différentes mises en œuvre du chiffrement de bout en bout varie. Des applications telles que [Signal](../real-time-communication.md#signal) s'exécutent nativement sur votre appareil, et chaque copie de l'application est la même sur différentes installations. Si le fournisseur de services venait à ouvrir une porte dérobée dans son application pour tenter de voler vos clés privées, cela pourrait être détecté ultérieurement par rétro-ingénierie. - - D'autre part, les implémentations de chiffrement de bout en bout basées sur le web, telles que l'application web de Proton Mail ou le coffre-fort web de Bitwarden, reposent sur le serveur qui sert dynamiquement du code JavaScript au navigateur pour gérer les opérations cryptographiques. Un serveur malveillant pourrait cibler une personne spécifique et lui envoyer un code JavaScript malveillant pour voler sa clé de chiffrement, et il serait extrêmement difficile pour l'utilisateur de s'en rendre compte. Même si cette personne s'aperçoit de la tentative de vol de sa clé, il serait incroyablement difficile de prouver que c'est le fournisseur qui tente de le faire, car le serveur peut choisir de servir différents clients web à différentes personnes. - - Par conséquent, lorsque vous comptez sur le chiffrement de bout en bout, vous devriez choisir d'utiliser des applications natives plutôt que des clients web, dans la mesure du possible. +Dans la pratique, l'efficacité des différentes mises en œuvre du chiffrement de bout en bout varie. Des applications telles que [Signal](../real-time-communication.md#signal) s'exécutent nativement sur votre appareil, et chaque copie de l'application est la même sur différentes installations. Si le fournisseur de services venait à ouvrir une porte dérobée dans son application pour tenter de voler vos clés privées, cela pourrait être détecté ultérieurement par rétro-ingénierie. + +D'autre part, les implémentations de chiffrement de bout en bout basées sur le web, telles que l'application web de Proton Mail ou le coffre-fort web de Bitwarden, reposent sur le serveur qui sert dynamiquement du code JavaScript au navigateur pour gérer les opérations cryptographiques. Un serveur malveillant pourrait cibler une personne spécifique et lui envoyer un code JavaScript malveillant pour voler sa clé de chiffrement, et il serait extrêmement difficile pour l'utilisateur de s'en rendre compte. Même si cette personne s'aperçoit de la tentative de vol de sa clé, il serait incroyablement difficile de prouver que c'est le fournisseur qui tente de le faire, car le serveur peut choisir de servir différents clients web à différentes personnes. + +Par conséquent, lorsque vous comptez sur le chiffrement de bout en bout, vous devriez choisir d'utiliser des applications natives plutôt que des clients web, dans la mesure du possible. + +
Même avec le chiffrement de bout en bout, les fournisseurs de services peuvent toujours vous profiler sur la base des **métadonnées**, qui ne sont généralement pas protégées. Si le fournisseur de services ne peut pas lire vos messages pour savoir ce que vous dites, il peut néanmoins observer des choses comme les personnes avec lesquelles vous parlez, la fréquence de vos messages et les heures où vous êtes généralement actif. La protection des métadonnées est assez rare, et vous devriez prêter une attention particulière à la documentation technique du logiciel que vous utilisez pour voir s'il y a une minimisation ou une protection des métadonnées, si cela vous préoccupe. @@ -77,17 +86,23 @@ Même avec le chiffrement de bout en bout, les fournisseurs de services peuvent La surveillance de masse est un effort visant à surveiller le "comportement, de nombreuses activités ou les informations" d'une population entière (ou d'une fraction substantielle d'une population).[^1] Elle fait souvent référence à des programmes gouvernementaux, tels que ceux [divulgués par Edward Snowden en 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). Cependant, elle peut également être réalisée par des entreprises, soit pour le compte d'agences gouvernementales, soit de leur propre initiative. -!!! abstract "Atlas de la surveillance" +
+

Atlas of Surveillance

- Si vous souhaitez en savoir plus sur les méthodes de surveillance et la manière dont elles sont mises en œuvre dans les villes aux États-Unis, vous pouvez également consulter l'[Atlas de la Surveillance](https://atlasofsurveillance.org/) de l'[Electronic Frontier Foundation](https://www.eff.org/). - - En France, vous pouvez consulter le site [Technolopolice](https://technopolice.fr/villes/) géré par l'association à but non lucratif La Quadrature du Net. +Si vous souhaitez en savoir plus sur les méthodes de surveillance et la manière dont elles sont mises en œuvre dans les villes aux États-Unis, vous pouvez également consulter l'[Atlas de la Surveillance](https://atlasofsurveillance.org/) de l'[Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Les gouvernements justifient souvent les programmes de surveillance de masse comme des moyens nécessaires pour combattre le terrorisme et prévenir la criminalité. Cependant, en violation des droits de l'homme, ces programmes de surveillance sont, entre autres, le plus souvent utilisés pour cibler de manière disproportionnée les minorités et les dissidents politiques. -!!! quote "ACLU : [*La leçon du 11 septembre en matière de vie privée : La surveillance de masse n'est pas la voie à suivre*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Face aux [révélations d'Edward Snowden sur des programmes gouvernementaux tels que [PRISM](https://fr.wikipedia.org/wiki/PRISM_%28programme_de_surveillance%29) et [Upstream](https://fr.wikipedia.org/wiki/Upstream_collection)], les responsables des services de renseignement ont également admis que la NSA collectait secrètement depuis des années des enregistrements sur pratiquement tous les appels téléphoniques des Américains - qui appelle qui, quand ces appels sont passés et la durée de ces appels. Ce type d'informations, lorsqu'il est amassé par la NSA quotidiennement, peut révéler des détails terriblement sensibles sur la vie des gens en associant ces données : s'ils ont appelé un pasteur, une clinique d'avortement, un centre d'addiction ou une ligne d'assistance contre le suicide par exemple. +Face aux [révélations d'Edward Snowden sur des programmes gouvernementaux tels que [PRISM](https://fr.wikipedia.org/wiki/PRISM_%28programme_de_surveillance%29) et [Upstream](https://fr.wikipedia.org/wiki/Upstream_collection)], les responsables des services de renseignement ont également admis que la NSA collectait secrètement depuis des années des enregistrements sur pratiquement tous les appels téléphoniques des Américains - qui appelle qui, quand ces appels sont passés et la durée de ces appels. Ce type d'informations, lorsqu'il est amassé par la NSA quotidiennement, peut révéler des détails terriblement sensibles sur la vie des gens en associant ces données : s'ils ont appelé un pasteur, une clinique d'avortement, un centre d'addiction ou une ligne d'assistance contre le suicide par exemple. + +
Malgré la surveillance de masse croissante aux États-Unis, le gouvernement a constaté que les programmes de surveillance de masse comme la section 215 ont eu "peu de valeur unique" en ce qui concerne l'arrêt de crimes réels ou de complots terroristes, les efforts faisant largement double emploi avec les programmes de surveillance ciblée du FBI.[^2] @@ -133,11 +148,14 @@ La censure sur les plateformes privées est de plus en plus courante, car des pl Les personnes concernées par la menace de la censure peuvent utiliser des technologies comme [Tor](../advanced/tor-overview.md) pour la contourner, et soutenir des plateformes de communication résistantes à la censure comme [Matrix](../real-time-communication.md#element), qui ne dispose pas d'une autorité centralisée pouvant fermer des comptes de manière arbitraire. -!!! tip "Conseil" +
+

Tip

- S'il peut être facile d'échapper à la censure en soi, cacher le fait que vous le faites peut être très problématique. - - Vous devez prendre en compte quels aspects du réseau votre adversaire peut observer, et si vous avez une possibilité de déni plausible pour vos actions. Par exemple, l'utilisation de [DNS chiffrés](../advanced/dns-overview.md#what-is-encrypted-dns) peut vous aider à contourner les systèmes de censure rudimentaires basés sur les DNS, mais elle ne peut pas vraiment cacher ce que vous visitez à votre FAI. Un VPN ou Tor peut aider à cacher ce que vous visitez aux administrateurs du réseaux, mais ne peut pas cacher que vous utilisez ces réseaux. Les transports enfichables (tels que Obfs4proxy, Meek ou Shadowsocks) peuvent vous aider à contourner les pare-feu qui bloquent les protocoles VPN courants ou Tor, mais vos tentatives de contournement peuvent toujours être détectées par des méthodes telles que le sondage ou [l'inspection approfondie des paquets](https://fr.wikipedia.org/wiki/Deep_packet_inspection). +S'il peut être facile d'échapper à la censure en soi, cacher le fait que vous le faites peut être très problématique. + +Vous devez prendre en compte quels aspects du réseau votre adversaire peut observer, et si vous avez une possibilité de déni plausible pour vos actions. Par exemple, l'utilisation de [DNS chiffrés](../advanced/dns-overview.md#what-is-encrypted-dns) peut vous aider à contourner les systèmes de censure rudimentaires basés sur les DNS, mais elle ne peut pas vraiment cacher ce que vous visitez à votre FAI. Un VPN ou Tor peut aider à cacher ce que vous visitez aux administrateurs du réseaux, mais ne peut pas cacher que vous utilisez ces réseaux. Les transports enfichables (tels que Obfs4proxy, Meek ou Shadowsocks) peuvent vous aider à contourner les pare-feu qui bloquent les protocoles VPN courants ou Tor, mais vos tentatives de contournement peuvent toujours être détectées par des méthodes telles que le sondage ou [l'inspection approfondie des paquets](https://fr.wikipedia.org/wiki/Deep_packet_inspection). + +
Vous devez toujours tenir compte des risques encourus en essayant de contourner la censure, des conséquences potentielles et du degré de sophistication de votre adversaire. Soyez très prudent dans le choix de vos logiciels et prévoyez un plan de secours au cas où vous seriez pris. diff --git a/i18n/fr/basics/multi-factor-authentication.md b/i18n/fr/basics/multi-factor-authentication.md index 0fdd50b4..5eeb96c2 100644 --- a/i18n/fr/basics/multi-factor-authentication.md +++ b/i18n/fr/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ Cette commande empêchera un adversaire de contourner le MFA au démarrage de l' ### Linux -!!! warning "Avertissement" +
+

Avertissement

- Si le nom d'hôte de votre système change (par exemple à cause du DHCP), vous ne pourrez pas vous connecter. Il est essentiel que vous configuriez un nom d'hôte approprié pour votre ordinateur avant de suivre ce guide. +Si le nom d'hôte de votre système change (par exemple à cause du DHCP), vous ne pourrez pas vous connecter. Il est essentiel que vous configuriez un nom d'hôte approprié pour votre ordinateur avant de suivre ce guide. + +
Le module `pam_u2f` sous Linux peut fournir une authentification à deux facteurs pour se connecter sur la plupart des distributions Linux populaires. Si vous avez une clé de sécurité matérielle qui prend en charge U2F, vous pouvez configurer l'authentification MFA pour votre connexion. Yubico a un guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) qui devrait fonctionner sur n'importe quelle distribution. Les commandes du gestionnaire de paquets - telles que `apt-get`- et les noms de paquets peuvent toutefois différer. Ce guide ne s'applique **pas** à Qubes OS. diff --git a/i18n/fr/basics/passwords-overview.md b/i18n/fr/basics/passwords-overview.md index b076fddb..8a9d332f 100644 --- a/i18n/fr/basics/passwords-overview.md +++ b/i18n/fr/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Introduction aux mots de passe" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Voici quelques conseils et astuces pour créer des mots de passe plus forts et sécuriser vos comptes. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Les mots de passe sont un élément essentiel de notre vie numérique quotidienne. Nous les utilisons pour protéger nos comptes, nos appareils et nos secrets. Bien qu'ils soient souvent la seule chose qui nous sépare d'un adversaire qui en veut à nos informations privées, ils ne font pas l'objet d'une réflexion approfondie, ce qui conduit souvent les gens à utiliser des mots de passe faciles à deviner ou à forcer. @@ -26,9 +26,12 @@ Vous devez éviter de changer trop souvent les mots de passe que vous devez rete En ce qui concerne les mots de passe que vous n'avez pas à retenir (comme les mots de passe stockés dans votre gestionnaire de mots de passe), si votre [modèle de menace](threat-modeling.md) le demande, nous vous recommandons de passer en revue les comptes importants (en particulier les comptes qui n'utilisent pas l'authentification multi-facteurs) et de changer leur mot de passe tous les deux mois, au cas où ils auraient été compromis dans le cadre d'une fuite de données qui n'a pas encore été rendue publique. La plupart des gestionnaires de mots de passe vous permettent de fixer une date d'expiration pour votre mot de passe afin d'en faciliter la gestion. -!!! tip "Vérifier les fuites de données" +
+

Checking for data breaches

- Si votre gestionnaire de mots de passe vous permet de vérifier les mots de passe compromis, assurez-vous de le faire et changez rapidement tout mot de passe qui pourrait avoir été exposé dans une fuite de données. Vous pouvez également suivre le flux [Dernières Brèches de Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) à l'aide d'un [agrégateur d'actualités](../news-aggregators.md). +Si votre gestionnaire de mots de passe vous permet de vérifier les mots de passe compromis, assurez-vous de le faire et changez rapidement tout mot de passe qui pourrait avoir été exposé dans une fuite de données. Vous pouvez également suivre le flux [Dernières Brèches de Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) à l'aide d'un [agrégateur d'actualités](../news-aggregators.md). + +
## Créer des mots de passe forts @@ -48,9 +51,12 @@ Un exemple de phrase secrète diceware est `viewable fastness reluctant squishy Pour générer une phrase secrète diceware à l'aide de vrais dés, suivez ces étapes : -!!! note "À noter" +
+

Note

- Ces instructions supposent que vous utilisez la [grande liste de mots de l'EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) pour générer la phrase secrète, ce qui nécessite cinq lancers de dés par mot. D'autres listes de mots peuvent nécessiter plus ou moins de lancers par mot, et peuvent nécessiter un nombre différent de mots pour obtenir la même entropie. +Ces instructions supposent que vous utilisez la [grande liste de mots de l'EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) pour générer la phrase secrète, ce qui nécessite cinq lancers de dés par mot. D'autres listes de mots peuvent nécessiter plus ou moins de lancers par mot, et peuvent nécessiter un nombre différent de mots pour obtenir la même entropie. + +
1. Lancez cinq fois un dé à six faces, en notant le nombre après chaque lancer. @@ -60,31 +66,37 @@ Pour générer une phrase secrète diceware à l'aide de vrais dés, suivez ces 4. Répétez ce processus jusqu'à ce que votre phrase secrète comporte autant de mots que nécessaire, que vous devez séparer par un espace. -!!! warning "Avertissement" +
+

Important

- Vous ne devez **pas** relancer les mots jusqu'à ce que vous obteniez une combinaison de mots qui vous plaît. Le processus doit être complètement aléatoire. +Vous ne devez **pas** relancer les mots jusqu'à ce que vous obteniez une combinaison de mots qui vous plaît. Le processus doit être complètement aléatoire. + +
Si vous n'avez pas accès à de vrais dés ou si vous préférez ne pas en utiliser, vous pouvez utiliser le générateur de mots de passe intégré à votre gestionnaire de mots de passe, car la plupart d'entre eux ont la possibilité de générer des phrases secrètes diceware en plus des mots de passe ordinaires. Nous vous recommandons d'utiliser la [grande liste de mots de l'EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) pour générer vos phrases secrètes diceware, car elle offre exactement la même sécurité que la liste originale, tout en contenant des mots plus faciles à mémoriser. Il existe également [d'autres listes de mots dans différentes langues](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), si vous ne souhaitez pas que votre phrase secrète soit en anglais. -??? note "Explication de l'entropie et de la force des phrases secrètes diceware" +
+Explanation of entropy and strength of diceware passphrases - Pour démontrer la force des phrases secrètes diceware, nous utiliserons la phrase secrète de sept mots mentionnée plus haut (`viewable fastness reluctant squishy seventeen shown pencil`) et la [grande liste de mots de l'EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) comme exemple. - - L'une des mesures permettant de déterminer la force d'une phrase secrète est son degré d'entropie. L'entropie par mot dans une phrase secrète est calculée comme suit : $\text{log}_2(\text{WordsInList})$ et l'entropie globale de la phrase secrète est calculée comme suit : $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Par conséquent, chaque mot de la liste susmentionnée génère ~12,9 bits d'entropie ($\text{log}_2(7776)$), et une phrase secrète de sept mots dérivée de cette liste a ~90,47 bits d'entropie ($\text{log}_2(7776^7)$). - - La [grande liste de mots de l'EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contient 7776 mots uniques. Pour calculer le nombre de phrases secrètes possibles, il suffit de faire $\text{WordsInList}^\text{WordsInPhrase}$, ou dans notre cas, $7776^7$. - - Mettons tout cela en perspective : Une phrase secrète de sept mots utilisant la [grande liste de mots de l'EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) est l'une des ~1 719 070 799 748 422 500 000 000 000 phrases secrètes possibles. - - En moyenne, il faut essayer 50 % de toutes les combinaisons possibles pour deviner votre phrase. En gardant cela à l'esprit, même si votre adversaire est capable de faire ~1 000 000 000 000 de suppositions par seconde, il lui faudrait toujours ~27 255 689 ans pour deviner votre phrase secrète. C'est le cas même si les choses suivantes sont vraies : +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Votre adversaire sait que vous avez utilisé la méthode du diceware. - - Votre adversaire connaît la liste de mots spécifique que vous avez utilisée. - - Votre adversaire sait combien de mots contient votre phrase secrète. +L'une des mesures permettant de déterminer la force d'une phrase secrète est son degré d'entropie. L'entropie par mot dans une phrase secrète est calculée comme suit : $\text{log}_2(\text{WordsInList})$ et l'entropie globale de la phrase secrète est calculée comme suit : $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Par conséquent, chaque mot de la liste susmentionnée génère ~12,9 bits d'entropie ($\text{log}_2(7776)$), et une phrase secrète de sept mots dérivée de cette liste a ~90,47 bits d'entropie ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. Pour calculer le nombre de phrases secrètes possibles, il suffit de faire $\text{WordsInList}^\text{WordsInPhrase}$, ou dans notre cas, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +En moyenne, il faut essayer 50 % de toutes les combinaisons possibles pour deviner votre phrase. En gardant cela à l'esprit, même si votre adversaire est capable de faire ~1 000 000 000 000 de suppositions par seconde, il lui faudrait toujours ~27 255 689 ans pour deviner votre phrase secrète. C'est le cas même si les choses suivantes sont vraies : + +- Votre adversaire sait que vous avez utilisé la méthode du diceware. +- Votre adversaire connaît la liste de mots spécifique que vous avez utilisée. +- Votre adversaire sait combien de mots contient votre phrase secrète. + +
Pour résumer, les phrases secrètes diceware sont votre meilleure option lorsque vous avez besoin d'une phrase à la fois facile à retenir *et* exceptionnellement forte. @@ -98,13 +110,16 @@ Il existe de nombreuses options intéressantes, qu'elles soient basées sur le c [Liste des gestionnaires de mots de passe recommandés](../passwords.md ""){.md-button} -!!! warning "Ne placez pas vos mots de passe et vos codes TOTP dans le même gestionnaire de mots de passe" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- Lorsque vous utilisez des codes TOTP comme [authentification à multi-facteurs](../multi-factor-authentication.md), la meilleure pratique de sécurité consiste à conserver vos codes TOTP dans une [application séparée](../multi-factor-authentication.md#authenticator-apps). - - Le stockage de vos codes TOTP au même endroit que vos mots de passe, bien que pratique, réduit les comptes à un seul facteur dans le cas où un adversaire aurait accès à votre gestionnaire de mots de passe. - - En outre, nous ne recommandons pas de stocker des codes de récupération à usage unique dans votre gestionnaire de mots de passe. Ils doivent être stockés séparément, par exemple dans un conteneur chiffré sur un dispositif de stockage hors ligne. +Lorsque vous utilisez des codes TOTP comme [authentification à multi-facteurs](../multi-factor-authentication.md), la meilleure pratique de sécurité consiste à conserver vos codes TOTP dans une [application séparée](../multi-factor-authentication.md#authenticator-apps). + +Le stockage de vos codes TOTP au même endroit que vos mots de passe, bien que pratique, réduit les comptes à un seul facteur dans le cas où un adversaire aurait accès à votre gestionnaire de mots de passe. + +En outre, nous ne recommandons pas de stocker des codes de récupération à usage unique dans votre gestionnaire de mots de passe. Ils doivent être stockés séparément, par exemple dans un conteneur chiffré sur un dispositif de stockage hors ligne. + +
### Sauvegardes diff --git a/i18n/fr/basics/vpn-overview.md b/i18n/fr/basics/vpn-overview.md index 18f72847..8c402f88 100644 --- a/i18n/fr/basics/vpn-overview.md +++ b/i18n/fr/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "Comment les VPNs protègent-ils votre vie privée ? Notre introduction aux VPNs - Privacy Guides" -title: Introduction aux VPNs +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Les réseaux privés virtuels déplacent le risque de votre FAI à un tiers en qui vous avez confiance. Vous devriez garder ces éléments à l'esprit. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Les Réseaux Privés Virtuels sont un moyen d'étendre l'extrémité de votre réseau avec une sortie située ailleurs dans le monde. @@ -11,9 +11,12 @@ Normalement, un FAI peut voir le flux de trafic internet qui entre et sort de vo L'utilisation d'un VPN permet de dissimuler ces informations à votre FAI, en transférant la confiance que vous accordez à votre réseau vers un serveur situé ailleurs dans le monde. Par conséquent, le FAI ne voit que le fait que vous êtes connecté à un VPN et rien sur l'activité que vous lui transmettez. -!!! note "À noter" +
+

Note

- Lorsque nous faisons référence aux "Réseaux Privés Virtuels" sur ce site, nous faisons généralement référence à [des fournisseurs VPN](../vpn.md) **commerciaux**, à qui vous payez des frais mensuels en échange de l'acheminement sécurisé de votre trafic Internet à travers leurs serveurs publics. Il existe de nombreuses autres formes de VPN, tels que ceux que vous hébergez vous-même ou ceux gérés par des lieux de travail qui vous permettent de vous connecter en toute sécurité à des ressources réseau internes/employés, Cependant, ces VPNs sont généralement conçus pour accéder à des réseaux distants en toute sécurité, plutôt que pour protéger la confidentialité de votre connexion Internet. +Lorsque nous faisons référence aux "Réseaux Privés Virtuels" sur ce site, nous faisons généralement référence à [des fournisseurs VPN](../vpn.md) **commerciaux**, à qui vous payez des frais mensuels en échange de l'acheminement sécurisé de votre trafic Internet à travers leurs serveurs publics. Il existe de nombreuses autres formes de VPN, tels que ceux que vous hébergez vous-même ou ceux gérés par des lieux de travail qui vous permettent de vous connecter en toute sécurité à des ressources réseau internes/employés, Cependant, ces VPNs sont généralement conçus pour accéder à des réseaux distants en toute sécurité, plutôt que pour protéger la confidentialité de votre connexion Internet. + +
## Comment fonctionne un VPN ? diff --git a/i18n/fr/os/android-overview.md b/i18n/fr/os/android-overview.md index 874818e8..99151075 100644 --- a/i18n/fr/os/android-overview.md +++ b/i18n/fr/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Introduction à Android +title: Android Overview icon: simple/android -description: Android est un système d'exploitation open source doté de solides protections de sécurité, ce qui en fait notre premier choix pour les téléphones. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Logo d'Android](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Une application peut demander une autorisation pour une fonction spécifique qu' [Exodus](https://exodus-privacy.eu.org/fr/) peut être utile pour comparer des applications ayant des objectifs similaires. Si une application nécessite de nombreuses autorisations et comporte beaucoup de traqueurs publicitaires et d'analytiques, c'est probablement un mauvais signe. Nous vous recommandons d'examiner les différents traqueurs et de lire leur description plutôt que de vous contenter de **compter leur nombre** et de supposer que tous les éléments énumérés sont égaux. -!!! warning "Avertissement" +
+

Avertissement

- Si une application est principalement un service web, le suivi peut se faire du côté du serveur. [Facebook](https://reports.exodus-privacy.eu.org/fr/reports/com.facebook.katana/latest/) n'affiche "aucun traqueur" mais suit certainement les intérêts et le comportement des utilisateurs sur le site. Les applications peuvent échapper à la détection en n'utilisant pas les bibliothèques de code standard produites par l'industrie de la publicité, bien que cela soit peu probable. +Si une application est principalement un service web, le suivi peut se faire du côté du serveur. [Facebook](https://reports.exodus-privacy.eu.org/fr/reports/com.facebook.katana/latest/) n'affiche "aucun traqueur" mais suit certainement les intérêts et le comportement des utilisateurs sur le site. Les applications peuvent échapper à la détection en n'utilisant pas les bibliothèques de code standard produites par l'industrie de la publicité, bien que cela soit peu probable. -!!! note "À noter" +
- Des applications respectueuses de la vie privée telles que [Bitwarden](https://reports.exodus-privacy.eu.org/fr/reports/com.x8bit.bitwarden/latest/) peuvent afficher certains traqueurs tels que [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/fr/trackers/49/). Cette bibliothèque comprend [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) qui peut fournir des [notifications push](https://fr.wikipedia.org/wiki/Server_push) dans les applications. C'est [le cas](https://fosstodon.org/@bitwarden/109636825700482007) avec Bitwarden. Cela ne signifie pas que Bitwarden utilise toutes les fonctionnalités d'analyse fournies par Google Firebase Analytics. +
+

Note

+ +Des applications respectueuses de la vie privée telles que [Bitwarden](https://reports.exodus-privacy.eu.org/fr/reports/com.x8bit.bitwarden/latest/) peuvent afficher certains traqueurs tels que [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/fr/trackers/49/). Cette bibliothèque comprend [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) qui peut fournir des [notifications push](https://fr.wikipedia.org/wiki/Server_push) dans les applications. C'est [le cas](https://fosstodon.org/@bitwarden/109636825700482007) avec Bitwarden. Cela ne signifie pas que Bitwarden utilise toutes les fonctionnalités d'analyse fournies par Google Firebase Analytics. + +
## Fonctionnalités de protection de la vie privée diff --git a/i18n/fr/os/ios-overview.md b/i18n/fr/os/ios-overview.md index d73f7d81..9bee5d1b 100644 --- a/i18n/fr/os/ios-overview.md +++ b/i18n/fr/os/ios-overview.md @@ -1,7 +1,7 @@ --- -title: Introduction à iOS +title: iOS Overview icon: simple/apple -description: iOS est un système d'exploitation mobile développé par Apple pour l'iPhone. +description: iOS is a mobile operating system developed by Apple for the iPhone. --- **iOS** et **iPadOS** sont des systèmes d'exploitation mobiles propriétaires développés par Apple pour ses produits iPhone et iPad, respectivement. Si vous possédez un appareil mobile Apple, vous pouvez améliorer votre vie privée en désactivant certaines fonctions de télémétrie intégrées et en renforçant certains paramètres de sécurité et de protection de la vie privée intégrés au système. @@ -146,9 +146,12 @@ Après avoir activé la protection en cas de vol de l’appareil, [certaines act Les iPhones sont déjà résistants aux attaques par force brute en vous faisant attendre de longues périodes de temps après plusieurs tentatives infructueuses ; cependant, il y a toujours eu des exploits pour contourner cette protection. Pour plus de sécurité, vous pouvez configurer votre téléphone pour qu'il s'efface de lui-même après 10 tentatives infructueuses de saisie du code d'accès. -!!! warning "Avertissement" +
+

Avertissement

- Si ce paramètre est activé, quelqu'un peut intentionnellement effacer votre téléphone en entrant plusieurs fois le mauvais mot de passe. Assurez-vous d'avoir des sauvegardes appropriées et n'activez ce paramètre que si vous vous sentez à l'aise avec ça. +Si ce paramètre est activé, quelqu'un peut intentionnellement effacer votre téléphone en entrant plusieurs fois le mauvais mot de passe. Assurez-vous d'avoir des sauvegardes appropriées et n'activez ce paramètre que si vous vous sentez à l'aise avec ça. + +
- [x] Activez **Effacer les données** diff --git a/i18n/fr/os/macos-overview.md b/i18n/fr/os/macos-overview.md index 30ce52a8..efdef58e 100644 --- a/i18n/fr/os/macos-overview.md +++ b/i18n/fr/os/macos-overview.md @@ -1,7 +1,7 @@ --- -title: Introduction à macOS +title: macOS Overview icon: material/apple-finder -description: macOS est le système d'exploitation d'Apple pour ordinateurs de bureau fonctionnant avec leur propre matériel pour assurer une sécurité renforcée. +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- **macOS** est un système d'exploitation Unix développé par Apple pour leurs ordinateurs Mac. Pour améliorer la confidentialité de macOS, il est possible de désactiver la télémétrie et renforcer les paramètres existants de confidentialité et de sécurité. @@ -156,9 +156,12 @@ macOS utilise la défense en profondeur en s'appuyant sur plusieurs couches de p ### Sécurité du logiciel -!!! warning "Avertissement" +
+

Avertissement

- macOS vous permet d'installer des mises à jour bêta. Elles sont instables et peuvent être accompagnées de données télémétriques supplémentaires puisqu'elles sont utilisées à des fins de test. Pour cette raison, nous vous recommandons d'éviter les logiciels bêta en général. +macOS vous permet d'installer des mises à jour bêta. Elles sont instables et peuvent être accompagnées de données télémétriques supplémentaires puisqu'elles sont utilisées à des fins de test. Pour cette raison, nous vous recommandons d'éviter les logiciels bêta en général. + +
#### Volume du système signé @@ -178,9 +181,12 @@ La protection de l'intégrité du système met en lecture seule les emplacements Les applications macOS téléchargées à partir de l'App Store doivent être mises en sandbox à l'aide de [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning "Avertissement" +
+

Avertissement

- Les logiciels téléchargés en dehors de l'App Store officiel n'ont pas besoin d'être placés en sandbox. Vous devriez éviter autant que possible les logiciels qui ne font pas partie de l'App Store. +Les logiciels téléchargés en dehors de l'App Store officiel n'ont pas besoin d'être placés en sandbox. Vous devriez éviter autant que possible les logiciels qui ne font pas partie de l'App Store. + +
##### Antivirus diff --git a/i18n/fr/os/qubes-overview.md b/i18n/fr/os/qubes-overview.md index 564f6531..c0571157 100644 --- a/i18n/fr/os/qubes-overview.md +++ b/i18n/fr/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes est un système d'exploitation conçu pour isoler les applica Les qubes utilisent la [compartimentation](https://www.qubes-os.org/intro/) pour assurer la sécurité du système. Les Qubes sont créés à partir de modèles, ceux par défaut étant pour Fedora, Debian et [Whonix](../desktop.md#whonix). Qubes OS vous permet également de créer des *qubes* à usage unique [jetables](https://www.qubes-os.org/doc/how-to-use-disposables/). -??? "Le terme *qubes* est progressivement mis à jour pour éviter d'y faire référence en tant que "machines virtuelles"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Certaines des informations présentées ici et dans la documentation du système d'exploitation Qubes OS peuvent être contradictoires, car le terme "appVM" est progressivement remplacé par "qube". Les qubes ne sont pas des machines virtuelles à part entière, mais ils conservent des fonctionnalités similaires à celles des VMs. +Certaines des informations présentées ici et dans la documentation du système d'exploitation Qubes OS peuvent être contradictoires, car le terme "appVM" est progressivement remplacé par "qube". Les qubes ne sont pas des machines virtuelles à part entière, mais ils conservent des fonctionnalités similaires à celles des VMs. + +
![Architecture de Qubes](../assets/img/qubes/qubes-trust-level-architecture.png)
Architecture de Qubes, Crédit : Intro de Qu'est-ce que Qubes OS
@@ -41,9 +44,12 @@ Vous pouvez [copier et coller du texte](https://www.qubes-os.org/doc/how-to-copy Pour copier et coller des fichiers et des répertoires (dossiers) d'un *qube* à un autre, vous pouvez utiliser l'option **Copier vers une autre AppVM...** ou **Déplacer vers une autre AppVM...**. La différence est que l'option **Déplacer** supprime le fichier d'origine. L'une ou l'autre option protégera votre presse-papiers contre les fuites vers d'autres *qubes*. Cette méthode est plus sûre que le transfert de fichiers air-gapped. Un ordinateur air-gapped sera toujours obligé d'analyser les partitions ou les systèmes de fichiers. Cela n'est pas nécessaire avec le système de copie inter-qube. -??? "Les Qubes n'ont pas leur propre système de fichiers." +
+Qubes do not have their own filesystems. - Vous pouvez [copier et déplacer des fichiers](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) entre *qubes*. Ce faisant, les changements ne sont pas immédiats et peuvent être facilement annulés en cas d'accident. Lorsque vous exécutez un *qube*, il ne dispose pas d'un système de fichiers persistant. Vous pouvez créer et supprimer des fichiers, mais ces modifications sont éphémères. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Ce faisant, les changements ne sont pas immédiats et peuvent être facilement annulés en cas d'accident. When you run a *qube*, it does not have a persistent filesystem. Vous pouvez créer et supprimer des fichiers, mais ces modifications sont éphémères. + +
### Interactions inter-VM diff --git a/i18n/he/advanced/payments.md b/i18n/he/advanced/payments.md index 7fa7b7fe..7fb67fa4 100644 --- a/i18n/he/advanced/payments.md +++ b/i18n/he/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: תשלומים פרטיים +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ icon: material/hand-coin מטבעות קריפטוגרפיים הם מטבע דיגיטלי שנועד לעבוד ללא רשויות מרכזיות כמו ממשלה או בנק. בעוד ש*כמה* פרויקטים של מטבעות קריפטוגרפיים יכולים לאפשר לך לבצע עסקאות פרטיות באופן מקוון, רבים משתמשים בבלוקצ'יין ציבורי שאינו מספק פרטיות עסקה כלשהי. מטבעות קריפטוגרפיים נוטים להיות נכסים מאוד תנודתיים, כלומר ערכם יכול להשתנות במהירות ובאופן משמעותי בכל עת. ככזה, אנו בדרך כלל לא ממליצים להשתמש במטבעות קריפטוגרפיים כמאגר ערך לטווח ארוך. אם תחליט להשתמש במטבעות קריפטוגרפיים באינטרנט, וודא שיש לך הבנה מלאה של היבטי הפרטיות שלו מראש, והשקיע רק סכומים שלא יהיה אסון להפסיד. -!!! danger "סַכָּנָה" +
+

Danger

- הרוב המכריע של מטבעות הקריפטו פועלים על בלוקצ'יין **ציבורי**, כלומר כל עסקה היא ידע ציבורי. זה כולל אפילו את רוב מטבעות הקריפטו הידועים כמו ביטקוין ואת'ריום. עסקאות עם מטבעות קריפטוגרפיים אלה לא צריכות להיחשב פרטיות ולא יגנו על האנונימיות שלך. - - בנוסף, רבים אם לא רוב המטבעות הקריפטו הם הונאות. בצע עסקאות בזהירות עם רק פרויקטים שאתה סומך עליהם. +הרוב המכריע של מטבעות הקריפטו פועלים על בלוקצ'יין **ציבורי**, כלומר כל עסקה היא ידע ציבורי. זה כולל אפילו את רוב מטבעות הקריפטו הידועים כמו ביטקוין ואת'ריום. עסקאות עם מטבעות קריפטוגרפיים אלה לא צריכות להיחשב פרטיות ולא יגנו על האנונימיות שלך. + +בנוסף, רבים אם לא רוב המטבעות הקריפטו הם הונאות. בצע עסקאות בזהירות עם רק פרויקטים שאתה סומך עליהם. + +
### מטבעות פרטיות diff --git a/i18n/he/advanced/tor-overview.md b/i18n/he/advanced/tor-overview.md index e7ca5b80..7d115d8d 100644 --- a/i18n/he/advanced/tor-overview.md +++ b/i18n/he/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/he/basics/account-creation.md b/i18n/he/basics/account-creation.md index 7733b184..6ca3bdea 100644 --- a/i18n/he/basics/account-creation.md +++ b/i18n/he/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "כיצד ליצור חשבונות אינטרנט באופן פרטי - Privacy Guides" -title: "יצירת חשבון" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: יצירת חשבונות מקוונים היא למעשה צורך באינטרנט, בצע את הצעדים האלה כדי לוודא שאתה נשאר פרטי. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- לעתים קרובות אנשים נרשמים לשירותים מבלי לחשוב. אולי זה שירות סטרימינג כדי שתוכל לצפות בתוכנית החדשה שכולם מדברים עליה, או חשבון שנותן לך הנחה למקום האוכל המהיר האהוב עליך. לא משנה מה המקרה, עליך לשקול את ההשלכות על הנתונים שלך כעת ובהמשך בהמשך הקו. @@ -29,9 +29,12 @@ description: יצירת חשבונות מקוונים היא למעשה צורך הדרך הנפוצה ביותר ליצור חשבון חדש היא באמצעות כתובת אימייל וסיסמה. בעת שימוש בשיטה זו, עליך להשתמש במנהל סיסמאות ולפעול לפי [שיטות עבודה מומלצות](passwords-overview.md) לגבי סיסמאות. -!!! tip "טיפ" +
+

Tip

- אתה יכול להשתמש במנהל הסיסמאות שלך כדי לארגן גם שיטות אימות אחרות! פשוט הוסף את הערך החדש ומלא את השדות המתאימים, אתה יכול להוסיף הערות לדברים כמו שאלות אבטחה או מפתח גיבוי. +אתה יכול להשתמש במנהל הסיסמאות שלך כדי לארגן גם שיטות אימות אחרות! פשוט הוסף את הערך החדש ומלא את השדות המתאימים, אתה יכול להוסיף הערות לדברים כמו שאלות אבטחה או מפתח גיבוי. + +
אתה תהיה אחראי על ניהול אישורי הכניסה שלך. לאבטחה נוספת, תוכל להגדיר [MFA](multi-factor-authentication.md) בחשבונות שלך. diff --git a/i18n/he/basics/common-misconceptions.md b/i18n/he/basics/common-misconceptions.md index a118a6b4..e2dd1bff 100644 --- a/i18n/he/basics/common-misconceptions.md +++ b/i18n/he/basics/common-misconceptions.md @@ -75,20 +75,23 @@ schema: אחד מדגמי האיום המובהקים ביותר הוא כזה שבו אנשים *יודעים מי אתה* ואחד שבו הם לא יודעים. תמיד יהיו מצבים שבהם אתה חייב להצהיר על שמך החוקי ויש אחרים שבהם אתה לא צריך. -1. **זהות ידועה** - זהות ידועה משמשת לדברים שבהם עליך להצהיר על שמך. ישנם מסמכים וחוזים משפטיים רבים שבהם נדרשת זהות משפטית. זה יכול לנוע בין פתיחת חשבון בנק, חתימה על חוזה שכירות, השגת דרכון, הצהרות מכס בעת יבוא פריטים או התמודדות אחרת עם הממשלה שלך. דברים אלה יובילו בדרך כלל לאישורים כגון כרטיסי אשראי, בדיקות דירוג אשראי, מספרי חשבונות ואולי כתובות פיזיות. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - אנחנו לא ממליצים להשתמש ב-VPN או ב-Tor עבור אף אחד מהדברים האלה, מכיוון שהזהות שלך כבר ידועה באמצעים אחרים. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "טיפ" - - בעת קניות באינטרנט, השימוש ב[ארונית חבילות](https://en.wikipedia.org/wiki/Parcel_locker) יכול לעזור לשמור על פרטיות הכתובת הפיזית שלך. +
+

Tip

+ +בעת קניות באינטרנט, השימוש ב[ארונית חבילות](https://en.wikipedia.org/wiki/Parcel_locker) יכול לעזור לשמור על פרטיות הכתובת הפיזית שלך. + +
2. **זהות לא ידועה** - זהות לא ידועה יכולה להיות שם בדוי יציב שאתה משתמש בו באופן קבוע. זה לא אנונימי כי זה לא משתנה. אם אתה חלק מקהילה מקוונת, ייתכן שתרצה לשמור על דמות שאחרים מכירים. שם בדוי זה אינו אנונימי מכיוון שאם מנוטרים מספיק זמן - פרטים על הבעלים יכולים לחשוף מידע נוסף, כגון האופן שבו הם כותבים, הידע הכללי שלהם לגבי נושאים מעניינים וכו'. - ייתכן שתרצו להשתמש ב - VPN כדי להסתיר את כתובת ה - IP שלכם. קשה יותר להסוות עסקאות פיננסיות: תוכל לשקול להשתמש במטבעות קריפטוגרפיים אנונימיים, כגון [Monero](https://www.getmonero.org/). שימוש בהעברת אלטקוין עשוי גם לעזור להסוות את מקור המטבע שלך. בדרך כלל, ההחלפות דורשות את השלמת KYC (הכר את הלקוח שלך) לפני שהן יאפשרו לך להחליף מטבע פיאט לכל סוג של מטבע קריפטוגרפי. גם אפשרויות מפגש מקומיות עשויות להוות פתרון; עם זאת, אלה לעתים קרובות יותר יקרים ולפעמים גם דורשים KYC. +ייתכן שתרצו להשתמש ב - VPN כדי להסתיר את כתובת ה - IP שלכם. קשה יותר להסוות עסקאות פיננסיות: תוכל לשקול להשתמש במטבעות קריפטוגרפיים אנונימיים, כגון [Monero](https://www.getmonero.org/). שימוש בהעברת אלטקוין עשוי גם לעזור להסוות את מקור המטבע שלך. בדרך כלל, ההחלפות דורשות את השלמת KYC (הכר את הלקוח שלך) לפני שהן יאפשרו לך להחליף מטבע פיאט לכל סוג של מטבע קריפטוגרפי. גם אפשרויות מפגש מקומיות עשויות להוות פתרון; עם זאת, אלה לעתים קרובות יותר יקרים ולפעמים גם דורשים KYC. 3. **זהות אנונימית** - גם עם ניסיון, זהויות אנונימיות קשות לשמירה לאורך תקופות זמן ארוכות. הן צריכות להיות זהויות קצרות טווח וקצרות מועד המסובבות באופן קבוע. - שימוש ב- Tor יכול לעזור בזה. ראוי גם לציין כי אנונימיות רבה יותר אפשרית באמצעות תקשורת אסינכרונית: תקשורת בזמן אמת חשופה לניתוח של דפוסי הקלדה (כלומר יותר מפסקת טקסט, מופצת בפורום, באמצעות דואר אלקטרוני וכו') +שימוש ב- Tor יכול לעזור בזה. ראוי גם לציין כי אנונימיות רבה יותר אפשרית באמצעות תקשורת אסינכרונית: תקשורת בזמן אמת חשופה לניתוח של דפוסי הקלדה (כלומר יותר מפסקת טקסט, מופצת בפורום, באמצעות דואר אלקטרוני וכו') [^1]: אחת הדוגמאות הבולטות לכך היא [תקרית 2021 שבה חוקרים מאוניברסיטת מינסוטה הציגו שלוש נקודות תורפה לפרויקט פיתוח ליבת לינוקס](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/he/basics/common-threats.md b/i18n/he/basics/common-threats.md index 64a304e7..06a41afa 100644 --- a/i18n/he/basics/common-threats.md +++ b/i18n/he/basics/common-threats.md @@ -35,19 +35,25 @@ description: מודל האיום שלך הוא אישי עבורך, אך אלו כדי למזער את הנזק שתוכנה זדונית *עלולה* לגרום, עליך להפעיל אבטחה על ידי מידור. לדוגמה, זה יכול לבוא בצורה של שימוש במחשבים שונים לעבודות שונות, שימוש במכונות וירטואליות כדי להפריד בין קבוצות שונות של יישומים קשורים, או שימוש במערכת הפעלה מאובטחת עם התמקדות חזקה בארגז חול של יישומים ובקרת גישה חובה. -!!! tip "טיפ" +
+

Tip

- למערכות הפעלה מובייל יש בדרך כלל ארגז חול טוב יותר לאפליקציות מאשר למערכות הפעלה שולחניות: אפליקציות אינן יכולות לקבל גישת שורש, ודורשות הרשאה לגישה למשאבי המערכת. - - מערכות הפעלה שולחניות בדרך כלל מפגרות עם ארגז חול נכון. ל-ChromeOS יש יכולות ארגז חול דומות לאנדרואיד, ול-macOS יש בקרת הרשאות מערכת מלאה (ומפתחים יכולים להצטרף לארגזי חול עבור יישומים). עם זאת, מערכות הפעלה אלו אכן משדרות מידע מזהה ליצרני ה-OEM שלהם. לינוקס נוטה לא לשלוח מידע לספקי מערכות, אך יש לה הגנה גרועה מפני ניצול ואפליקציות זדוניות. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +למערכות הפעלה מובייל יש בדרך כלל ארגז חול טוב יותר לאפליקציות מאשר למערכות הפעלה שולחניות: אפליקציות אינן יכולות לקבל גישת שורש, ודורשות הרשאה לגישה למשאבי המערכת. + +מערכות הפעלה שולחניות בדרך כלל מפגרות עם ארגז חול נכון. ל-ChromeOS יש יכולות ארגז חול דומות לאנדרואיד, ול-macOS יש בקרת הרשאות מערכת מלאה (ומפתחים יכולים להצטרף לארגזי חול עבור יישומים). עם זאת, מערכות הפעלה אלו אכן משדרות מידע מזהה ליצרני ה-OEM שלהם. לינוקס נוטה לא לשלוח מידע לספקי מערכות, אך יש לה הגנה גרועה מפני ניצול ואפליקציות זדוניות. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: התקפות ממוקדות התקפות ממוקדות נגד אדם ספציפי הן בעייתיות יותר להתמודדות. התקפות נפוצות כוללות שליחת מסמכים זדוניים באמצעות מייל, ניצול פגיעויות (למשל בדפדפנים ובמערכות הפעלה) והתקפות פיזיות. אם זה מדאיג אותך, עליך להשתמש באסטרטגיות מתקדמות יותר להפחתת איומים. -!!! tip "טיפ" +
+

Tip

- לפי התכנון, **דפדפני אינטרנט**, **לקוחות אימייל** ו**יישומי משרד** מריצים בדרך כלל קוד לא מהימן, שנשלח אליך מצדדים שלישיים. הפעלת מספר מכונות וירטואליות - כדי להפריד יישומים כמו אלה מהמערכת המארחת שלך, כמו גם אחד מהשני - היא טכניקה אחת שבה תוכל להשתמש כדי להפחית את הסיכוי של ניצול ביישומים אלה שיפגע בשאר המערכת שלך. לדוגמה, טכנולוגיות כמו Qubes OS או Microsoft Defender Application Guard ב-Windows מספקות שיטות נוחות לעשות זאת. +לפי התכנון, **דפדפני אינטרנט**, **לקוחות אימייל** ו**יישומי משרד** מריצים בדרך כלל קוד לא מהימן, שנשלח אליך מצדדים שלישיים. הפעלת מספר מכונות וירטואליות - כדי להפריד יישומים כמו אלה מהמערכת המארחת שלך, כמו גם אחד מהשני - היא טכניקה אחת שבה תוכל להשתמש כדי להפחית את הסיכוי של ניצול ביישומים אלה שיפגע בשאר המערכת שלך. לדוגמה, טכנולוגיות כמו Qubes OS או Microsoft Defender Application Guard ב-Windows מספקות שיטות נוחות לעשות זאת. + +
אם אתה מודאג מ**התקפות פיזיות**, עליך להשתמש במערכת הפעלה עם יישום אתחול מאומת מאובטח, כגון Android, iOS, macOS או [Windows (עם TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). עליך גם לוודא שהכונן שלך מוצפן ושמערכת ההפעלה משתמשת ב-TPM או ב-Secure [מובלע](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) או [אלמנט](https://developers.google.com/android/security/android-ready-se) כדי להגביל ניסיונות להזין את ביטוי הסיסמה להצפנה. עליך להימנע משיתוף המחשב שלך עם אנשים שאינך סומך עליהם, מכיוון שרוב מערכות ההפעלה שולחניות אינן מצפינות נתונים בנפרד לכל משתמש. @@ -61,13 +67,16 @@ description: מודל האיום שלך הוא אישי עבורך, אך אלו למרבה המזל, E2EE יכול להקל על בעיה זו על ידי הצפנת התקשורת בינך לבין הנמענים הרצויים שלך לפני שהם בכלל נשלחים לשרת. סודיות ההודעות שלך מובטחת, בהנחה שלספק השירות אין גישה למפתחות הפרטיים של אף אחד מהצדדים. -!!! note "הערה על הצפנה מבוססת אינטרנט" +
+

Note on Web-based Encryption

- בפועל, היעילות של יישומי E2EE שונים משתנה. אפליקציות, כגון [Signal](../real-time-communication.md#signal), פועלות באופן מקורי במכשיר שלך, וכל עותק של האפליקציה זהה בהתקנות שונות. אם ספק השירות היה מציג [דלת אחורית](https://en.wikipedia.org/wiki/Backdoor_(computing)) באפליקציה שלו - בניסיון לגנוב את המפתחות הפרטיים שלך - ניתן היה לזהות אותו מאוחר יותר באמצעות [הפוך הנדסה](https://en.wikipedia.org/wiki/Reverse_engineering). - - מצד שני, יישומי E2EE מבוססי אינטרנט, כמו דואר האינטרנט של Proton Mail או *כספת האינטרנט* של Bitwarden, מסתמכים על השרת שמגיש באופן דינמי קוד JavaScript לדפדפן כדי לטפל בהצפנה. שרת זדוני יכול למקד אותך ולשלוח לך קוד JavaScript זדוני כדי לגנוב את מפתח ההצפנה שלך (והיה קשה מאוד לשים לב אליו). מכיוון שהשרת יכול לבחור לשרת לקוחות אינטרנט שונים לאנשים שונים - גם אם שמתם לב להתקפה - יהיה קשה מאוד להוכיח את אשמתו של הספק. - - לכן, עליך להשתמש ביישומים מקוריים על פני לקוחות אינטרנט במידת האפשר. +בפועל, היעילות של יישומי E2EE שונים משתנה. אפליקציות, כגון [Signal](../real-time-communication.md#signal), פועלות באופן מקורי במכשיר שלך, וכל עותק של האפליקציה זהה בהתקנות שונות. אם ספק השירות היה מציג [דלת אחורית](https://en.wikipedia.org/wiki/Backdoor_(computing)) באפליקציה שלו - בניסיון לגנוב את המפתחות הפרטיים שלך - ניתן היה לזהות אותו מאוחר יותר באמצעות [הפוך הנדסה](https://en.wikipedia.org/wiki/Reverse_engineering). + +מצד שני, יישומי E2EE מבוססי אינטרנט, כמו דואר האינטרנט של Proton Mail או *כספת האינטרנט* של Bitwarden, מסתמכים על השרת שמגיש באופן דינמי קוד JavaScript לדפדפן כדי לטפל בהצפנה. שרת זדוני יכול למקד אותך ולשלוח לך קוד JavaScript זדוני כדי לגנוב את מפתח ההצפנה שלך (והיה קשה מאוד לשים לב אליו). מכיוון שהשרת יכול לבחור לשרת לקוחות אינטרנט שונים לאנשים שונים - גם אם שמתם לב להתקפה - יהיה קשה מאוד להוכיח את אשמתו של הספק. + +לכן, עליך להשתמש ביישומים מקוריים על פני לקוחות אינטרנט במידת האפשר. + +
אפילו עם E2EE, ספקי שירות עדיין יכולים ליצור פרופיל שלך על סמך **מטא נתונים**, שבדרך כלל אינם מוגנים. למרות שספק השירות לא יכול לקרוא את ההודעות שלך, הוא עדיין יכול לראות דברים חשובים, כגון עם מי אתה מדבר, באיזו תדירות אתה שולח להם הודעות ומתי אתה פעיל בדרך כלל. הגנה על מטא נתונים היא נדירה למדי, ואם היא ב[מודל האיום](threat-modeling.md) שלך - עליך לשים לב היטב לתיעוד הטכני של התוכנה שבה אתה משתמש כדי לראות אם יש מזעור או הגנה של מטא נתונים בכלל. @@ -77,17 +86,23 @@ description: מודל האיום שלך הוא אישי עבורך, אך אלו מעקב המוני הוא המאמץ המורכב לנטר את "ההתנהגות, הפעילויות הרבות או המידע" של אוכלוסייה שלמה (או חלק ניכר מאוכלוסיה).[^1] לעתים קרובות זה מתייחס לתוכניות ממשלתיות, כגון אלו [נחשף על ידי אדוארד סנודן ב-2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). עם זאת, זה יכול להתבצע גם על ידי תאגידים, בין אם מטעם סוכנויות ממשלתיות או ביוזמתם. -!!! abstract "אטלס מעקב" +
+

Atlas of Surveillance

- אם אתה רוצה ללמוד עוד על שיטות מעקב וכיצד הן מיושמות בעיר שלך, תוכל גם להסתכל על [אטלס המעקב](https://atlasofsurveillance.org/) של [Electronic Frontier Foundation](https://www.eff.org/). - - בצרפת אתה יכול להסתכל על [אתר Technolopolice](https://technopolice.fr/villes/) המתוחזק על ידי העמותה ללא מטרות רווח La Quadrature du Net. +אם אתה רוצה ללמוד עוד על שיטות מעקב וכיצד הן מיושמות בעיר שלך, תוכל גם להסתכל על [אטלס המעקב](https://atlasofsurveillance.org/) של [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
ממשלות לעתים קרובות מצדיקות תוכניות מעקב המוניות כאמצעים הכרחיים למאבק בטרור ולמניעת פשע. עם זאת, תוך הפרת זכויות אדם, הוא משמש לרוב כדי למקד באופן לא פרופורציונלי קבוצות מיעוט ומתנגדים פוליטיים, בין היתר. -!!! quote "ACLU: [*שיעור הפרטיות של 9/11: מעקב המוני הוא לא הדרך קדימה*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- אל מול [חשיפותיו של אדוארד סנודן לגבי תוכניות ממשלתיות כגון [PRISM](https://en.wikipedia.org/wiki/PRISM) ו-[Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], פקידי מודיעין גם הודו כי ה-NSA במשך שנים אספה בחשאי תיעוד על כמעט כל שיחות טלפון של כל אמריקאי - מי מתקשר למי, מתי השיחות הללו מבוצעות וכמה זמן הן נמשכות. מידע מסוג זה, כאשר הוא נצבר על ידי ה-NSA יום אחר יום, יכול לחשוף פרטים רגישים להפליא על חייהם והאסוציאציות של אנשים, כגון האם הם התקשרו לכומר, מטפל בהפלות, ליועצת להתמכרות או למוקד התאבדות. +אל מול [חשיפותיו של אדוארד סנודן לגבי תוכניות ממשלתיות כגון [PRISM](https://en.wikipedia.org/wiki/PRISM) ו-[Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], פקידי מודיעין גם הודו כי ה-NSA במשך שנים אספה בחשאי תיעוד על כמעט כל שיחות טלפון של כל אמריקאי - מי מתקשר למי, מתי השיחות הללו מבוצעות וכמה זמן הן נמשכות. מידע מסוג זה, כאשר הוא נצבר על ידי ה-NSA יום אחר יום, יכול לחשוף פרטים רגישים להפליא על חייהם והאסוציאציות של אנשים, כגון האם הם התקשרו לכומר, מטפל בהפלות, ליועצת להתמכרות או למוקד התאבדות. + +
למרות המעקב ההמוני הגובר בארצות הברית, הממשלה מצאה שלתוכניות מעקב המוני כמו סעיף 215 היה "ערך ייחודי מועט" ביחס לעצירת פשעים או מזימות טרור בפועל, כאשר מאמצים משכפלים במידה רבה את תוכניות המעקב הממוקדות של ה-FBI עצמו.[^2] @@ -133,11 +148,14 @@ description: מודל האיום שלך הוא אישי עבורך, אך אלו אנשים המודאגים מהאיום של צנזורה יכולים להשתמש בטכנולוגיות כמו [Tor](../advanced/tor-overview.md) כדי לעקוף אותו, ולתמוך בפלטפורמות תקשורת עמידות לצנזורה כמו [Matrix](../real-time-communication.md#element), שאין לה סמכות חשבון מרכזית יכול לסגור חשבונות באופן שרירותי. -!!! tip "טיפ" +
+

Tip

- למרות שהתחמקות מצנזורה עצמה יכולה להיות קלה, הסתרת העובדה שאתה עושה זאת יכולה להיות מאוד בעייתית. - - עליך לשקול באילו היבטים של הרשת יריבך יכול לצפות, והאם יש לך הכחשה סבירה למעשיך. לדוגמה, שימוש ב-[DNS מוצפן](../advanced/dns-overview.md#what-is-encrypted-dns) יכול לעזור לך לעקוף מערכות צנזורה בסיסיות ומבוססות DNS, אבל זה לא באמת יכול להסתיר את מה שאתה ביקור מ-ISP שלך. VPN או Tor יכולים לעזור להסתיר את מה שאתה מבקר ממנהלי רשת, אבל לא יכולים להסתיר שאתה משתמש ברשתות האלה מלכתחילה. העברות ניתנות לחיבור (כגון Obfs4proxy, Meek או Shadowsocks) יכולים לעזור לך להתחמק מחומת אש שחוסמת פרוטוקולי VPN נפוצים או Tor, אך עדיין ניתן לזהות את ניסיונות העקיפה שלך בשיטות כמו בדיקה או [בדיקת מנות עמוקה](https://en.wikipedia.org/wiki/Deep_packet_inspection). +למרות שהתחמקות מצנזורה עצמה יכולה להיות קלה, הסתרת העובדה שאתה עושה זאת יכולה להיות מאוד בעייתית. + +עליך לשקול באילו היבטים של הרשת יריבך יכול לצפות, והאם יש לך הכחשה סבירה למעשיך. לדוגמה, שימוש ב-[DNS מוצפן](../advanced/dns-overview.md#what-is-encrypted-dns) יכול לעזור לך לעקוף מערכות צנזורה בסיסיות ומבוססות DNS, אבל זה לא באמת יכול להסתיר את מה שאתה ביקור מ-ISP שלך. VPN או Tor יכולים לעזור להסתיר את מה שאתה מבקר ממנהלי רשת, אבל לא יכולים להסתיר שאתה משתמש ברשתות האלה מלכתחילה. העברות ניתנות לחיבור (כגון Obfs4proxy, Meek או Shadowsocks) יכולים לעזור לך להתחמק מחומת אש שחוסמת פרוטוקולי VPN נפוצים או Tor, אך עדיין ניתן לזהות את ניסיונות העקיפה שלך בשיטות כמו בדיקה או [בדיקת מנות עמוקה](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
אתה חייב תמיד לשקול את הסיכונים בניסיון לעקוף את הצנזורה, את ההשלכות האפשריות ועד כמה מתוחכם עלול להיות היריב שלך. אתה צריך להיות זהיר בבחירת התוכנה שלך, ולהכין תוכנית גיבוי למקרה שתיתפס. diff --git a/i18n/he/basics/multi-factor-authentication.md b/i18n/he/basics/multi-factor-authentication.md index a9ffd2b4..9a714094 100644 --- a/i18n/he/basics/multi-factor-authentication.md +++ b/i18n/he/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLog ### לינוקס -!!! warning "אזהרה" +
+

Warning

- אם שם המארח של המערכת שלך משתנה (כגון עקב DHCP), לא תוכל להתחבר. חיוני להגדיר שם מארח מתאים למחשב שלך לפני ביצוע מדריך זה. +אם שם המארח של המערכת שלך משתנה (כגון עקב DHCP), לא תוכל להתחבר. חיוני להגדיר שם מארח מתאים למחשב שלך לפני ביצוע מדריך זה. + +
מודול `pam_u2f` ב-Linux יכול לספק אימות דו-גורמי לכניסה לרוב ההפצות הפופולריות של לינוקס. אם יש לך מפתח אבטחת חומרה התומך ב-U2F, תוכל להגדיר אימות MFA עבור הכניסה שלך. ליוביקו יש מדריך [מדריך התחברות ל-Ubuntu Linux - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) שאמור לעבוד על כל הפצה. הפקודות של מנהל החבילות - כגון `apt-get` - ושמות החבילות עשויים להיות שונים. מדריך זה **אינו** חל על מערכת ההפעלה Qubes. diff --git a/i18n/he/basics/passwords-overview.md b/i18n/he/basics/passwords-overview.md index fda831a9..38d7970e 100644 --- a/i18n/he/basics/passwords-overview.md +++ b/i18n/he/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "מבוא לסיסמאות" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: אלו הם כמה טיפים וטריקים כיצד ליצור את הסיסמאות החזקות ביותר ולשמור על אבטחת החשבונות שלך. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- סיסמאות הן חלק חיוני מחיינו הדיגיטליים היומיומיים. אנו משתמשים בהם כדי להגן על החשבונות שלנו, המכשירים והסודות שלנו. למרות היותם לעתים קרובות הדבר היחיד בינינו לבין יריב שרודף אחרי המידע הפרטי שלנו, לא מושקעת בהם הרבה מחשבה, מה שמוביל לרוב לכך שאנשים משתמשים בסיסמאות שניתן לנחש בקלות או להכריח אותן. @@ -26,9 +26,12 @@ description: אלו הם כמה טיפים וטריקים כיצד ליצור א כשמדובר בסיסמאות שאינך חייב לזכור (כגון סיסמאות המאוחסנות בתוך מנהל הסיסמאות שלך), אם [מודל האיומים](threat-modeling.md) שלך דורש זאת, אנו ממליצים עוברים על חשבונות חשובים (במיוחד חשבונות שאינם משתמשים באימות רב-גורמי) ומשנים את הסיסמה שלהם כל חודשיים, למקרה שהם נפגעו בפרצת מידע שעדיין לא הפכה לציבורית. רוב מנהלי הסיסמאות מאפשרים לך להגדיר תאריך תפוגה לסיסמה שלך כדי להקל על הניהול שלה. -!!! tip "בודקים פרצות נתונים" +
+

Checking for data breaches

- אם מנהל הסיסמאות שלך מאפשר לך לחפש סיסמאות שנפגעו, הקפד לעשות זאת ולשנות מיד כל סיסמה שאולי נחשפה בפרצת נתונים. לחלופין, תוכל לעקוב אחר [עדכון ההפרות האחרונות של have i been pwned'](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) בעזרת [מצבר חדשות](../news-aggregators.md). +אם מנהל הסיסמאות שלך מאפשר לך לחפש סיסמאות שנפגעו, הקפד לעשות זאת ולשנות מיד כל סיסמה שאולי נחשפה בפרצת נתונים. לחלופין, תוכל לעקוב אחר [עדכון ההפרות האחרונות של have i been pwned'](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) בעזרת [מצבר חדשות](../news-aggregators.md). + +
## יצירת סיסמאות חזקות @@ -48,9 +51,12 @@ description: אלו הם כמה טיפים וטריקים כיצד ליצור א כדי ליצור ביטוי סיסמא של כלי קוביות באמצעות קוביות אמיתיות, בצע את השלבים הבאים: -!!! note "הערה" +
+

Note

- הוראות אלה מניחות שאתה משתמש ב[רשימת המילים הגדולה של EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) כדי ליצור את ביטוי הסיסמה, שדורש חמש הטלות קוביות לכל מילה. רשימות מילים אחרות עשויות לדרוש יותר או פחות גלגולים למילה, ועשויות לדרוש כמות שונה של מילים כדי להשיג את אותה אנטרופיה. +הוראות אלה מניחות שאתה משתמש ב[רשימת המילים הגדולה של EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) כדי ליצור את ביטוי הסיסמה, שדורש חמש הטלות קוביות לכל מילה. רשימות מילים אחרות עשויות לדרוש יותר או פחות גלגולים למילה, ועשויות לדרוש כמות שונה של מילים כדי להשיג את אותה אנטרופיה. + +
1. לזרוק קובייה בעלת שש צדדים חמש פעמים, לרשום את המספר לאחר כל גלגול. @@ -60,31 +66,37 @@ description: אלו הם כמה טיפים וטריקים כיצד ליצור א 4. חזור על תהליך זה עד לביטוי הסיסמה שלך יש כמה מילים שאתה צריך, שאותן עליך להפריד ברווח. -!!! warning "חשוב" +
+

Important

- כדאי **לא** לגלגל מחדש מילים עד שתקבל שילוב של מילים שמושכות אותך. התהליך צריך להיות אקראי לחלוטין. +כדאי **לא** לגלגל מחדש מילים עד שתקבל שילוב של מילים שמושכות אותך. התהליך צריך להיות אקראי לחלוטין. + +
אם אין לך גישה או תעדיף לא להשתמש בקוביות אמיתיות, תוכל להשתמש במחולל הסיסמאות המובנה של מנהל הסיסמאות שלך, שכן לרובם יש אפשרות ליצור ביטויי סיסמה של תוכנת קוביות בנוסף לסיסמאות הרגילות. אנו ממליצים להשתמש ב[רשימת המילים הגדולה של EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) כדי ליצור את ביטויי הסיסמה של תוכנת הקוביות שלך, מכיוון שהיא מציעה את אותה אבטחה בדיוק כמו הרשימה המקורית, תוך שהיא מכילה מילים שקל יותר לשנן. יש גם [רשימות מילים אחרות בשפות שונות](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), אם אינך רוצה שביטוי הסיסמה שלך יהיה באנגלית. -??? note "הסבר על אנטרופיה וחוזק של ביטויי סיסמה של כלי קוביות" +
+Explanation of entropy and strength of diceware passphrases - כדי להדגים עד כמה חזקות ביטויי הסיסמא של תוכנת קוביות, נשתמש בביטוי הסיסמא של שבע המילים שהוזכר לעיל (`מהירות ניתנת לצפייה סרבן עיפרון מרוטש שבע עשרה מוצג`) וב[רשימת המילים הגדולה של EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) כדוגמה. - - מדד אחד לקביעת עוצמתו של משפט סיסמא של קוביות הוא כמה אנטרופיה יש לו. האנטרופיה למילה בביטוי סיסמה של תוכנת קוביות מחושבת כnd the overall entropy of the passphrase is calculated as -$\text{log}_2(\text{WordsInList})$והאנטרופיה הכוללת של ביטוי הסיסמה מחושבת כ - $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - לכן, כל מילה ברשימה הנ"ל מביאה ל-~12.9 סיביות של אנטרופיה ($\text{log}_2(7776)$), ולביטוי סיסמה של שבע מילים שנגזר ממנו יש ~90.47 סיביות של אנטרופיה($\text{log}_2(7776^7)$). - - [רשימת המילים הגדולה של EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) מכילה 7776 מילים ייחודיות. כדי לחשב את כמות ביטויי הסיסמה האפשריים, כל שעלינו לעשות הוא $\text{WordsInList}^\text{WordsInPhrase}$, או במקרה שלנו, $ 7776^7 $. - - בואו נשים את כל זה בפרספקטיבה: ביטוי סיסמה של שבע מילים באמצעות [רשימת המילים הגדולה של EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) הוא אחד מ-~1,719,070,799,748,422,500,000,phrass אפשריות. - - בממוצע, צריך לנסות 50% מכל השילובים האפשריים כדי לנחש את הביטוי שלך. עם זאת בחשבון, גם אם היריב שלך מסוגל ל-1,000,000,000,000 ניחושים בשנייה, עדיין ייקח לו ~27,255,689 שנים לנחש את משפט הסיסמה שלך. זה המצב גם אם הדברים הבאים נכונים: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - היריב שלך יודע שהשתמשת בשיטת קוביות. - - היריב שלך יודע את רשימת המילים הספציפית שבה השתמשת. - - היריב שלך יודע כמה מילים מכיל ביטוי הסיסמה שלך. +מדד אחד לקביעת עוצמתו של משפט סיסמא של קוביות הוא כמה אנטרופיה יש לו. האנטרופיה למילה בביטוי סיסמה של תוכנת קוביות מחושבת כnd the overall entropy of the passphrase is calculated as -$\text{log}_2(\text{WordsInList})$והאנטרופיה הכוללת של ביטוי הסיסמה מחושבת כ - $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +לכן, כל מילה ברשימה הנ"ל מביאה ל-~12.9 סיביות של אנטרופיה ($\text{log}_2(7776)$), ולביטוי סיסמה של שבע מילים שנגזר ממנו יש ~90.47 סיביות של אנטרופיה($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. כדי לחשב את כמות ביטויי הסיסמה האפשריים, כל שעלינו לעשות הוא $\text{WordsInList}^\text{WordsInPhrase}$, או במקרה שלנו, $ 7776^7 $. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +בממוצע, צריך לנסות 50% מכל השילובים האפשריים כדי לנחש את הביטוי שלך. עם זאת בחשבון, גם אם היריב שלך מסוגל ל-1,000,000,000,000 ניחושים בשנייה, עדיין ייקח לו ~27,255,689 שנים לנחש את משפט הסיסמה שלך. זה המצב גם אם הדברים הבאים נכונים: + +- היריב שלך יודע שהשתמשת בשיטת קוביות. +- היריב שלך יודע את רשימת המילים הספציפית שבה השתמשת. +- היריב שלך יודע כמה מילים מכיל ביטוי הסיסמה שלך. + +
לסיכום, ביטויי סיסמה של תוכנת קוביות הם האפשרות הטובה ביותר שלך כאשר אתה צריך משהו שקל לזכור גם *ו* חזק במיוחד. @@ -98,13 +110,16 @@ description: אלו הם כמה טיפים וטריקים כיצד ליצור א [רשימת מנהלי סיסמאות מומלצים](../passwords.md ""){.md-button} -!!! warning אזהרה "אל תציב את הסיסמאות ואסימוני ה-TOTP שלך באותו מנהל סיסמאות" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- בעת שימוש בקודי TOTP כ[אימות רב-גורמי](../multi-factor-authentication.md), שיטת האבטחה הטובה ביותר היא לשמור את קודי ה-TOTP שלך ב[אפליקציה נפרדת](../multi-factor-authentication.md#authenticator-apps). - - אחסון אסימוני ה-TOTP שלך באותו מקום כמו הסיסמאות שלך, למרות שהוא נוח, מצמצם את החשבונות לגורם יחיד במקרה שיריב יקבל גישה למנהל הסיסמאות שלך. - - יתר על כן, איננו ממליצים לאחסן קודי שחזור חד-פעמיים במנהל הסיסמאות שלך. יש לאחסן אותם בנפרד, כגון במיכל מוצפן בהתקן אחסון לא מקוון. +בעת שימוש בקודי TOTP כ[אימות רב-גורמי](../multi-factor-authentication.md), שיטת האבטחה הטובה ביותר היא לשמור את קודי ה-TOTP שלך ב[אפליקציה נפרדת](../multi-factor-authentication.md#authenticator-apps). + +אחסון אסימוני ה-TOTP שלך באותו מקום כמו הסיסמאות שלך, למרות שהוא נוח, מצמצם את החשבונות לגורם יחיד במקרה שיריב יקבל גישה למנהל הסיסמאות שלך. + +יתר על כן, איננו ממליצים לאחסן קודי שחזור חד-פעמיים במנהל הסיסמאות שלך. יש לאחסן אותם בנפרד, כגון במיכל מוצפן בהתקן אחסון לא מקוון. + +
### גיבויים diff --git a/i18n/he/basics/vpn-overview.md b/i18n/he/basics/vpn-overview.md index bb83d8d8..54993cfa 100644 --- a/i18n/he/basics/vpn-overview.md +++ b/i18n/he/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "כיצד VPNs מגנים על הפרטיות שלך? סקירת ה-VPN שלנו -Privacy Guides" -title: סקירה כללית של VPN +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: רשתות וירטואליות פרטיות מעבירות את הסיכון מספק שירותי האינטרנט שלך לצד שלישי שאתה סומך עליו. כדאי לזכור את הדברים האלה. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- רשתות וירטואליות פרטיות הן דרך להרחיב את הקצה של הרשת שלך ליציאה למקום אחר בעולם. @@ -11,9 +11,12 @@ description: רשתות וירטואליות פרטיות מעבירות את ה Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note "הערה" +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/he/os/android-overview.md b/i18n/he/os/android-overview.md index 3990eaea..638119d2 100644 --- a/i18n/he/os/android-overview.md +++ b/i18n/he/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: סקירה כללית של אנדרואיד +title: Android Overview icon: simple/android -description: אנדרואיד היא מערכת הפעלה בקוד פתוח עם הגנות אבטחה חזקות, מה שהופך אותה לבחירה המובילה שלנו עבור טלפונים. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![לוגו אנדרואיד](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Fairphone, for example, markets their Fairphone 4 device as receiving 6 years of [Exodus](https://exodus-privacy.eu.org/) יכול להיות שימושי כאשר משווים אפליקציות שיש להן מטרות דומות. אם אפליקציה דורשת הרבה הרשאות ויש לה הרבה פרסום וניתוח זה כנראה סימן רע. אנו ממליצים להסתכל על העוקבים הבודדים ולקרוא את התיאורים שלהם במקום פשוט **לספור את הסכום הכולל** ולהנחה שכל הפריטים הרשומים שווים. -!!! warning "אזהרה" +
+

Warning

- אם אפליקציה היא ברובה שירות מבוסס אינטרנט, המעקב עשוי להתרחש בצד השרת. [פייסבוק](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) מציג "ללא עוקבים" אבל בהחלט עוקב אחר תחומי העניין וההתנהגות של המשתמשים ברחבי האתר. אפליקציות עשויות להתחמק מזיהוי על ידי אי שימוש בספריות קוד סטנדרטיות המיוצרות על ידי תעשיית הפרסום, אם כי זה לא סביר. +אם אפליקציה היא ברובה שירות מבוסס אינטרנט, המעקב עשוי להתרחש בצד השרת. [פייסבוק](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) מציג "ללא עוקבים" אבל בהחלט עוקב אחר תחומי העניין וההתנהגות של המשתמשים ברחבי האתר. אפליקציות עשויות להתחמק מזיהוי על ידי אי שימוש בספריות קוד סטנדרטיות המיוצרות על ידי תעשיית הפרסום, אם כי זה לא סביר. -!!! note "הערה" +
- אפליקציות ידידותיות לפרטיות כגון [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) עשויות להציג עוקבים מסוימים כגון [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). ספרייה זו כוללת את [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) שיכולה לספק [הודעות דחיפה](https://en.wikipedia.org/wiki/Push_technology) באפליקציות. זה [המקרה](https://fosstodon.org/@bitwarden/109636825700482007) עם Bitwarden. זה לא אומר ש-Bitwarden משתמש בכל תכונות הניתוח שמסופקות על ידי Google Firebase Analytics. +
+

Note

+ +אפליקציות ידידותיות לפרטיות כגון [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) עשויות להציג עוקבים מסוימים כגון [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). ספרייה זו כוללת את [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) שיכולה לספק [הודעות דחיפה](https://en.wikipedia.org/wiki/Push_technology) באפליקציות. זה [המקרה](https://fosstodon.org/@bitwarden/109636825700482007) עם Bitwarden. זה לא אומר ש-Bitwarden משתמש בכל תכונות הניתוח שמסופקות על ידי Google Firebase Analytics. + +
## תכונות פרטיות diff --git a/i18n/he/os/ios-overview.md b/i18n/he/os/ios-overview.md index fc279345..b1813837 100644 --- a/i18n/he/os/ios-overview.md +++ b/i18n/he/os/ios-overview.md @@ -1,7 +1,7 @@ --- -title: סקירה כללית של iOS +title: iOS Overview icon: simple/apple -description: iOS היא מערכת הפעלה ניידת שפותחה על ידי אפל עבור האייפון. +description: iOS is a mobile operating system developed by Apple for the iPhone. --- **iOS** ו-**iPadOS** הן מערכות הפעלה קנייניות לנייד שפותחו על ידי אפל עבור מוצרי האייפון והאייפד שלהם, בהתאמה. אם יש לך מכשיר נייד של אפל, תוכל להגביר את הפרטיות שלך על ידי השבתת כמה תכונות טלמטריה מובנות, והקשחת הגדרות פרטיות ואבטחה המובנות במערכת. @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c מכשירי אייפון כבר עמידים בפני התקפות בכוח גס בכך שהם גורמים לך להמתין פרקי זמן ארוכים לאחר ניסיונות כושלים מרובים; עם זאת, היסטורית היו מעללים כדי לעקוף את זה. ליתר ביטחון, אתה יכול להגדיר את הטלפון שלך לנגב את עצמו לאחר 10 ניסיונות כושלים של קוד סיסמה. -!!! warning "אזהרה" +
+

Warning

- כאשר הגדרה זו מופעלת, מישהו יכול למחוק את הטלפון שלך בכוונה על ידי הזנת הסיסמה השגויה פעמים רבות. ודא שיש לך גיבויים מתאימים והפעל את ההגדרה הזו רק אם אתה מרגיש בנוח איתה. +כאשר הגדרה זו מופעלת, מישהו יכול למחוק את הטלפון שלך בכוונה על ידי הזנת הסיסמה השגויה פעמים רבות. ודא שיש לך גיבויים מתאימים והפעל את ההגדרה הזו רק אם אתה מרגיש בנוח איתה. + +
- [x] הפעל את **מחק נתונים** diff --git a/i18n/he/os/macos-overview.md b/i18n/he/os/macos-overview.md index 3b2caccf..a3d31ea4 100644 --- a/i18n/he/os/macos-overview.md +++ b/i18n/he/os/macos-overview.md @@ -1,7 +1,7 @@ --- -title: סקירה כללית של macOS +title: macOS Overview icon: material/apple-finder -description: macOS היא מערכת ההפעלה שולחנית של אפל שעובדת עם החומרה שלהם כדי לספק אבטחה חזקה. +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- **macOS** היא מערכת הפעלה Unix שפותחה על ידי אפל עבור מחשבי ה-Mac שלהם. כדי לשפר את הפרטיות ב-macOS, אתה יכול להשבית את תכונות הטלמטריה ולהקשיח את הגדרות הפרטיות והאבטחה הקיימות. @@ -156,9 +156,12 @@ macOS משתמשת בהגנה לעומק על ידי הסתמכות על שכב ### אבטחת תוכנה -!!! warning "אזהרה" +
+

Warning

- macOS מאפשר לך להתקין עדכוני בטא. אלה אינם יציבים ועשויים להגיע עם טלמטריה נוספת מכיוון שהם מיועדים למטרות בדיקה. בשל כך, אנו ממליצים להימנע מתוכנות בטא באופן כללי. +macOS מאפשר לך להתקין עדכוני בטא. אלה אינם יציבים ועשויים להגיע עם טלמטריה נוספת מכיוון שהם מיועדים למטרות בדיקה. בשל כך, אנו ממליצים להימנע מתוכנות בטא באופן כללי. + +
#### נפח מערכת חתומה @@ -178,9 +181,12 @@ macOS מגדיר מגבלות אבטחה מסוימות שלא ניתן לעקו אפליקציות macOS שהורדו מ-App Store נדרשות להיות בארגז חול באמצעות [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning "אזהרה" +
+

Warning

- תוכנה שהורדה מחוץ לחנות האפליקציות הרשמית אינה חייבת להיות בארגז חול. עליך להימנע ככל האפשר מתוכנות שאינן ב-App Store. +תוכנה שהורדה מחוץ לחנות האפליקציות הרשמית אינה חייבת להיות בארגז חול. עליך להימנע ככל האפשר מתוכנות שאינן ב-App Store. + +
##### אנטי וירוס diff --git a/i18n/he/os/qubes-overview.md b/i18n/he/os/qubes-overview.md index 95b03594..f5db23cf 100644 --- a/i18n/he/os/qubes-overview.md +++ b/i18n/he/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes היא מערכת הפעלה הבנויה סביב בידוד Qubes משתמשת ב[מידור](https://www.qubes-os.org/intro/) כדי לשמור על אבטחת המערכת. Qubes נוצרים מתבניות, ברירת המחדל היא עבור Fedora, Debian ו-[Whonix](../desktop.md#whonix). מערכת ההפעלה Qubes מאפשרת לך גם ליצור [חד פעמי](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes* לשימוש חד פעמי. -??? "המונח *qubes* מתעדכן בהדרגה כדי להימנע מהתייחסות אליהם כ"מכונות וירטואליות"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - חלק מהמידע כאן ובתיעוד של מערכת ההפעלה של Qubes עשוי להכיל שפה סותרת מכיוון שהמונח "appVM" משתנה בהדרגה ל-"qube". Qubes הם לא מכונות וירטואליות שלמות, אבל שומרים על פונקציונליות דומות ל-VMs. +חלק מהמידע כאן ובתיעוד של מערכת ההפעלה של Qubes עשוי להכיל שפה סותרת מכיוון שהמונח "appVM" משתנה בהדרגה ל-"qube". Qubes הם לא מכונות וירטואליות שלמות, אבל שומרים על פונקציונליות דומות ל-VMs. + +
![ארכיטקטורת Qubes](../assets/img/qubes/qubes-trust-level-architecture.png)
ארכיטקטורת Qubes, קרדיט: מהי הקדמה למערכת ההפעלה של Qubes
@@ -41,9 +44,12 @@ Qubes OS משתמשת ב-[דום0](https://wiki.xenproject.org/wiki/Dom0)Xen VM כדי להעתיק ולהדביק קבצים וספריות (תיקיות) מ*qube* אחד לאחר, אתה יכול להשתמש באפשרות **העתק ל-AppVM אחר...** או **העבר ל-AppVM אחר...**. ההבדל הוא שהאפשרות ה**העבר** תמחק את הקובץ המקורי. כל אחת מהאפשרויות תגן על הלוח שלך מפני דליפה לכל *qubes* אחרים. זה מאובטח יותר מהעברת קבצים ברווח-אוויר. מחשב עם מרווח אוויר עדיין ייאלץ לנתח מחיצות או מערכות קבצים. זה לא נדרש עם מערכת ההעתקה inter-qube. -??? "ל-Qubes אין מערכות קבצים משלהם." +
+Qubes do not have their own filesystems. - אתה יכול [להעתיק ולהעביר קבצים](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) בין *qubes*. כאשר עושים זאת השינויים לא מתבצעים באופן מיידי וניתן לבטל אותם בקלות במקרה של תאונה. כאשר אתה מפעיל *qube*, אין לו מערכת קבצים מתמשכת. אתה יכול ליצור ולמחוק קבצים, אבל השינויים האלה הם ארעיים. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. כאשר עושים זאת השינויים לא מתבצעים באופן מיידי וניתן לבטל אותם בקלות במקרה של תאונה. When you run a *qube*, it does not have a persistent filesystem. אתה יכול ליצור ולמחוק קבצים, אבל השינויים האלה הם ארעיים. + +
### אינטראקציות בין-VM diff --git a/i18n/hi/advanced/payments.md b/i18n/hi/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/hi/advanced/payments.md +++ b/i18n/hi/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/hi/advanced/tor-overview.md b/i18n/hi/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/hi/advanced/tor-overview.md +++ b/i18n/hi/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/hi/basics/account-creation.md b/i18n/hi/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/hi/basics/account-creation.md +++ b/i18n/hi/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/hi/basics/common-misconceptions.md b/i18n/hi/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/hi/basics/common-misconceptions.md +++ b/i18n/hi/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/hi/basics/common-threats.md b/i18n/hi/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/hi/basics/common-threats.md +++ b/i18n/hi/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/hi/basics/multi-factor-authentication.md b/i18n/hi/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/hi/basics/multi-factor-authentication.md +++ b/i18n/hi/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/hi/basics/passwords-overview.md b/i18n/hi/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/hi/basics/passwords-overview.md +++ b/i18n/hi/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/hi/basics/vpn-overview.md b/i18n/hi/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/hi/basics/vpn-overview.md +++ b/i18n/hi/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/hi/os/android-overview.md b/i18n/hi/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/hi/os/android-overview.md +++ b/i18n/hi/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/hi/os/ios-overview.md b/i18n/hi/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/hi/os/ios-overview.md +++ b/i18n/hi/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/hi/os/macos-overview.md b/i18n/hi/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/hi/os/macos-overview.md +++ b/i18n/hi/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/hi/os/qubes-overview.md b/i18n/hi/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/hi/os/qubes-overview.md +++ b/i18n/hi/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/hu/advanced/payments.md b/i18n/hu/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/hu/advanced/payments.md +++ b/i18n/hu/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/hu/advanced/tor-overview.md b/i18n/hu/advanced/tor-overview.md index d4cbe618..e10fe17e 100644 --- a/i18n/hu/advanced/tor-overview.md +++ b/i18n/hu/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/hu/basics/account-creation.md b/i18n/hu/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/hu/basics/account-creation.md +++ b/i18n/hu/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/hu/basics/common-misconceptions.md b/i18n/hu/basics/common-misconceptions.md index 69c23213..2007ea10 100644 --- a/i18n/hu/basics/common-misconceptions.md +++ b/i18n/hu/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/hu/basics/common-threats.md b/i18n/hu/basics/common-threats.md index 4686c699..18ce9166 100644 --- a/i18n/hu/basics/common-threats.md +++ b/i18n/hu/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/hu/basics/multi-factor-authentication.md b/i18n/hu/basics/multi-factor-authentication.md index e2b40a9b..bf49f773 100644 --- a/i18n/hu/basics/multi-factor-authentication.md +++ b/i18n/hu/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/hu/basics/passwords-overview.md b/i18n/hu/basics/passwords-overview.md index 06010013..ae1e55de 100644 --- a/i18n/hu/basics/passwords-overview.md +++ b/i18n/hu/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/hu/basics/vpn-overview.md b/i18n/hu/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/hu/basics/vpn-overview.md +++ b/i18n/hu/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/hu/os/android-overview.md b/i18n/hu/os/android-overview.md index 7a3c3c4a..04eef90f 100644 --- a/i18n/hu/os/android-overview.md +++ b/i18n/hu/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Android áttekintés +title: Android Overview icon: simple/android -description: Az Android egy nyílt forráskódú operációs rendszer, amely erős biztonsági védelemmel rendelkezik, ezért ez az elsődleges választásunk telefonok esetében. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android logo](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Egy alkalmazás engedélyt kérhet egy adott funkciójához. Például minden ol Az [Exodus](https://exodus-privacy.eu.org/) hasznos lehet hasonló célú alkalmazások összehasonlításakor. Ha egy alkalmazás sok engedélyt igényel, valamint sok reklámot és elemzést tartalmaz, az valószínűleg egy rossz jel. Javasoljuk, hogy tekintsd meg az egyes nyomkövetőket és olvasd el a leírásukat, ahelyett, hogy egyszerűen **megszámolod az összeset** azt feltételezve, hogy a felsorolt tételek egyenlőek. -!!! warning +
+

Warning

- Ha egy alkalmazás többnyire egy webalapú szolgáltatás, a nyomon követés történhet a szerveroldalon. A [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) azt mutatja, hogy "nincsenek nyomkövetők", de minden bizonnyal nyomon követi a felhasználók érdeklődését és viselkedését az oldalon. Alkalmazások elkerülhetik az észlelést azzal, hogy nem használják a reklámipar által készített szabványos kódkönyvtárakat, bár ez nem valószínű. +Ha egy alkalmazás többnyire egy webalapú szolgáltatás, a nyomon követés történhet a szerveroldalon. A [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) azt mutatja, hogy "nincsenek nyomkövetők", de minden bizonnyal nyomon követi a felhasználók érdeklődését és viselkedését az oldalon. Alkalmazások elkerülhetik az észlelést azzal, hogy nem használják a reklámipar által készített szabványos kódkönyvtárakat, bár ez nem valószínű. -!!! note +
- Az olyan magánélet-barát alkalmazások, mint a [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/), megjeleníthetnek néhány nyomkövetőt, mint például a [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). Ez a könyvtár tartalmazza a [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging)-et, amely [push értesítéseket](https://en.wikipedia.org/wiki/Push_technology) tud nyújtani az alkalmazásoknak. Ez [a helyzet](https://fosstodon.org/@bitwarden/109636825700482007) a Bitwardennel is. Ez nem jelenti azt, hogy a Bitwarden a Google Firebase Analytics által biztosított összes elemzési funkciót használja. +
+

Note

+ +Az olyan magánélet-barát alkalmazások, mint a [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/), megjeleníthetnek néhány nyomkövetőt, mint például a [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). Ez a könyvtár tartalmazza a [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging)-et, amely [push értesítéseket](https://en.wikipedia.org/wiki/Push_technology) tud nyújtani az alkalmazásoknak. Ez [a helyzet](https://fosstodon.org/@bitwarden/109636825700482007) a Bitwardennel is. Ez nem jelenti azt, hogy a Bitwarden a Google Firebase Analytics által biztosított összes elemzési funkciót használja. + +
## Adatvédelmi funkciók diff --git a/i18n/hu/os/ios-overview.md b/i18n/hu/os/ios-overview.md index 1ddd1b90..5a79868f 100644 --- a/i18n/hu/os/ios-overview.md +++ b/i18n/hu/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/hu/os/macos-overview.md b/i18n/hu/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/hu/os/macos-overview.md +++ b/i18n/hu/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/hu/os/qubes-overview.md b/i18n/hu/os/qubes-overview.md index 04435eae..9986e985 100644 --- a/i18n/hu/os/qubes-overview.md +++ b/i18n/hu/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/id/advanced/payments.md b/i18n/id/advanced/payments.md index b876244e..2361f6ee 100644 --- a/i18n/id/advanced/payments.md +++ b/i18n/id/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Pembayaran Pribadi +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ Ini cenderung menjadi pilihan yang baik untuk pembayaran berulang/langganan seca Mata uang kripto adalah bentuk mata uang digital yang dirancang untuk bekerja tanpa otoritas pusat seperti pemerintah atau bank. Meskipun *beberapa* proyek mata uang kripto memungkinkan Anda untuk melakukan transaksi pribadi secara daring, banyak yang menggunakan blockchain publik yang tidak memberikan privasi transaksi. Mata uang kripto juga cenderung merupakan aset yang sangat fluktuatif, artinya nilainya dapat berubah dengan cepat dan signifikan kapan saja. Oleh karena itu, kami umumnya tidak menyarankan penggunaan mata uang kripto sebagai penyimpan nilai jangka panjang. Jika Anda memutuskan untuk menggunakan mata uang kripto secara daring, pastikan Anda memiliki pemahaman penuh mengenai aspek privasinya terlebih dahulu, dan hanya menginvestasikan jumlah yang tidak akan menyebabkan kerugian besar. -!!! danger +
+

Danger

- Sebagian besar mata uang kripto beroperasi pada blockchain **publik**, yang berarti bahwa setiap transaksi diketahui oleh publik. Ini termasuk mata uang kripto yang paling terkenal seperti Bitcoin dan Ethereum. Transaksi dengan mata uang kripto ini tidak dapat dianggap sebagai transaksi pribadi dan tidak akan melindungi anonimitas Anda. - - Selain itu, banyak atau bahkan sebagian besar mata uang kripto adalah penipuan. Lakukan transaksi dengan hati-hati hanya dengan proyek yang Anda percayai. +Sebagian besar mata uang kripto beroperasi pada blockchain **publik**, yang berarti bahwa setiap transaksi diketahui oleh publik. Ini termasuk mata uang kripto yang paling terkenal seperti Bitcoin dan Ethereum. Transaksi dengan mata uang kripto ini tidak dapat dianggap sebagai transaksi pribadi dan tidak akan melindungi anonimitas Anda. + +Selain itu, banyak atau bahkan sebagian besar mata uang kripto adalah penipuan. Lakukan transaksi dengan hati-hati hanya dengan proyek yang Anda percayai. + +
### Koin Privasi diff --git a/i18n/id/advanced/tor-overview.md b/i18n/id/advanced/tor-overview.md index 451749be..5e6096e2 100644 --- a/i18n/id/advanced/tor-overview.md +++ b/i18n/id/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/id/basics/account-creation.md b/i18n/id/basics/account-creation.md index ee7613e9..36262a97 100644 --- a/i18n/id/basics/account-creation.md +++ b/i18n/id/basics/account-creation.md @@ -1,8 +1,8 @@ --- meta_title: "How to Create Internet Accounts Privately - Privacy Guides" -title: "Pembuatan Akun" +title: "Account Creation" icon: 'material/account-plus' -description: Membuat akun online bisa dibilang merupakan kebutuhan internet, lakukan langkah-langkah ini untuk memastikan Anda tetap privat. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Seringkali orang mendaftar untuk layanan tanpa berpikir. Mungkin itu adalah layanan streaming sehingga Anda dapat menonton acara baru yang dibicarakan semua orang, atau akun yang memberi Anda diskon untuk tempat makanan cepat saji favorit Anda. Apa pun masalahnya, Anda harus mempertimbangkan implikasi untuk data Anda sekarang dan di kemudian hari. @@ -29,9 +29,12 @@ Biasanya ada beberapa cara untuk mendaftar akun, masing-masing dengan kelebihan Cara paling umum untuk membuat akun baru adalah dengan alamat email dan kata sandi. Saat menggunakan metode ini, Anda harus menggunakan pengelola kata sandi dan mengikuti [praktik terbaik](passwords-overview.md) mengenai kata sandi. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
Anda akan bertanggung jawab untuk mengelola kredensial login Anda. Untuk keamanan tambahan, Anda dapat mengatur [MFA](multi-factor-authentication.md) pada akun Anda. diff --git a/i18n/id/basics/common-misconceptions.md b/i18n/id/basics/common-misconceptions.md index 62a81127..9464daab 100644 --- a/i18n/id/basics/common-misconceptions.md +++ b/i18n/id/basics/common-misconceptions.md @@ -75,20 +75,23 @@ Jadi, bagaimana ini terlihat? Salah satu model ancaman yang paling jelas adalah model di mana orang *tahu siapa Anda* dan model di mana mereka tidak tahu. Di situ akan selalu ada situasi di mana Anda harus menyatakan nama resmi Anda dan ada situasi lain di mana Anda tidak perlu melakukannya. -1. **Identitas yang diketahui** - Identitas yang diketahui digunakan untuk hal-hal yang mengharuskan Anda untuk menyatakan nama Anda. Ada banyak dokumen hukum dan kontrak yang memerlukan identitas hukum. Hal ini dapat berkisar dari membuka rekening bank, menandatangani sewa properti, mendapatkan paspor, deklarasi bea cukai saat mengimpor barang, atau berurusan dengan pemerintah Anda. Hal-hal ini biasanya akan mengarah pada kredensial seperti kartu kredit, pemeriksaan peringkat kredit, nomor rekening, dan mungkin alamat fisik. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Kami tidak menyarankan menggunakan VPN atau Tor untuk hal-hal ini, karena identitas Anda sudah diketahui melalui cara lain. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - Saat berbelanja secara daring, penggunaan [loker paket] (https://en.wikipedia.org/wiki/Parcel_locker) dapat membantu menjaga kerahasiaan alamat fisik Anda. +
+

Tip

+ +Saat berbelanja secara daring, penggunaan [loker paket] (https://en.wikipedia.org/wiki/Parcel_locker) dapat membantu menjaga kerahasiaan alamat fisik Anda. + +
2. **Identitas tidak dikenal** - Identitas yang tidak dikenal dapat berupa nama samaran yang stabil yang sering Anda gunakan. Ini tidak anonim karena tidak berubah. Jika Anda adalah bagian dari komunitas daring, Anda mungkin ingin mempertahankan persona yang dikenal orang lain. Nama samaran ini tidak anonim karena—jika dipantau cukup lama—rincian tentang pemiliknya dapat mengungkapkan informasi lebih lanjut, seperti cara mereka menulis, pengetahuan umum mereka tentang topik yang diminati, dll. - Anda mungkin ingin menggunakan VPN untuk hal ini, untuk menyembunyikan alamat IP Anda. Transaksi keuangan lebih sulit untuk disamarkan: Anda dapat mempertimbangkan untuk menggunakan mata uang kripto anonim, seperti [Monero](https://www.getmonero.org/). Menggunakan pengalihan altcoin juga dapat membantu menyamarkan dari mana mata uang Anda berasal. Biasanya, bursa memerlukan KYC (kenali pelanggan Anda) untuk diselesaikan sebelum mereka mengizinkan Anda menukar mata uang fiat ke mata uang kripto apa pun. Opsi pertemuan lokal juga dapat menjadi solusi; namun, biasanya lebih mahal dan terkadang juga memerlukan KYC. +Anda mungkin ingin menggunakan VPN untuk hal ini, untuk menyembunyikan alamat IP Anda. Transaksi keuangan lebih sulit untuk disamarkan: Anda dapat mempertimbangkan untuk menggunakan mata uang kripto anonim, seperti [Monero](https://www.getmonero.org/). Menggunakan pengalihan altcoin juga dapat membantu menyamarkan dari mana mata uang Anda berasal. Biasanya, bursa memerlukan KYC (kenali pelanggan Anda) untuk diselesaikan sebelum mereka mengizinkan Anda menukar mata uang fiat ke mata uang kripto apa pun. Opsi pertemuan lokal juga dapat menjadi solusi; namun, biasanya lebih mahal dan terkadang juga memerlukan KYC. 3. **Identitas anonim** - Bahkan dengan pengalaman, identitas anonim sulit untuk dipertahankan dalam jangka waktu yang lama. Identitas tersebut haruslah identitas jangka pendek dan berumur pendek yang dirotasi secara teratur. - Menggunakan Tor dapat membantu dalam hal ini. Perlu juga dicatat bahwa anonimitas yang lebih baik dimungkinkan melalui komunikasi asinkron: Komunikasi waktu nyata rentan terhadap analisis pola pengetikan (misalnya lebih dari satu paragraf teks, didistribusikan di forum, melalui surel, dll.) +Menggunakan Tor dapat membantu dalam hal ini. Perlu juga dicatat bahwa anonimitas yang lebih baik dimungkinkan melalui komunikasi asinkron: Komunikasi waktu nyata rentan terhadap analisis pola pengetikan (misalnya lebih dari satu paragraf teks, didistribusikan di forum, melalui surel, dll.) [^1]: Salah satu contoh penting dari hal ini adalah [insiden pada 2021 di mana para peneliti Universitas Minnesota memperkenalkan tiga kerentanan ke dalam proyek pengembangan kernel Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/id/basics/common-threats.md b/i18n/id/basics/common-threats.md index 78aaf54f..6a7589ea 100644 --- a/i18n/id/basics/common-threats.md +++ b/i18n/id/basics/common-threats.md @@ -35,19 +35,25 @@ Dalam hal keamanan aplikasi, umumnya kami tidak (dan terkadang tidak bisa) menge Untuk meminimalkan kerusakan *yang dapat* dilakukan oleh perangkat lunak berbahaya, Anda harus menggunakan keamanan dengan kompartementalisasi. Sebagai contoh, hal ini dapat berupa penggunaan komputer yang berbeda untuk pekerjaan yang berbeda, menggunakan mesin virtual untuk memisahkan berbagai kelompok aplikasi yang terkait, atau menggunakan sistem operasi yang aman dengan fokus yang kuat pada kotak pasir aplikasi dan kontrol akses yang wajib. -!!! tip +
+

Tip

- Sistem operasi seluler umumnya memiliki kotak pasir aplikasi yang lebih baik daripada sistem operasi desktop: Aplikasi tidak dapat memperoleh akses akar, dan memerlukan izin untuk mengakses sumber daya sistem. - - Sistem operasi desktop umumnya tertinggal dalam hal kotak pasir yang tepat. ChromeOS memiliki kemampuan kotak pasir yang mirip dengan Android, dan macOS memiliki kontrol izin sistem penuh (dan pengembang dapat memilih untuk ikut serta dalam kotak pasir untuk aplikasi). Namun demikian, sistem operasi ini mengirimkan informasi identifikasi ke OEM masing-masing. Linux cenderung tidak menyerahkan informasi kepada vendor sistem, tetapi memiliki perlindungan yang buruk terhadap eksploitasi dan aplikasi jahat. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Sistem operasi seluler umumnya memiliki kotak pasir aplikasi yang lebih baik daripada sistem operasi desktop: Aplikasi tidak dapat memperoleh akses akar, dan memerlukan izin untuk mengakses sumber daya sistem. + +Sistem operasi desktop umumnya tertinggal dalam hal kotak pasir yang tepat. ChromeOS memiliki kemampuan kotak pasir yang mirip dengan Android, dan macOS memiliki kontrol izin sistem penuh (dan pengembang dapat memilih untuk ikut serta dalam kotak pasir untuk aplikasi). Namun demikian, sistem operasi ini mengirimkan informasi identifikasi ke OEM masing-masing. Linux cenderung tidak menyerahkan informasi kepada vendor sistem, tetapi memiliki perlindungan yang buruk terhadap eksploitasi dan aplikasi jahat. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Serangan Bertarget Serangan yang ditargetkan terhadap orang tertentu akan lebih sulit ditangani. Serangan yang umum terjadi termasuk mengirim dokumen berbahaya melalui surel, mengeksploitasi kerentanan (misalnya pada peramban dan sistem operasi), dan serangan fisik. Jika hal ini menjadi perhatian Anda, Anda harus menggunakan strategi mitigasi ancaman yang lebih canggih. -!!! tip +
+

Tip

- Secara rancangan, **peramban web**, **klien surel**, dan **aplikasi perkantoran** biasanya menjalankan kode yang tidak dipercaya, yang dikirimkan kepada Anda dari pihak ketiga. Menjalankan beberapa mesin virtual—untuk memisahkan aplikasi seperti ini dari sistem hos Anda, dan juga satu sama lain—adalah salah satu teknik yang bisa Anda gunakan untuk mengurangi kemungkinan eksploitasi pada aplikasi-aplikasi ini yang mengorbankan sistem Anda yang lain. Sebagai contoh, teknologi seperti Qubes OS atau Microsoft Defender Application Guard pada Windows menyediakan metode yang nyaman untuk melakukan hal ini. +Secara rancangan, **peramban web**, **klien surel**, dan **aplikasi perkantoran** biasanya menjalankan kode yang tidak dipercaya, yang dikirimkan kepada Anda dari pihak ketiga. Menjalankan beberapa mesin virtual—untuk memisahkan aplikasi seperti ini dari sistem hos Anda, dan juga satu sama lain—adalah salah satu teknik yang bisa Anda gunakan untuk mengurangi kemungkinan eksploitasi pada aplikasi-aplikasi ini yang mengorbankan sistem Anda yang lain. Sebagai contoh, teknologi seperti Qubes OS atau Microsoft Defender Application Guard pada Windows menyediakan metode yang nyaman untuk melakukan hal ini. + +
Jika Anda khawatir tentang **serangan fisik** Anda harus menggunakan sistem operasi dengan implementasi boot terverifikasi yang aman, seperti Android, iOS, macOS, atau [Windows (dengan TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Anda juga harus memastikan bahwa penyimpanan Anda dienkripsi, dan bahwa sistem operasi menggunakan TPM atau Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) atau [Element](https://developers.google.com/android/security/android-ready-se) untuk menilai batas upaya memasukkan frasa sandi enkripsi. Anda sebaiknya menghindari berbagi komputer dengan orang yang tidak Anda percayai, karena sebagian besar sistem operasi desktop tidak mengenkripsi data secara terpisah per pengguna. @@ -61,13 +67,16 @@ Masalah yang jelas dengan hal ini adalah penyedia layanan (atau peretas yang tel Untungnya, E2EE dapat mengatasi masalah ini dengan mengenkripsi komunikasi antara Anda dan penerima yang Anda inginkan bahkan sebelum dikirim ke server. Kerahasiaan pesan Anda dijamin, dengan asumsi penyedia layanan tidak memiliki akses ke kunci pribadi salah satu pihak. -!!! note "Catatan Tentang Enkripsi Berbasis Web" +
+

Note on Web-based Encryption

- Dalam praktiknya, efektivitas implementasi E2EE yang berbeda bervariasi. Aplikasi, seperti [Signal](../real-time-communication.md#signal), berjalan secara asli pada perangkat Anda, dan setiap salinan aplikasi sama pada instalasi yang berbeda. Jika penyedia layanan memperkenalkan sebuah [pintu belakang](https://id.wikipedia.org/wiki/Pintu_belakang_(komputer)) dalam aplikasi mereka—dalam upaya untuk mencuri kunci pribadi Anda—nantinya dapat dideteksi dengan [rekayasa balik] (https://id.wikipedia.org/wiki/Rekayasa_balik). - - Di sisi lain, implementasi E2EE berbasis web, seperti surel web Proton Mail atau *Web Vault* dari Bitwarden, bergantung pada server yang secara dinamis menyajikan kode JavaScript ke peramban untuk menangani kriptografi. Sebuah server jahat dapat menargetkan Anda dan mengirimkan kode JavaScript berbahaya untuk mencuri kunci enkripsi Anda (dan akan sangat sulit untuk diketahui). Karena server dapat memilih untuk melayani klien web yang berbeda untuk orang yang berbeda—bahkan jika Anda menyadari serangan itu—akan sangat sulit untuk membuktikan kesalahan penyedia. - - Oleh karena itu, Anda seharusnya menggunakan aplikasi asli daripada klien web bila memungkinkan. +Dalam praktiknya, efektivitas implementasi E2EE yang berbeda bervariasi. Aplikasi, seperti [Signal](../real-time-communication.md#signal), berjalan secara asli pada perangkat Anda, dan setiap salinan aplikasi sama pada instalasi yang berbeda. Jika penyedia layanan memperkenalkan sebuah [pintu belakang](https://id.wikipedia.org/wiki/Pintu_belakang_(komputer)) dalam aplikasi mereka—dalam upaya untuk mencuri kunci pribadi Anda—nantinya dapat dideteksi dengan [rekayasa balik] (https://id.wikipedia.org/wiki/Rekayasa_balik). + +Di sisi lain, implementasi E2EE berbasis web, seperti surel web Proton Mail atau *Web Vault* dari Bitwarden, bergantung pada server yang secara dinamis menyajikan kode JavaScript ke peramban untuk menangani kriptografi. Sebuah server jahat dapat menargetkan Anda dan mengirimkan kode JavaScript berbahaya untuk mencuri kunci enkripsi Anda (dan akan sangat sulit untuk diketahui). Karena server dapat memilih untuk melayani klien web yang berbeda untuk orang yang berbeda—bahkan jika Anda menyadari serangan itu—akan sangat sulit untuk membuktikan kesalahan penyedia. + +Oleh karena itu, Anda seharusnya menggunakan aplikasi asli daripada klien web bila memungkinkan. + +
Bahkan dengan E2EE, penyedia layanan masih bisa membuat profil Anda berdasarkan **metadata**, yang biasanya tidak dilindungi. Meskipun penyedia layanan tidak dapat membaca pesan Anda, mereka masih dapat mengamati hal-hal penting, seperti siapa yang Anda ajak bicara, seberapa sering Anda mengirim pesan kepada mereka, dan kapan Anda biasanya aktif. Perlindungan metadata cukup jarang dilakukan, dan—jika ada dalam [model ancaman](threat-modeling.md)—Anda harus memperhatikan dengan seksama dokumentasi teknis perangkat lunak yang Anda gunakan untuk mengetahui apakah ada minimalisasi atau perlindungan metadata sama sekali. @@ -77,17 +86,23 @@ Bahkan dengan E2EE, penyedia layanan masih bisa membuat profil Anda berdasarkan Pengawasan massal adalah upaya yang rumit untuk memantau "perilaku, berbagai aktivitas, atau informasi" dari seluruh (atau sebagian besar) populasi.[^1] Hal ini sering merujuk pada program pemerintah, seperti yang [diungkapkan oleh Edward Snowden pada tahun 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). Namun, hal ini juga dapat dilakukan oleh perusahaan, baik atas nama lembaga pemerintah maupun atas inisiatif sendiri. -!!! abstract "Atlas Pengawasan" +
+

Atlas of Surveillance

- Jika Anda ingin mempelajari lebih lanjut tentang metode pengawasan dan bagaimana metode tersebut diterapkan di kota Anda, Anda juga dapat melihat [Atlas Pengawasan (Atlas of Surveillance)](https://atlasofsurveillance.org/) oleh [Electronic Frontier Foundation](https://www.eff.org/). - - Di Prancis, Anda dapat melihat [situs web Technolopolice] (https://technopolice.fr/villes/) yang dikelola oleh asosiasi nirlaba La Quadrature du Net. +Jika Anda ingin mempelajari lebih lanjut tentang metode pengawasan dan bagaimana metode tersebut diterapkan di kota Anda, Anda juga dapat melihat [Atlas Pengawasan (Atlas of Surveillance)](https://atlasofsurveillance.org/) oleh [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Pemerintah sering kali membenarkan program pengawasan massal sebagai cara yang diperlukan untuk memerangi terorisme dan mencegah kejahatan. Namun, melanggar hak asasi manusia, hal ini paling sering digunakan untuk menargetkan kelompok minoritas dan pembangkang politik secara tidak proporsional. -!!! quote "ACLU: [*Pelajaran Privasi dari Peristiwa 9/11: Pengawasan Massal Bukanlah Jalan ke Depan*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Dalam menghadapi [pengungkapan Edward Snowden tentang program-program pemerintah seperti [PRISM](https://en.wikipedia.org/wiki/PRISM) dan [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], para pejabat intelijen juga mengakui bahwa NSA selama bertahun-tahun secara diam-diam telah mengumpulkan catatan tentang hampir semua panggilan telepon setiap orang Amerika—siapa yang menelepon siapa, kapan panggilan itu dilakukan, dan berapa lama panggilan itu berlangsung. Informasi semacam ini, ketika dikumpulkan oleh NSA dari hari ke hari, dapat mengungkapkan detail yang sangat sensitif tentang kehidupan dan pergaulan seseorang, seperti apakah mereka pernah menelepon pendeta, penyedia layanan aborsi, konselor kecanduan, atau bantuan pencegahan bunuh diri. +Dalam menghadapi [pengungkapan Edward Snowden tentang program-program pemerintah seperti [PRISM](https://en.wikipedia.org/wiki/PRISM) dan [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], para pejabat intelijen juga mengakui bahwa NSA selama bertahun-tahun secara diam-diam telah mengumpulkan catatan tentang hampir semua panggilan telepon setiap orang Amerika—siapa yang menelepon siapa, kapan panggilan itu dilakukan, dan berapa lama panggilan itu berlangsung. Informasi semacam ini, ketika dikumpulkan oleh NSA dari hari ke hari, dapat mengungkapkan detail yang sangat sensitif tentang kehidupan dan pergaulan seseorang, seperti apakah mereka pernah menelepon pendeta, penyedia layanan aborsi, konselor kecanduan, atau bantuan pencegahan bunuh diri. + +
Meskipun pengawasan massal semakin meningkat di Amerika Serikat, pemerintah telah menemukan bahwa program pengawasan massal seperti Bagian 215 hanya memiliki "sedikit nilai unik" dalam hal menghentikan kejahatan aktual atau plot teroris, dengan upaya-upaya yang sebagian besar menduplikasi program pengawasan yang ditargetkan oleh FBI.[^2] @@ -133,11 +148,14 @@ Penyensoran pada platform perusahaan semakin umum terjadi, karena platform seper Orang-orang yang khawatir dengan ancaman penyensoran dapat menggunakan teknologi seperti [Tor](../advanced/tor-overview.md) untuk mengelakkannya, dan mendukung platform komunikasi yang tahan sensor seperti [Matrix](../real-time-communication.md#element), yang tidak memiliki otoritas akun terpusat yang dapat menutup akun secara sewenang-wenang. -!!! tip +
+

Tip

- Meskipun menghindari penyensoran itu sendiri bisa jadi mudah, menyembunyikan fakta bahwa Anda melakukannya bisa jadi sangat bermasalah. - - Anda harus mempertimbangkan aspek mana dari jaringan yang dapat diamati oleh musuh Anda, dan apakah Anda memiliki penyangkalan yang masuk akal atas tindakan Anda. Sebagai contoh, menggunakan [DNS terenkripsi](../advanced/dns-overview.md#what-is-encrypted-dns) bisa membantu Anda melalui sistem sensor berbasis DNS yang belum sempurna, tetapi tidak bisa menyembunyikan apa yang Anda kunjungi dari ISP Anda. Sebuah VPN atau Tor bisa membantu menyembunyikan apa yang Anda kunjungi dari administrator jaringan, tetapi tidak bisa menyembunyikan kalau Anda menggunakan jaringan tersebut sejak awal. Transport yang dapat dicolokkan (seperti Obfs4proxy, Meek, atau Shadowsocks) dapat membantu Anda menghindari dinding api yang memblokir protokol VPN umum atau Tor, tetapi upaya pengelabuan Anda masih bisa dideteksi dengan metode seperti pengujian atau [inspeksi paket dalam](https://en.wikipedia.org/wiki/Deep_packet_inspection). +Meskipun menghindari penyensoran itu sendiri bisa jadi mudah, menyembunyikan fakta bahwa Anda melakukannya bisa jadi sangat bermasalah. + +Anda harus mempertimbangkan aspek mana dari jaringan yang dapat diamati oleh musuh Anda, dan apakah Anda memiliki penyangkalan yang masuk akal atas tindakan Anda. Sebagai contoh, menggunakan [DNS terenkripsi](../advanced/dns-overview.md#what-is-encrypted-dns) bisa membantu Anda melalui sistem sensor berbasis DNS yang belum sempurna, tetapi tidak bisa menyembunyikan apa yang Anda kunjungi dari ISP Anda. Sebuah VPN atau Tor bisa membantu menyembunyikan apa yang Anda kunjungi dari administrator jaringan, tetapi tidak bisa menyembunyikan kalau Anda menggunakan jaringan tersebut sejak awal. Transport yang dapat dicolokkan (seperti Obfs4proxy, Meek, atau Shadowsocks) dapat membantu Anda menghindari dinding api yang memblokir protokol VPN umum atau Tor, tetapi upaya pengelabuan Anda masih bisa dideteksi dengan metode seperti pengujian atau [inspeksi paket dalam](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
Anda harus selalu mempertimbangkan risiko mencoba menerobos sensor, konsekuensi potensial, dan seberapa canggih musuh Anda. Anda harus berhati-hati dalam memilih perangkat lunak, dan memiliki rencana cadangan untuk berjaga-jaga seandainya Anda ketahuan. diff --git a/i18n/id/basics/multi-factor-authentication.md b/i18n/id/basics/multi-factor-authentication.md index 17a0450a..0d60944b 100644 --- a/i18n/id/basics/multi-factor-authentication.md +++ b/i18n/id/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! peringatan +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/id/basics/passwords-overview.md b/i18n/id/basics/passwords-overview.md index 69e86d4a..18a74084 100644 --- a/i18n/id/basics/passwords-overview.md +++ b/i18n/id/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Pengantar Kata Sandi" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Berikut ini adalah beberapa tips dan trik tentang cara membuat kata sandi terkuat dan menjaga akun Anda tetap aman. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Kata sandi adalah bagian penting dari kehidupan digital kita sehari-hari. Kami menggunakannya untuk melindungi akun, perangkat, dan rahasia kami. Meskipun sering kali menjadi satu-satunya hal antara kita dan musuh yang mengincar informasi pribadi kita, tidak banyak yang memikirkannya, yang sering kali membuat orang menggunakan kata sandi yang dapat dengan mudah ditebak atau dipaksakan. @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Sebagian besar pengelola kata sandi memungkinkan Anda untuk mengatur tanggal kedaluwarsa untuk kata sandi Anda agar lebih mudah dikelola. -!!! tip "Memeriksa pelanggaran data" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Sebagai alternatif, Anda dapat mengikuti [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) dengan bantuan [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Sebagai alternatif, Anda dapat mengikuti [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) dengan bantuan [news aggregator](../news-aggregators.md). + +
## Membuat kata sandi yang kuat @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! catatan +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Lempar dadu enam sisi sebanyak lima kali, catat nomornya setelah setiap lemparan. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Ulangi proses ini hingga kata sandi Anda memiliki kata sebanyak yang Anda butuhkan, yang harus Anda pisahkan dengan spasi. -!!! peringatan "Penting" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? catatan "Penjelasan tentang entropi dan kekuatan frasa sandi diceware" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Musuh Anda tahu bahwa Anda menggunakan metode diceware. - - Musuh Anda mengetahui daftar kata tertentu yang Anda gunakan. - - Musuh Anda mengetahui berapa banyak kata yang terkandung dalam kata sandi Anda. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Musuh Anda tahu bahwa Anda menggunakan metode diceware. +- Musuh Anda mengetahui daftar kata tertentu yang Anda gunakan. +- Musuh Anda mengetahui berapa banyak kata yang terkandung dalam kata sandi Anda. + +
Singkatnya, kata sandi diceware adalah pilihan terbaik Anda ketika Anda membutuhkan sesuatu yang mudah diingat *dan* sangat kuat. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Pilih sa [Daftar pengelola kata sandi yang direkomendasikan](../passwords.md ""){.md-button} -!!! peringatan "Jangan letakkan kata sandi dan token TOTP Anda di dalam pengelola kata sandi yang sama" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Selain itu, kami tidak menyarankan untuk menyimpan kode pemulihan sekali pakai di pengelola kata sandi Anda. Data tersebut harus disimpan secara terpisah, misalnya dalam wadah terenkripsi pada perangkat penyimpanan offline. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Selain itu, kami tidak menyarankan untuk menyimpan kode pemulihan sekali pakai di pengelola kata sandi Anda. Data tersebut harus disimpan secara terpisah, misalnya dalam wadah terenkripsi pada perangkat penyimpanan offline. + +
### Cadangan diff --git a/i18n/id/basics/vpn-overview.md b/i18n/id/basics/vpn-overview.md index 6f8f49dc..b161fca6 100644 --- a/i18n/id/basics/vpn-overview.md +++ b/i18n/id/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "Bagaimana VPN Melindungi Privasi Anda? Ringkasan VPN dari Kami - Privacy Guides" -title: Ikhtisar VPN +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Virtual Private Networks mengalihkan risiko dari ISP Anda ke pihak ketiga yang Anda percayai. Anda harus mengingat hal-hal ini. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! catatan +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/id/os/android-overview.md b/i18n/id/os/android-overview.md index 2981cf5e..73695b08 100644 --- a/i18n/id/os/android-overview.md +++ b/i18n/id/os/android-overview.md @@ -1,7 +1,7 @@ --- title: Android Overview icon: simple/android -description: Android adalah sistem operasi sumber terbuka dengan perlindungan keamanan yang kuat, yang menjadikannya pilihan utama kami untuk ponsel. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android logo](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! peringatan +
+

Warning

- Jika sebuah aplikasi sebagian besar merupakan layanan berbasis web, pelacakan dapat terjadi di sisi server. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) menunjukkan "tidak ada pelacak" tetapi tentu saja melacak minat dan perilaku pengguna di seluruh situs. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +Jika sebuah aplikasi sebagian besar merupakan layanan berbasis web, pelacakan dapat terjadi di sisi server. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) menunjukkan "tidak ada pelacak" tetapi tentu saja melacak minat dan perilaku pengguna di seluruh situs. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! catatan +
- Aplikasi ramah privasi seperti [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) dapat menampilkan beberapa pelacak seperti [Google Firebase Analytics] (https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. Ini [adalah kasus] (https://fosstodon.org/@bitwarden/109636825700482007) dengan Bitwarden. Itu tidak berarti bahwa Bitwarden menggunakan semua fitur analisis yang disediakan oleh Google Firebase Analytics. +
+

Note

+ +Aplikasi ramah privasi seperti [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) dapat menampilkan beberapa pelacak seperti [Google Firebase Analytics] (https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. Ini [adalah kasus] (https://fosstodon.org/@bitwarden/109636825700482007) dengan Bitwarden. Itu tidak berarti bahwa Bitwarden menggunakan semua fitur analisis yang disediakan oleh Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/id/os/ios-overview.md b/i18n/id/os/ios-overview.md index 5917f36f..f31aecda 100644 --- a/i18n/id/os/ios-overview.md +++ b/i18n/id/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! peringatan +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/id/os/macos-overview.md b/i18n/id/os/macos-overview.md index e3e9b683..af821840 100644 --- a/i18n/id/os/macos-overview.md +++ b/i18n/id/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! peringatan +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! peringatan +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/id/os/qubes-overview.md b/i18n/id/os/qubes-overview.md index 08e086bf..e809b07a 100644 --- a/i18n/id/os/qubes-overview.md +++ b/i18n/id/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes adalah sistem operasi yang dibangun dengan mengisolasi aplika Qubes menggunakan kompartementalisasi [](https://www.qubes-os.org/intro/) untuk menjaga sistem tetap aman. Qubes dibuat dari beberapa template, umumnya untuk Fedora, Debian dan [Whonix](../desktop.md#whonix). Qubes OS juga memungkinkan Anda untuk membuat [sekali pakai](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes sekali pakai*. -??? "Istilah *qubes* secara bertahap diperbarui untuk menghindari penyebutan sebagai "mesin virtual"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Beberapa informasi di sini dan di dokumentasi Qubes OS mungkin mengandung bahasa yang bertentangan karena istilah "appVM" secara bertahap diubah menjadi "qube". Qubes bukanlah mesin virtual secara keseluruhan, tetapi memiliki fungsi yang serupa dengan VM. +Beberapa informasi di sini dan di dokumentasi Qubes OS mungkin mengandung bahasa yang bertentangan karena istilah "appVM" secara bertahap diubah menjadi "qube". Qubes bukanlah mesin virtual secara keseluruhan, tetapi memiliki fungsi yang serupa dengan VM. + +
![Arsitektur Qubes](../assets/img/qubes/qubes-trust-level-architecture.png)
Arsitektur Qubes, Kredit: Apa itu Qubes OS Intro
@@ -41,9 +44,12 @@ Anda dapat [menyalin dan menempelkan teks](https://www.qubes-os.org/doc/how-to-c Untuk menyalin dan menempelkan file dan direktori (folder) dari satu *qube* ke *qube* lainnya, Anda dapat menggunakan opsi **Copy to Other AppVM...** atau **Move to Other AppVM...**. Perbedaannya adalah bahwa opsi **Pindahkan** akan menghapus file asli. Opsi mana pun akan melindungi papan klip Anda agar tidak bocor ke *qubes* lainnya. Ini lebih aman daripada transfer file melalui udara. Komputer yang memiliki celah udara masih akan dipaksa untuk mengurai partisi atau sistem file. Hal itu tidak diperlukan dengan sistem penyalinan antar-qube. -??? "Qubes tidak memiliki sistem file sendiri." +
+Qubes do not have their own filesystems. - Anda dapat [menyalin dan memindahkan file](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) di antara *qubes*. Ketika melakukan hal tersebut, perubahan tidak langsung dilakukan dan dapat dengan mudah dibatalkan jika terjadi kecelakaan. Ketika Anda menjalankan *qube*, ia tidak memiliki sistem berkas yang persisten. Anda dapat membuat dan menghapus file, tetapi perubahan ini bersifat sementara. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Ketika melakukan hal tersebut, perubahan tidak langsung dilakukan dan dapat dengan mudah dibatalkan jika terjadi kecelakaan. When you run a *qube*, it does not have a persistent filesystem. Anda dapat membuat dan menghapus file, tetapi perubahan ini bersifat sementara. + +
### Interaksi Antar-VM diff --git a/i18n/it/advanced/payments.md b/i18n/it/advanced/payments.md index d2b4c570..831a850d 100644 --- a/i18n/it/advanced/payments.md +++ b/i18n/it/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Pagamenti privati +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ Queste, tendono a essere buone opzioni per i pagamenti ricorrenti/abbonamenti on Le criptovalute sono una forma di valuta digitale, progettata per funzionare senza autorità centrale, come un governo o una banca. Mentre *alcuni* progetti di criptovalute possono consentirti di effettuare transazioni private online, molti utilizzano una blockchain pubblica che non fornisce alcuna privacy delle transazioni. Inoltre, le criptovalute tendono a essere risorse molto volatili, a significare che il loro valore può cambiare rapidamente e significativamente, in qualsiasi momento. Per questo, generalmente, sconsigliamo l'utilizzo di criptovalute come riserva di valore a lungo termine. Se decidi di utilizzare le criptovalute online, assicurati prima di avere la piena comprensione degli aspetti relativi alla privacy, e di investire soltanto somme che non sarebbero disastrose da perdere. -!!! danger "Attenzione" +
+

Attenzione

- La maggior parte delle criptovalute operano su una blockchain **pubblica**, il che significa che ogni transazione è di dominio pubblico. Ciò include anche gran parte delle criptovalute più note, come Bitcoin ed Ethereum. Le transazioni con tali criptovalute non dovrebbero essere considerate private e non proteggeranno il tuo anonimato. - - Inoltre, molte, se non la maggior parte, delle criptovalute sono truffe. Effettua attentamente le transazioni, soltanto con i progetti di cui ti fidi. +La maggior parte delle criptovalute operano su una blockchain **pubblica**, il che significa che ogni transazione è di dominio pubblico. Ciò include anche gran parte delle criptovalute più note, come Bitcoin ed Ethereum. Le transazioni con tali criptovalute non dovrebbero essere considerate private e non proteggeranno il tuo anonimato. + +Inoltre, molte, se non la maggior parte, delle criptovalute sono truffe. Effettua attentamente le transazioni, soltanto con i progetti di cui ti fidi. + +
### Privacy Coin diff --git a/i18n/it/advanced/tor-overview.md b/i18n/it/advanced/tor-overview.md index 8078a69c..b07cf550 100644 --- a/i18n/it/advanced/tor-overview.md +++ b/i18n/it/advanced/tor-overview.md @@ -45,13 +45,16 @@ Alcuni provider di VPN e altre pubblicazioni raccomandano occasionalmente queste --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- Il Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) afferma che *teoricamente* l'utilizzo di una VPN per nascondere le attività Tor al proprio ISP potrebbe non essere infallibile. Le VPN sono risultate vulnerabili al fingerprinting del traffico dei siti web, in cui un avversario può comunque indovinare quale sito web viene visitato, perché tutti i siti web hanno modelli di traffico specifici. - - Pertanto, non è irragionevole credere che anche il traffico Tor crittografato nascosto da una VPN possa essere rilevato con metodi simili. Non esistono ricerche in merito e riteniamo che i vantaggi dell'utilizzo di una VPN siano di gran lunga superiori a questi rischi, ma è un aspetto da tenere presente. - - Se sei ancora convinto che i trasporti collegabili (bridge) forniscano una protezione aggiuntiva contro il fingerprinting del traffico dei siti web che una VPN non offre, hai sempre la possibilità di utilizzare un bridge **e** una VPN insieme. +Il Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) afferma che *teoricamente* l'utilizzo di una VPN per nascondere le attività Tor al proprio ISP potrebbe non essere infallibile. Le VPN sono risultate vulnerabili al fingerprinting del traffico dei siti web, in cui un avversario può comunque indovinare quale sito web viene visitato, perché tutti i siti web hanno modelli di traffico specifici. + +Pertanto, non è irragionevole credere che anche il traffico Tor crittografato nascosto da una VPN possa essere rilevato con metodi simili. Non esistono ricerche in merito e riteniamo che i vantaggi dell'utilizzo di una VPN siano di gran lunga superiori a questi rischi, ma è un aspetto da tenere presente. + +Se sei ancora convinto che i trasporti collegabili (bridge) forniscano una protezione aggiuntiva contro il fingerprinting del traffico dei siti web che una VPN non offre, hai sempre la possibilità di utilizzare un bridge **e** una VPN insieme. + +
Per stabilire se sia il caso di utilizzare una VPN per connettersi alla rete Tor è necessario un po' di buon senso e la conoscenza delle politiche del proprio governo e del proprio ISP in merito a ciò a cui ci si connette. Tuttavia, anche in questo caso, nella maggior parte dei casi sarà meglio essere visti come connessi a una rete VPN commerciale piuttosto che direttamente alla rete Tor. Se i provider di VPN sono censurati nella tua zona, puoi anche considerare l'utilizzo di trasporti Tor pluggable (ad esempio Snowflake o meek bridge) come alternativa, ma l'uso di questi bridge può destare più sospetti rispetto ai tunnel WireGuard/OpenVPN standard. diff --git a/i18n/it/basics/account-creation.md b/i18n/it/basics/account-creation.md index 5fe3a4fc..c1f04d59 100644 --- a/i18n/it/basics/account-creation.md +++ b/i18n/it/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Come creare profili internet privatamente - Privacy Guides" -title: "Creare profili" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: La creazione di profili online è praticamente una necessità di Internet, aadotta questi accorgimenti per assicurarti di rimanere privato. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Spesso le persone si iscrivono a servizi senza riflettere. Forse è un servizio di streaming per guardare quella nuova serie di cui tutti parlano, o di un profilo che ti offre uno sconto per il tuo fast food preferito. In ogni caso, dovresti considerare le implicazioni per i tuoi dati, ora e in futuro. @@ -29,9 +29,12 @@ Solitamente, esistono svariati metodi per iscriversi a un profilo, ognuno con i Il modo più comune per creare un nuovo account è tramite un indirizzo e-mail e una password. Utilizzando questo metodo, dovresti utilizzare un gestore di password e seguire le [migliori pratiche](passwords-overview.md) per ciò che riguarda le password. -!!! tip "Suggerimento" +
+

Suggerimento

- Puoi utilizzare il tuo gestore di password per organizzare anche altri metodi d'autenticazione! Basta aggiungere la nuova voce e compilare i campi appropriati; puoi aggiungere note per cose come le domande di sicurezza o le chiavi di backup. +Puoi utilizzare il tuo gestore di password per organizzare anche altri metodi d'autenticazione! Basta aggiungere la nuova voce e compilare i campi appropriati; puoi aggiungere note per cose come le domande di sicurezza o le chiavi di backup. + +
Sarai responsabile della gestione delle tue credenziali di accesso. Per una maggiore sicurezza, puoi impostare l'[AFM](multi-factor-authentication.md) sui tuoi profili. diff --git a/i18n/it/basics/common-misconceptions.md b/i18n/it/basics/common-misconceptions.md index 8dce1629..d2b70a79 100644 --- a/i18n/it/basics/common-misconceptions.md +++ b/i18n/it/basics/common-misconceptions.md @@ -75,20 +75,23 @@ Quindi, come potrebbe apparire? Uno dei modelli di minaccia più chiari è quello in cui le persone *ti conoscono* e uno in cui non ti conoscono. Ci saranno sempre situazioni in cui dovrai dichiarare il tuo nome legale, e altre in cui non sarà necessario. -1. **Identità nota**: Un'identità nota è utilizzata per le cose in cui devi dichiarare il tuo nome. Esistono molti documenti legali e contratti in cui l'identità legale è necessaria. Questi possono andare dall'apertura di un conto bancario, la firma di affitto di una proprietà, l'ottenimento di un passaporto, dichiarazioni personalizzate per l'importazione di articoli, o altri rapporti con il tuo governo. Solitamente, queste cose, richiedono credenziali quali carte di credito, controlli di affidabilità creditizia, numeri di conto e, possibilmente, indirizzi fisici. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Non suggeriamo di utilizzare alcuna VPN o Tor per queste cose, poiché la tua identità è già nota tramite altri mezzi. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "Suggerimento" - - Acquistando online, l'utilizzo di un [Paccomat](https://it.wikipedia.org/wiki/Paccomat), può contribuire a mantenere privato il tuo indirizzo email. +
+

Suggerimento

+ +Acquistando online, l'utilizzo di un [Paccomat](https://it.wikipedia.org/wiki/Paccomat), può contribuire a mantenere privato il tuo indirizzo email. + +
2. **Identità sconosciuta**: Un'identità sconosciuta potrebbe essere uno pseudonimo stabile che utilizzi regolarmente. Non è anonimo perché non cambia. Se fai parte di una community online, potresti voler mantenere un'identità nota ad altri. Questo pseudonimo non è anonimo perché, se monitorato abbastanza a lungo, i dettagli sul proprietario potrebbero rilevare ulteriori informazioni, come il modo in cui scrive, le sue conoscenze generali su argomenti d'interesse, etc. - Potresti voler utilizzare una VPN per questo, per mascherare il tuo indirizzo IP. Le transazioni finanziarie sono più difficili da mascherare: potresti considerare l'utilizzo di criptovalute anonime, come [Monero](https://www.getmonero.org/). L'utilizzo del cambio di criptovalute, inoltre, potrebbe aiutare a distinguere l'origine della valuta. Tipicamente, le piattaforme di scambio richiedono il completamento della KYC (conoscenza del cliente), prima di consentirti di scambiare valuta legale per qualsiasi tipo di criptovaluta. Anche le opzioni di incontro locali potrebbero essere una soluzione; tuttavia, sono spesso più costose e, talvolta, richiedono la KYC. +Potresti voler utilizzare una VPN per questo, per mascherare il tuo indirizzo IP. Le transazioni finanziarie sono più difficili da mascherare: potresti considerare l'utilizzo di criptovalute anonime, come [Monero](https://www.getmonero.org/). L'utilizzo del cambio di criptovalute, inoltre, potrebbe aiutare a distinguere l'origine della valuta. Tipicamente, le piattaforme di scambio richiedono il completamento della KYC (conoscenza del cliente), prima di consentirti di scambiare valuta legale per qualsiasi tipo di criptovaluta. Anche le opzioni di incontro locali potrebbero essere una soluzione; tuttavia, sono spesso più costose e, talvolta, richiedono la KYC. 3. **Identità anonima**: Anche con l'esperienza, le identità anonime sono difficili da mantenere per lunghi periodi di tempo. Dovrebbero essere identità a breve termine e di breve durata, a rotazione regolare. - In questo caso, l'utilizzo di Tor può aiutare. Vale anche la pena di notare che un anonimato maggiore è possibile, tramite la comunicazione asincrona: la comunicazione in tempo reale è vulnerabile alle analisi dei modelli di digitazione (cioè, più di un paragrafo di testo, distribuito su un forum, via email, etc.) +In questo caso, l'utilizzo di Tor può aiutare. Vale anche la pena di notare che un anonimato maggiore è possibile, tramite la comunicazione asincrona: la comunicazione in tempo reale è vulnerabile alle analisi dei modelli di digitazione (cioè, più di un paragrafo di testo, distribuito su un forum, via email, etc.) [^1]: Un notevole esempio è quello dell'[incidente del 2021, in cui i ricercatori dell'Università del Minnesota hanno introdotto tre vulnerabilità nel progetto di sviluppo del kernel Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/it/basics/common-threats.md b/i18n/it/basics/common-threats.md index b0666e55..59cfdf8f 100644 --- a/i18n/it/basics/common-threats.md +++ b/i18n/it/basics/common-threats.md @@ -35,19 +35,25 @@ Per quanto riguarda la sicurezza delle applicazioni, generalmente, non sappiamo Per minimizzare i danni che un software malevolo *potrebbe* causare, dovresti utilizzare la sicurezza per la compartimentazione. Ad esempio, ciò potrebbe presentarsi nell'utilizzo di computer differenti per lavori differenti, utilizzando macchine virtuali per separare i gruppi differenti di applicazioni correlate, o utilizzando un sistema operativo sicuro con una forte attenzione al sandboxing delle applicazioni e il controllo obbligatorio degli accessi. -!!! tip "Suggerimento" +
+

Suggerimento

- I sistemi operativi per mobile, generalmente, presentano un migliore sandboxing delle applicazioni, rispetto ai sistemi operativi per desktop: le app possono ottenere l'accesso di root e richiedono l'autorizzazione per accedere alle risorse di sistema. - - Generalmente, i sistemi operativi per desktop sono in ritardo, per l'adeguato sandboxing. ChromeOS ha funzionalità di sandboxing simili ad Android e macOS ha il pieno controllo delle autorizzazioni di sistema (e gli sviluppatori possono optare per il sandboxing delle applicazioni). Tuttavia, questi sistemi operativi trasmettono le informazioni identificativi ai rispettivi OEM. Linux tende a non inviare le informazioni ai fornitori del sistema, ma presenta una scarsa protezione da exploit e applicazioni dannose. Ciò si può in qualche modo mitigare con distribuzioni specializzate che fanno significativo utilizzo di macchine virtuali o contenitori, come [Qubes OS](../desktop.md#qubes-os). +I sistemi operativi per mobile, generalmente, presentano un migliore sandboxing delle applicazioni, rispetto ai sistemi operativi per desktop: le app possono ottenere l'accesso di root e richiedono l'autorizzazione per accedere alle risorse di sistema. + +Generalmente, i sistemi operativi per desktop sono in ritardo, per l'adeguato sandboxing. ChromeOS ha funzionalità di sandboxing simili ad Android e macOS ha il pieno controllo delle autorizzazioni di sistema (e gli sviluppatori possono optare per il sandboxing delle applicazioni). Tuttavia, questi sistemi operativi trasmettono le informazioni identificativi ai rispettivi OEM. Linux tende a non inviare le informazioni ai fornitori del sistema, ma presenta una scarsa protezione da exploit e applicazioni dannose. Ciò si può in qualche modo mitigare con distribuzioni specializzate che fanno significativo utilizzo di macchine virtuali o contenitori, come [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Attacchi Mirati Gli attacchi mirati contro una persona specifica sono più problematici da affrontare. Gli attacchi comuni includono l'invio di documenti dannosi via email, lo sfruttamento delle vulnerabilità (es., nei browser e nei sistemi operativi) e gli attacchi fisici. Se per voi queste sono preoccupazioni, dovresti impiegare strategie di mitigazione delle minacce più avanzate. -!!! tip "Suggerimento" +
+

Suggerimento

- Per loro natura, i **browser web**, i **client email** e le **applicazioni per ufficio**, eseguono tipicamente del codice non attendibile, inviato da terzi. L'esecuzione di più macchine virtuali, per separare applicazioni simili dal tuo sistema di hosting, nonché da ogni altra, è una tecnica utilizzabile per mitigare la probabilità che un exploit di queste applicazioni comprometta il resto del tuo sistema. Ad esempio, le tecnologie come QubesOS o Microsoft Defender Application Guard su Windows, forniscono comodi metodi per farlo. +Per loro natura, i **browser web**, i **client email** e le **applicazioni per ufficio**, eseguono tipicamente del codice non attendibile, inviato da terzi. L'esecuzione di più macchine virtuali, per separare applicazioni simili dal tuo sistema di hosting, nonché da ogni altra, è una tecnica utilizzabile per mitigare la probabilità che un exploit di queste applicazioni comprometta il resto del tuo sistema. Ad esempio, le tecnologie come QubesOS o Microsoft Defender Application Guard su Windows, forniscono comodi metodi per farlo. + +
Se temi un **attacco fisico**, dovresti utilizzare un sistema operativo con un'implementazione d'avvio verificata e sicura, come Android, iOS, macOS, o [Windows (con TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Inoltre, dovresti assicurarti che la tua unità sia crittografata e che il sistema operativo utilizzi un TPM o Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) od [Element](https://developers.google.com/android/security/android-ready-se), per limitare la frequenza dei tentativi di inserire la frase segreta crittografica. Dovresti evitare di condividere il tuo computer con persone di cui non ti fidi, poiché gran parte dei sistemi operativi per desktop non crittografa i dati separatamente, per ogni utente. @@ -61,13 +67,16 @@ Il problema evidente è che il fornitore del servizio (o un hacker che ha compro Fortunatamente, l'E2EE può alleviare questo problema crittografando le comunicazioni tra te e i tuoi destinatari desiderati, persino prima che siano inviate al server. La confidenzialità dei tuoi messaggi è garantita, supponendo che il fornitore del servizio non abbia accesso alle chiavi private di ambe le parti. -!!! note "Nota sulla crittografia basata sul Web" +
+

Note on Web-based Encryption

- In pratica, l'efficacia delle diverse implementazioni E2EE varia. Le applicazioni, come [Signal](../real-time-communication.md#signal), operano nativamente sul tuo dispositivo e ogni copia dell'applicazione è la stessa tra diverse installazioni. Se il fornitore del servizio introducesse una [backdoor](https://it.wikipedia.org/wiki/Backdoor) nella propria applicazione, tentando di rubare le tue chiavi private, sarebbe successivamente rilevabile con l'[ingegneria inversa](https://it.wikipedia.org/wiki/Reverse_engineering). - - D'altra parte, le implementazioni E2EE basate sul web, come la webmail di Proton Mail o il *Web Vault* di Bitwarden, si affidano al fatto che il server serve dinamicamente il codice in JavaScript al browser, per gestire la crittografia. Un server malintenzionato può prenderti di mira, inviandoti codice dannoso in JavaScript per rubare la tua chiave crittografica (cosa estremamente difficile da notare). Poiché il server può scegliere di servire client differenti a persone differenti, anche se notassi l'attacco, sarebbe incredibilmente difficile provare la colpevolezza del fornitore. - - Dunque, dovresti utilizzare le applicazioni native, invece dei client web, quando possibile. +In pratica, l'efficacia delle diverse implementazioni E2EE varia. Le applicazioni, come [Signal](../real-time-communication.md#signal), operano nativamente sul tuo dispositivo e ogni copia dell'applicazione è la stessa tra diverse installazioni. Se il fornitore del servizio introducesse una [backdoor](https://it.wikipedia.org/wiki/Backdoor) nella propria applicazione, tentando di rubare le tue chiavi private, sarebbe successivamente rilevabile con l'[ingegneria inversa](https://it.wikipedia.org/wiki/Reverse_engineering). + +D'altra parte, le implementazioni E2EE basate sul web, come la webmail di Proton Mail o il *Web Vault* di Bitwarden, si affidano al fatto che il server serve dinamicamente il codice in JavaScript al browser, per gestire la crittografia. Un server malintenzionato può prenderti di mira, inviandoti codice dannoso in JavaScript per rubare la tua chiave crittografica (cosa estremamente difficile da notare). Poiché il server può scegliere di servire client differenti a persone differenti, anche se notassi l'attacco, sarebbe incredibilmente difficile provare la colpevolezza del fornitore. + +Dunque, dovresti utilizzare le applicazioni native, invece dei client web, quando possibile. + +
Anche con l'E2EE, i fornitori dei servizi possono comunque profilarti secondo i **metadati**, che tipicamente non sono protetti. Sebbene il fornitore del servizio non possa leggere i tuoi messaggi, può comunque osservare cose importanti, come con chi stai parlando, quanto spesso gli invii messaggi e quando sei tipicamente attivo. La protezione dei metadati è abbastanza rara e, se rientra nel tuo [modello di minaccia](threat-modeling.md), dovresti prestare molta attenzione alla documentazione tecnica del software che stai utilizzando, per scoprire se è prevista alcuna minimizzazione o protezione dei metadati. @@ -77,17 +86,23 @@ Anche con l'E2EE, i fornitori dei servizi possono comunque profilarti secondo i La sorveglianza di massa consiste nell'intricato sforzo di monitorare il "comportamento, molte attività o informazioni" di un'intera (o di una sostanziale frazione di una) popolazione.[^1] Spesso si riferisce a programmi governativi, come quelli [divulgati da Edward Snowden, nel 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). Tuttavia, può essere anche svolta dalle aziende, per conto di agenzie governative o di propria iniziativa. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- Se vuoi saperne di più sui metodi di sorveglianza e su come vengono attuati nella tua città, puoi anche dare un'occhiata all'[Atlas of Surveillance](https://atlasofsurveillance.org/) della [Electronic Frontier Foundation](https://www.eff.org/). - - In Francia puoi consultare il [sito web della Technopolice](https://technopolice.fr/villes), mantenuto dall'associazione senza scopi di lucro 'La Quadrature du Net'. +Se vuoi saperne di più sui metodi di sorveglianza e su come vengono attuati nella tua città, puoi anche dare un'occhiata all'[Atlas of Surveillance](https://atlasofsurveillance.org/) della [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Spesso, i governi, giustificano i programmi di sorveglianza di massa come mezzi necessari per combattere il terrorismo e prevenire il crimine. Tuttavia, violando i diritti umani, sono spesso utilizzati per colpire in modo sproporzionato gruppi di minoranza e dissidenti politici, tra gli altri. -!!! quote "ACLU: [*La lezione sulla privacy del 9/11: la sorveglianza di massa non è la strada da seguire*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Di fronte alle [divulgazioni di Edward Snowden dei programmi governativi come [PRISM](https://it.wikipedia.org/wiki/PRISM_(programma_di_sorveglianza)) e [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)]; inoltre, i funzionari dell'intelligence hanno ammesso che l'NSA ha raccolto segretamente per anni i registri su virtualmente ogni chiamata telefonica statunitense: chi chiama chi, quando e quanto durano. Questo tipo di informazioni, accumulate dall'NSA giorno dopo giorno, possono rivelare dettagli incredibilmente sensibili sulle vite delle persone e le associazioni, come se hanno chiamato un prete, una struttura preposta all'aborto, un consulente per le dipendenze o una linea diretta anti-suicidi. +Di fronte alle [divulgazioni di Edward Snowden dei programmi governativi come [PRISM](https://it.wikipedia.org/wiki/PRISM_(programma_di_sorveglianza)) e [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)]; inoltre, i funzionari dell'intelligence hanno ammesso che l'NSA ha raccolto segretamente per anni i registri su virtualmente ogni chiamata telefonica statunitense: chi chiama chi, quando e quanto durano. Questo tipo di informazioni, accumulate dall'NSA giorno dopo giorno, possono rivelare dettagli incredibilmente sensibili sulle vite delle persone e le associazioni, come se hanno chiamato un prete, una struttura preposta all'aborto, un consulente per le dipendenze o una linea diretta anti-suicidi. + +
Nonostante la crescente sorveglianza di massa negli Stati Uniti, il governo ha riscontrato che i programmi di sorveglianza di massa come la Sezione 215 hanno avuto "poco valore univoco", per quanto riguarda l'arresto di crimini reali o di complotti terroristici, con sforzi che, in gran parte, duplicano i programmi di sorveglianza mirata del FBI.[^2] @@ -133,11 +148,14 @@ La censura sulle piattaforme aziendali è sempre più comune, in quanto piattafo Le persone preoccupate dalla minaccia della censura possono utilizzare tecnologie come [Tor](../advanced/tor-overview.md) per aggirarla, e supportare le piattaforme di comunicazione resistenti alla censura come [Matrix](../real-time-communication.md#element), prive di autorità centralizzata che possa chiudere arbitrariamente i profili. -!!! tip "Suggerimento" +
+

Suggerimento

- Anche se eludere la censura stessa è facile, nascondere il fatto che lo si stia facendo può essere molto problematico. - - Dovresti considerare quali aspetti della rete sono osservabili dal tuo avversario, e se hai la possibilità di negare in modo plausibile le tue azioni. Ad esempio, l'utilizzo di [DNS crittografati](../advanced/dns-overview.md#what-is-encrypted-dns), può aiutarti a superare i sistemi di censura rudimentali e basati sul DNS, ma non può nascondere realmente ciò che visiti dal tuo ISP. Una VPN o Tor possono aiutare a nascondere ciò che stai visitando dagli amministratori di rete, ma non può nascondere il fatto che si stiano utilizzando tali reti. I trasporti collegabili (come Obfs4proxy, Meek o Shadowsocks) possono aiutarti a eludere i firewall che bloccano i protocolli comuni VPN o Tor, ma i tuoi tentativi di elusione possono comunque essere rilevati da metodi come il probing o l'[ispezione approfondita dei pacchetti](https://it.wikipedia.org/wiki/Deep_packet_inspection). +Anche se eludere la censura stessa è facile, nascondere il fatto che lo si stia facendo può essere molto problematico. + +Dovresti considerare quali aspetti della rete sono osservabili dal tuo avversario, e se hai la possibilità di negare in modo plausibile le tue azioni. Ad esempio, l'utilizzo di [DNS crittografati](../advanced/dns-overview.md#what-is-encrypted-dns), può aiutarti a superare i sistemi di censura rudimentali e basati sul DNS, ma non può nascondere realmente ciò che visiti dal tuo ISP. Una VPN o Tor possono aiutare a nascondere ciò che stai visitando dagli amministratori di rete, ma non può nascondere il fatto che si stiano utilizzando tali reti. I trasporti collegabili (come Obfs4proxy, Meek o Shadowsocks) possono aiutarti a eludere i firewall che bloccano i protocolli comuni VPN o Tor, ma i tuoi tentativi di elusione possono comunque essere rilevati da metodi come il probing o l'[ispezione approfondita dei pacchetti](https://it.wikipedia.org/wiki/Deep_packet_inspection). + +
Devi sempre considerare i rischi di provare a eludere la censura, le potenziali conseguenze e quanto potrebbe essere sofisticato il tuo avversario. Dovresti essere cauto con la tua selezione del software e avere un piano di riserva nel caso in cui dovessi essere scoperto. diff --git a/i18n/it/basics/multi-factor-authentication.md b/i18n/it/basics/multi-factor-authentication.md index a1c2534e..7adcaa89 100644 --- a/i18n/it/basics/multi-factor-authentication.md +++ b/i18n/it/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ Il comando impedirà ai malintenzionati di aggirare l'AFM, all'avvio del compute ### Linux -!!! warning "Attenzione" +
+

Avviso

- Se il nome del host del tuo sistema cambia (ad esempio, a causa del DHCP), non potrai accedere. È fondamentale che tu configuri un nome del host adeguato per il tuo computer, prima di seguire questa guida. +Se il nome del host del tuo sistema cambia (ad esempio, a causa del DHCP), non potrai accedere. È fondamentale che tu configuri un nome del host adeguato per il tuo computer, prima di seguire questa guida. + +
Il modulo `pam_u2f` su Linux può fornire l'autenticazione a due fattori per accedere alle distribuzioni più popolari di Linux. Se possiedi una chiave di sicurezza hardware che supporta U2F, puoi configurare l'autenticazione AFM per il tuo accesso. Yubico dispone della [Guida di Accesso a Linux Ubuntu - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F), che dovrebbe funzionare su qualsiasi distribuzione. I comandi del gestore di pacchetti, come `apt-get` e i nomi dei pacchetti, tuttavia, potrebbero variare. Questa guida **non** si applica a Qubes OS. diff --git a/i18n/it/basics/passwords-overview.md b/i18n/it/basics/passwords-overview.md index 6c7bd546..560dba54 100644 --- a/i18n/it/basics/passwords-overview.md +++ b/i18n/it/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Introduzione alle password" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Ecco alcuni consigli e trucchi su come creare le password più forti e mantenere sicuri i tuoi profili. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Le password sono una parte essenziale delle nostre vite digitali quotidiane. Le utilizziamo per proteggere i nostri profili, dispositivi e segreti. Nonostante spesso siano la sola cosa tra di noi e un malintenzionato a caccia di informazioni private, non ci si pensa molto, portando spesso le persone a utilizzare password facili da indovinare o forzare. @@ -26,9 +26,12 @@ Dovresti evitare di modificare troppo spesso le password che devi ricordare (com Per quanto riguard le password che non devi ricordare (come quelle memorizzate nel tuo gestore di password), se il tuo [modello di minaccia](threat-modeling.md) lo richiede, consigliamo di modificare le password dei profili importaanti (specialmente profili privi di autenticazione a più fattori), ogni paio di mesi, nel caso in cui siano state compromesse in una violazione di dati non ancora resa pubblica. Gran parte dei gestori di password ti consentono di impostare una data di scadenza per la tua password, rendendola più facile da gestire. -!!! tip "Controllare le violazioni di dati" +
+

Checking for data breaches

- Se il tuo gestore di password ti consente di verificare quelle compromesse, assicurati di farlo e di modificare prontamente qualsiasi password possa esser stata esposta in una violazione di dati. Altrimenti, potresti seguire il [feed di Violazioni di Dati Recenti di Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches), con l'aiuto di un [aggregatore di notizie](../news-aggregators.md). +Se il tuo gestore di password ti consente di verificare quelle compromesse, assicurati di farlo e di modificare prontamente qualsiasi password possa esser stata esposta in una violazione di dati. Altrimenti, potresti seguire il [feed di Violazioni di Dati Recenti di Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches), con l'aiuto di un [aggregatore di notizie](../news-aggregators.md). + +
## Creare password forti @@ -48,9 +51,12 @@ Un esempio di frase segreta Dicewaare è `visualizzabile velocità riluttante mo Per generare una frase segreta Dicewaare utilizzando dadi reali, segui questi passaggi: -!!! note "Nota" +
+

Nota

- Queste istruzioni suppongono che tu stia utilizzando il [grande elenco di parole di EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) per generare la frase segreta, che richiede cinque lanci di dadi per parola. Altri elenchi di parole potrebbero richiedere maggiori o minori lanci per parola e potrebbero richiedere una quantità di parole differenti, per ottenere la stessa entropia. +Queste istruzioni suppongono che tu stia utilizzando il [grande elenco di parole di EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) per generare la frase segreta, che richiede cinque lanci di dadi per parola. Altri elenchi di parole potrebbero richiedere maggiori o minori lanci per parola e potrebbero richiedere una quantità di parole differenti, per ottenere la stessa entropia. + +
1. Lancia un dado a sei facce per cinque volte, annotando il numero dopo ogni lancio. @@ -60,31 +66,37 @@ Per generare una frase segreta Dicewaare utilizzando dadi reali, segui questi pa 4. Ripeti questa procedura finché la tua frase segreta contiene quante parole necessarie, che dovresti separare con degli spazi. -!!! warning "Importante" +
+

Important

- **Non** dovresti rigenerare le parole finché non ottieni una combinazione di parole che ti attragga. Il processo dovrebbe essere totalmente casuale. +**Non** dovresti rigenerare le parole finché non ottieni una combinazione di parole che ti attragga. Il processo dovrebbe essere totalmente casuale. + +
Se non hai accesso a dadi reali o preferiresti non utilizzarli, puoi utilizzare il generatore di password integrato del gestore di password, poiché molti di essi offrono l'opzione di generare frasi segrete Diceware, oltre alle password regolari. Consigliamo di utilizzare il [grande elenco di parole di EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) per generare le tue frasi segrete Diceware, poiché offre la stessa sicurezza dell'elenco originale, contenendo parole più facili da memorizzare. Esistono anche [altri elenchi di parole in lingue differenti](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), se non desideri che la tua frase segreta sia in inglese. -??? note "Spiegazione dell'entropia e forza delle frasi segrete Diceware" +
+Explanation of entropy and strength of diceware passphrases - Per dimostrare la forza delle frasi segrete Diceware, utilizzeremo la suddetta frase segreta da sette parole ('visualizzabile velocità riluttante morbido diciassette mostrato matita') e il [grande elenco di parole di EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) come esempio. - - Un parametro per determinare la forza di una frase segreta Diceware è la sua entropia. L'entropia per parola in una frase segreta Diceware è calcolata come $\text{log}_2(\text{WordsInList})$ e l'entropia complessiva della frase segreta è calcolata come $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Dunque, ogni parola nell'elenco suddetto risulta in circa 12,9 bit di entropia ($\text{log}_2(7776)$), e una frase segreta di sette parole da esso derivaata contiene circa 90,47 bit di entropia ($\text{log}_2(7776^7)$). - - Il [grande elenco di parole di EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contiene 7776 parole uniche. Per calcolare la quantità di frasi segrete possibili, tutto ciò che dobbiamo fare è $\text{WordsInList}^\text{WordsInPhrase}$ o, nel nostro caso, $ 7776^7 $. - - Mettiamo tutto questo in prospettiva: Una frase segreta di sette parole che utilizza il [grande elenco di parole di EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) è una delle approssimative 1.719.070.799.748.422.500.000.000.000.000 possibili frasi segrete. - - In media, è necessario tentare il 50% di tutte le combinazioni possibili per indovinare la tua frase segreta. Tenendo ciò a mente, anche se il malintenzionato è capace di circa 1.000.000.000.000 tentativi al secondo, gli ci vorrebbero comunque circa 27.255.689 aanni per indovinare la tua frase segreta. Questo vale solo se le seguenti cose sono vere: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Il tuo avversario sa che hai utilizzato il metodo Diceware. - - Il tuo avversario conosce l'elenco di parole specifico utilizzato. - - Il tuo avversario sa quante parole contiene la tua frase segreta. +Un parametro per determinare la forza di una frase segreta Diceware è la sua entropia. L'entropia per parola in una frase segreta Diceware è calcolata come $\text{log}_2(\text{WordsInList})$ e l'entropia complessiva della frase segreta è calcolata come $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Dunque, ogni parola nell'elenco suddetto risulta in circa 12,9 bit di entropia ($\text{log}_2(7776)$), e una frase segreta di sette parole da esso derivaata contiene circa 90,47 bit di entropia ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. Per calcolare la quantità di frasi segrete possibili, tutto ciò che dobbiamo fare è $\text{WordsInList}^\text{WordsInPhrase}$ o, nel nostro caso, $ 7776^7 $. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +In media, è necessario tentare il 50% di tutte le combinazioni possibili per indovinare la tua frase segreta. Tenendo ciò a mente, anche se il malintenzionato è capace di circa 1.000.000.000.000 tentativi al secondo, gli ci vorrebbero comunque circa 27.255.689 aanni per indovinare la tua frase segreta. Questo vale solo se le seguenti cose sono vere: + +- Il tuo avversario sa che hai utilizzato il metodo Diceware. +- Il tuo avversario conosce l'elenco di parole specifico utilizzato. +- Il tuo avversario sa quante parole contiene la tua frase segreta. + +
Ricapitolando, le frasi segrete Diceware sono la tua migliore opzione quando necessiti di qualcosa che sia facile da ricordare *ed* eccezionalmente forte. @@ -98,13 +110,16 @@ Esistono molte buone opzioni da cui scegliere, sia basate su cloud che locali. S [Elenco dei gestori di password consigliati](../passwords.md ""){.md-button} -!!! warning "Non memorizzare le tue password e i token TOTP nello stesso gestore di password" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- Utilizzando i codici TOTP come [autenticazione a più fattori](../multi-factor-authentication.md), la migliore pratica di sicurezza è mantenerli in un'[app separata](../multi-factor-authentication.md#authenticator-apps). - - Memorizzare i token TOTP nello stesso luogo delle tue password, sebbene comodo, riduce i profili a un singolo fattore, nel caso in cui un malintenzionato ottenga l'accesso al tuo gestore di password. - - Inoltre, sconsigliamo di memorizzare i codici di recupero a uso singolo nel tuo gestore di password. Questi, dovrebbero essere memorizzati separatamente in un contenitore crittografato, su un dispositivo di archiviazione offline. +Utilizzando i codici TOTP come [autenticazione a più fattori](../multi-factor-authentication.md), la migliore pratica di sicurezza è mantenerli in un'[app separata](../multi-factor-authentication.md#authenticator-apps). + +Memorizzare i token TOTP nello stesso luogo delle tue password, sebbene comodo, riduce i profili a un singolo fattore, nel caso in cui un malintenzionato ottenga l'accesso al tuo gestore di password. + +Inoltre, sconsigliamo di memorizzare i codici di recupero a uso singolo nel tuo gestore di password. Questi, dovrebbero essere memorizzati separatamente in un contenitore crittografato, su un dispositivo di archiviazione offline. + +
### Backup diff --git a/i18n/it/basics/vpn-overview.md b/i18n/it/basics/vpn-overview.md index d3276317..0737739f 100644 --- a/i18n/it/basics/vpn-overview.md +++ b/i18n/it/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "Come le VPN proteggono la tua privacy? La nostra panoramica sulle VPN - Privacy Guides" -title: Panoramica VPN +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Le reti virtuali private spostano il rischio dal vostro ISP a una terza parte di cui vi fidate. Dovresti tenere a mente questi aspetti. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Le Reti Private Virtuali sono un metodo d'estensione del termine della tua rete, affinché il traffico esca da qualche altra parte nel mondo. @@ -11,9 +11,12 @@ Normalmente, un ISP può visualizzare il flusso di traffico Internet in entrate L'utilizzo di una VPN nasconde persino queste informazioni dal tuo ISP, spostando la fiducia che poni nella tua rete, a un server da qualche altra parte nel mondo. Di conseguenza, l'ISP può soltanto vedere che sei conness* a una VPN e nulla sull'attività che vi stai svolgendo. -!!! note "Nota" +
+

Nota

- Quando ci riferiamo a "Reti Private Virtuali" su questo sito web, solitamente ci riferiamo ai [fornitori di VPN](../vpn.md) **commerciali**, per cui paghi una tariffa mensile, in cambio dell'instradamento sicuro del tuo traffico Internet, tramite server pubblici. Esistono molte altre forme di VPN, come quelle auto-ospitate, o quelle operate dai luoghi di lavoro, che ti consentono di connetterti in sicurezza alle risorse di rete interne/dei dipendenti; tuttavia, queste VPN sono solitamente progettate per accedere in sicurezza alle reti da remoto, piuttosto che per proteggere la privacy della tua connessione a Internet. +Quando ci riferiamo a "Reti Private Virtuali" su questo sito web, solitamente ci riferiamo ai [fornitori di VPN](../vpn.md) **commerciali**, per cui paghi una tariffa mensile, in cambio dell'instradamento sicuro del tuo traffico Internet, tramite server pubblici. Esistono molte altre forme di VPN, come quelle auto-ospitate, o quelle operate dai luoghi di lavoro, che ti consentono di connetterti in sicurezza alle risorse di rete interne/dei dipendenti; tuttavia, queste VPN sono solitamente progettate per accedere in sicurezza alle reti da remoto, piuttosto che per proteggere la privacy della tua connessione a Internet. + +
## Come funziona una VPN? diff --git a/i18n/it/os/android-overview.md b/i18n/it/os/android-overview.md index 20e20518..eab3a1b9 100644 --- a/i18n/it/os/android-overview.md +++ b/i18n/it/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Panoramica Android +title: Android Overview icon: simple/android -description: Android è un sistema operativo open source con forti protezioni per la sicurezza, il che lo rende la nostra scelta migliore, per la telefonia. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Logo di Android](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Un'app potrebbe richiedere un'autorizzazione per una sua funzionalità specifica [Exodus](https://exodus-privacy.eu.org/) può essere utile se devi confrontare app con scopi simili. Se un'app richiede molte autorizzazioni e contiene molti annunci e analisi, è probabilmente un brutto segno. Consigliamo di esaminare i singoli tracker e di leggerne le descrizioni piuttosto che limitarsi a **contarne il totale** e supporre che tutte le voci elencate siano uguali. -!!! warning "Attenzione" +
+

Avviso

- Se un'app è prevalentemente un servizio basato su web, il tracciamento potrebbe verificarsi dal lato del server. [Facebook](https://reports.exodus-privacy.eu.org/it/reports/com.facebook.katana/latest/) mostra "nessun tracciatore", ma traccia sicuramente gli interessi e comportamenti degli utenti sul sito. Le app potrebbero eludere il rilevamento non utilizzando le librerie di codice standard prodotte dall'industria pubblicitaria, sebbene sia improbabile. +Se un'app è prevalentemente un servizio basato su web, il tracciamento potrebbe verificarsi dal lato del server. [Facebook](https://reports.exodus-privacy.eu.org/it/reports/com.facebook.katana/latest/) mostra "nessun tracciatore", ma traccia sicuramente gli interessi e comportamenti degli utenti sul sito. Le app potrebbero eludere il rilevamento non utilizzando le librerie di codice standard prodotte dall'industria pubblicitaria, sebbene sia improbabile. -!!! note "Nota" +
- Le app che rispettano la privacy come [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) potrebbero mostrare dei tracciatori come [Google Firebase Analytics](https://reports.exodus.privacy.eu.org/en/trackers/49/). Questa libreria include [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) che può fornire [notifiche push](https://en.wikipedia.org/wiki/Push_technology) nelle app. Questo [è il caso] (https://fosstodon.org/@bitwarden/109636825700482007) di Bitwarden. Ciò non significa che Bitwarden sta utilizzando tutte le funzionalità analitiche fornite da Google Firebase Analytics. +
+

Nota

+ +Le app che rispettano la privacy come [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) potrebbero mostrare dei tracciatori come [Google Firebase Analytics](https://reports.exodus.privacy.eu.org/en/trackers/49/). Questa libreria include [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) che può fornire [notifiche push](https://en.wikipedia.org/wiki/Push_technology) nelle app. Questo [è il caso] (https://fosstodon.org/@bitwarden/109636825700482007) di Bitwarden. Ciò non significa che Bitwarden sta utilizzando tutte le funzionalità analitiche fornite da Google Firebase Analytics. + +
## Funzionalità per la Privacy diff --git a/i18n/it/os/ios-overview.md b/i18n/it/os/ios-overview.md index 5e641d39..229e6fd1 100644 --- a/i18n/it/os/ios-overview.md +++ b/i18n/it/os/ios-overview.md @@ -1,7 +1,7 @@ --- -title: Panoramica su iOS +title: iOS Overview icon: simple/apple -description: iOS è un sistema operativo mobile sviluppato da Apple per l'iPhone. +description: iOS is a mobile operating system developed by Apple for the iPhone. --- **iOS** e **iPadOS** sono sistemi operativi mobili proprietari sviluppati da Apple per i propri prodotti, iPhone e iPad, rispettivamente. Se possiedi un dispositivo mobile Apple, puoi incrementare la tua privacy disabilitando alcune funzionalità di telemetria integrate e rafforzando alcune impostazioni per la privacy e la sicurezza, integrate sul sistema. @@ -146,9 +146,12 @@ Dopo aver abilitato la protezione dei dati rubati, [alcune azioni](https://suppo Gli iPhone sono già resistenti agli attacchi di forza bruta, facendoti attendere abbastanza a lungo dopo più tentativi falliti; tuttavia, storicamente, sono esistiti degli exploit per aggirare tale problema. Per una maggiore sicurezza, puoi impostare il tuo telefono perché si ripristini da solo, dopo 10 tentativi falliti di inserimento del codice d'accesso. -!!! warning "Attenzione" +
+

Avviso

- Con quest'impostazione abilitata, qualcuno potrebbe ripristinare intenzionalmente il tuo telefono, inserendo molte volte la password errata. Assicurati di avere dei backup adeguati e di abilitare quest'impostazione soltanto se ti senti a tuo agio nel farlo. +Con quest'impostazione abilitata, qualcuno potrebbe ripristinare intenzionalmente il tuo telefono, inserendo molte volte la password errata. Assicurati di avere dei backup adeguati e di abilitare quest'impostazione soltanto se ti senti a tuo agio nel farlo. + +
- [x] Attiva **Cancella Dati** diff --git a/i18n/it/os/macos-overview.md b/i18n/it/os/macos-overview.md index 4e692443..632d80f8 100644 --- a/i18n/it/os/macos-overview.md +++ b/i18n/it/os/macos-overview.md @@ -1,7 +1,7 @@ --- -title: Panoramica di macOS +title: macOS Overview icon: material/apple-finder -description: macOS è il sistema operativo desktop di Apple che opera con il loro hardware, fornendo grande sicurezza. +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- **macOS** è un sistema operativo Unix sviluppato da Apple per i propri computer Mac. Per migliorare la privacy su macOS, puoi disabilitare le funzionalità di telemetria e rafforzare le impostazioni di privacy e sicurezza esistenti. @@ -156,9 +156,12 @@ macOS utilizza la difesa approfondita, affidandosi a svariati livelli di protezi ### Sicurezza del Software -!!! warning "Attenzione" +
+

Avviso

- macOS ti consente di installare gli aggiornamenti beta. Questi sono instabili e potrebbero comportare un'ulteriore telemetria, essendo per scopi di test. Per questo, ti consigliamo di evitare i software in beta, in generale. +macOS ti consente di installare gli aggiornamenti beta. Questi sono instabili e potrebbero comportare un'ulteriore telemetria, essendo per scopi di test. Per questo, ti consigliamo di evitare i software in beta, in generale. + +
#### Volume di Sistema Firmato @@ -178,9 +181,12 @@ La Protezione dell'Integrità di Sistema rende le posizioni dei file di sola let Le app di macOS scaricate dall'App Store devono essere testate utilizzando [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning "Attenzione" +
+

Avviso

- I software scaricati al di fuori dell'App Store ufficiale non devono essere testate. Dovresti evitare i software non provenienti dall'App Store, il più possibile. +I software scaricati al di fuori dell'App Store ufficiale non devono essere testate. Dovresti evitare i software non provenienti dall'App Store, il più possibile. + +
##### Antivirus diff --git a/i18n/it/os/qubes-overview.md b/i18n/it/os/qubes-overview.md index c4ea482f..b89112e1 100644 --- a/i18n/it/os/qubes-overview.md +++ b/i18n/it/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes è un sistema operativo basato sull'isolamento delle applicaz Qubes utilizza la [compartimentazione](https://www.qubes-os.org/intro/) per mantenere il sistema sicuro. I Qube sono creati da modelli, predefiniti per Fedora, Debian e [Whonix](../desktop.md#whonix). Qubes OS ti consente anche di creare *qubes* [monouso](https://www.qubes-os.org/doc/how-to-use-disposables/). -??? "Il termine *qubes* sta venendo pian piano aggiornato per evitare di confonderle con le "macchine virtuali"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Alcune informazioni riportate qui e nella documentazione di Quebes OS possono contenere un linguaggio contraddittorio, poiché il termine "appVM" sta venendo pian piano modificato in "qube". Le Qube non sono delle vere e proprie macchine virtuali, ma mantengono funzionalità simili alle VM. +Alcune informazioni riportate qui e nella documentazione di Quebes OS possono contenere un linguaggio contraddittorio, poiché il termine "appVM" sta venendo pian piano modificato in "qube". Le Qube non sono delle vere e proprie macchine virtuali, ma mantengono funzionalità simili alle VM. + +
![Architettura Qubes](../assets/img/qubes/qubes-trust-level-architecture.png)
Architettura di Qubes, Crediti: Introduzione a Qubes OS
@@ -41,9 +44,12 @@ Puoi [copiare e incollare il testo](https://www.qubes-os.org/doc/how-to-copy-and Per copiare e incollare file e cartelle da una *qube* a un'altra, puoi usare l'opzione **Copia in un'altra AppVM...** o **Sposta in un'altra AppVM...**. La differenza è che l'opzione **Move** eliminerà il file originale. Entrambe le opzioni proteggeranno i tuoi appunti dalla trasmissione verso altre *qube*. Questo è più sicuro del trasferimento di file via etere. Un computer isolato sarà comunque costretto ad analizzare partizioni o file di sistema. Ciò non è necessario con il sistema di copia tra Qube. -??? "Le Qube non hanno i propri file di sistema." +
+Qubes do not have their own filesystems. - Puoi [copiare e spostare file](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) tra le *qube*. Così facendo, le modifiche non vengono applicate immediatamente e sono facilmente annullabili, in caso di incidente. Quando esegui una *qube*, questa non dispone di un file di sistema persistente. Puoi creare e cancellare file, ma queste modifiche sono effimere. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Così facendo, le modifiche non vengono applicate immediatamente e sono facilmente annullabili, in caso di incidente. When you run a *qube*, it does not have a persistent filesystem. Puoi creare e cancellare file, ma queste modifiche sono effimere. + +
### Interazioni tra VM diff --git a/i18n/ja/advanced/payments.md b/i18n/ja/advanced/payments.md index 60e43b9a..da21c52d 100644 --- a/i18n/ja/advanced/payments.md +++ b/i18n/ja/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: プライベートな支払い +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! 警告 +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. 信頼できるプロジェクトとのみ慎重に取引してください。 +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. 信頼できるプロジェクトとのみ慎重に取引してください。 + +
### プライバシーコイン diff --git a/i18n/ja/advanced/tor-overview.md b/i18n/ja/advanced/tor-overview.md index 1f282870..095f8323 100644 --- a/i18n/ja/advanced/tor-overview.md +++ b/i18n/ja/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSHフィンガープリンティング" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/ja/basics/account-creation.md b/i18n/ja/basics/account-creation.md index a9da2f44..1f87207f 100644 --- a/i18n/ja/basics/account-creation.md +++ b/i18n/ja/basics/account-creation.md @@ -1,6 +1,6 @@ --- meta_title: "How to Create Internet Accounts Privately - Privacy Guides" -title: "アカウントの作成" +title: "Account Creation" icon: 'material/account-plus' description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! ヒント +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/ja/basics/common-misconceptions.md b/i18n/ja/basics/common-misconceptions.md index c03bfbbe..5c0a31bd 100644 --- a/i18n/ja/basics/common-misconceptions.md +++ b/i18n/ja/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! ヒント - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/ja/basics/common-threats.md b/i18n/ja/basics/common-threats.md index 39fabaf3..65e7aa2e 100644 --- a/i18n/ja/basics/common-threats.md +++ b/i18n/ja/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! ヒント +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! ヒント +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! 引用元：「ACLU（アメリカ自由人権協会）：[*9.11のプライバシーに関する教訓：大量監視は進むべき道ではない*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)」 +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! ヒント +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/ja/basics/multi-factor-authentication.md b/i18n/ja/basics/multi-factor-authentication.md index 3bbc634f..4577af45 100644 --- a/i18n/ja/basics/multi-factor-authentication.md +++ b/i18n/ja/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! 警告 +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/ja/basics/passwords-overview.md b/i18n/ja/basics/passwords-overview.md index dd07668d..1012e2b4 100644 --- a/i18n/ja/basics/passwords-overview.md +++ b/i18n/ja/basics/passwords-overview.md @@ -1,5 +1,5 @@ --- -title: "パスワードの概要" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## 強力なパスワードの作成 @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! メモ +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### バックアップ diff --git a/i18n/ja/basics/vpn-overview.md b/i18n/ja/basics/vpn-overview.md index 10673056..1994eef1 100644 --- a/i18n/ja/basics/vpn-overview.md +++ b/i18n/ja/basics/vpn-overview.md @@ -1,6 +1,6 @@ --- -meta_title: "VPNがプライバシーを守る方法について。 VPNの概要 - Privacy Guides" -title: VPNの概要 +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! メモ +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## VPNの仕組み diff --git a/i18n/ja/os/android-overview.md b/i18n/ja/os/android-overview.md index b135c9a8..99a08d82 100644 --- a/i18n/ja/os/android-overview.md +++ b/i18n/ja/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Androidの概要 +title: Android Overview icon: simple/android -description: Androidは、強力なセキュリティー保護機能を備えたオープンソースのオペレーティングシステムであり、携帯電話に関する最も優れた選択肢です。 +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android logo](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! 警告 +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! メモ +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## プライバシー機能 diff --git a/i18n/ja/os/ios-overview.md b/i18n/ja/os/ios-overview.md index 17e7635a..163424b0 100644 --- a/i18n/ja/os/ios-overview.md +++ b/i18n/ja/os/ios-overview.md @@ -1,5 +1,5 @@ --- -title: iOSの概要 +title: iOS Overview icon: simple/apple description: iOS is a mobile operating system developed by Apple for the iPhone. --- @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! 警告 +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/ja/os/macos-overview.md b/i18n/ja/os/macos-overview.md index ba0ebfa1..f5957d7d 100644 --- a/i18n/ja/os/macos-overview.md +++ b/i18n/ja/os/macos-overview.md @@ -1,7 +1,7 @@ --- -title: macOSの概要 +title: macOS Overview icon: material/apple-finder -description: macOSはAppleのデスクトップオペレーティングシステムで、ハードウェアと連携して強力なセキュリティを提供します。 +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- **macOS**は、AppleがMacコンピュータ用に開発したUnixオペレーティングシステムです。 To enhance privacy on macOS, you can disable telemetry features and harden existing privacy and security settings. @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### ソフトウェアのセキュリティー -!!! 警告 +
+

Warning

- macOSではベータ版アップデートをインストールできます。 These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOSではベータ版アップデートをインストールできます。 These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! 警告 +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### アンチウィルス diff --git a/i18n/ja/os/qubes-overview.md b/i18n/ja/os/qubes-overview.md index 02e96460..4dde7c23 100644 --- a/i18n/ja/os/qubes-overview.md +++ b/i18n/ja/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubesは、 [区画化（コンパートメンタリゼーション）](https://www.qubes-os.org/intro/) によってシステムの安全性を維持しています。 Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubesのアーキテクチャー](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/ko/advanced/payments.md b/i18n/ko/advanced/payments.md index 7522d6d5..326ef98c 100644 --- a/i18n/ko/advanced/payments.md +++ b/i18n/ko/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: 비공개 결제 수단 +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while 암호화폐는 정부 혹은 은행 등의 중앙 기관 없이도 작동하도록 설계된 디지털 화폐입니다. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger "위험" +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### 프라이버시 코인 diff --git a/i18n/ko/advanced/tor-overview.md b/i18n/ko/advanced/tor-overview.md index 0ddc0efd..defcf4f8 100644 --- a/i18n/ko/advanced/tor-overview.md +++ b/i18n/ko/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/ko/basics/account-creation.md b/i18n/ko/basics/account-creation.md index 5a0908d1..dce24a78 100644 --- a/i18n/ko/basics/account-creation.md +++ b/i18n/ko/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "프라이버시를 지키며 인터넷 계정을 생성하는 방법 - Privacy Guides" -title: "계정 생성" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: 인터넷을 하려면 계정 생성은 필수적입니다. 이 절차를 따라 계정 프라이버시를 보호할 수 있습니다. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- 사람들은 별다른 생각 없이 서비스에 가입할 때가 많습니다. 남들이 이야기하는 새로 나온 드라마를 상영하는 스트리밍 서비스에 가입하기도 하고, 자주 가는 음식 프랜차이즈에서 할인 혜택을 받으려고 가입하기도 합니다. 어떤 경우든, 현재 및 향후 여러분의 데이터에 미치는 영향을 고려해야 합니다. @@ -29,9 +29,12 @@ description: 인터넷을 하려면 계정 생성은 필수적입니다. 이 절 새로운 계정을 생성할 때는 이메일 주소와 비밀번호를 사용하는 것이 가장 일반적입니다. 이 경우, 비밀번호 관리자를 사용해야 하며 비밀번호 관련 [모범 사례](passwords-overview.md)를 따라야 합니다. -!!! tip "도움말" +
+

Tip

- 다른 인증 방법도 비밀번호 관리자에서 관리할 수 있습니다! 새 항목을 추가하고 적절한 필드를 채우면 보안 질문, 백업 키 등 관련 메모를 추가할 수 있습니다. +다른 인증 방법도 비밀번호 관리자에서 관리할 수 있습니다! 새 항목을 추가하고 적절한 필드를 채우면 보안 질문, 백업 키 등 관련 메모를 추가할 수 있습니다. + +
로그인 자격 증명의 관리 책임은 자기 자신에게 있습니다. 보안을 강화하려면 계정에 [MFA](multi-factor-authentication.md)를 설정하세요. diff --git a/i18n/ko/basics/common-misconceptions.md b/i18n/ko/basics/common-misconceptions.md index f046fbb1..2c3d839b 100644 --- a/i18n/ko/basics/common-misconceptions.md +++ b/i18n/ko/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "도움말" - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/ko/basics/common-threats.md b/i18n/ko/basics/common-threats.md index b45f3ac3..e8d9a875 100644 --- a/i18n/ko/basics/common-threats.md +++ b/i18n/ko/basics/common-threats.md @@ -35,19 +35,25 @@ description: 위협 모델은 개개인마다 다르지만, 이 사이트의 방 악성 소프트웨어가 일으킬 *수도 있는* 피해를 최소화하려면 구획화를 이용한 보안을 적용해야합니다. 작업 종류마다 다른 컴퓨터를 사용하거나, 애플리케이션을 연관 그룹별로 분류해 가상 머신에서 사용하거나, 애플리케이션 샌드박스 격리 및 필수 접근 제어 기능에 특화된 보안 운영체제를 사용하는 등의 방법이 있습니다. -!!! tip "도움말" +
+

Tip

- 일반적으로 모바일 운영 체제는 데스크톱 운영 체제보다 애플리케이션 샌드박스 기능이 뛰어납니다. 모바일 운영체제에서는 앱이 루트 권한을 얻을 수 없고, 시스템 리소스에 접근하려면 권한이 필요합니다. - - 데스크톱 운영 체제는 보통 적절한 샌드박스 기능 면에서 뒤처집니다. ChromeOS는 Android와 유사한 샌드박스 기능을 제공하며, macOS는 전체 시스템 권한 제어 기능을 제공합니다(개발자는 애플리케이션의 샌드박스를 적용 여부를 선택할 수 있습니다). 하지만 이러한 운영 체제는 식별 정보를 각 OEM에 전송합니다. Linux는 대체로 시스템 공급 업체에 정보를 보내지 않지만, 취약점 및 악성 앱으로부터의 보호 기능은 미흡합니다. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +일반적으로 모바일 운영 체제는 데스크톱 운영 체제보다 애플리케이션 샌드박스 기능이 뛰어납니다. 모바일 운영체제에서는 앱이 루트 권한을 얻을 수 없고, 시스템 리소스에 접근하려면 권한이 필요합니다. + +데스크톱 운영 체제는 보통 적절한 샌드박스 기능 면에서 뒤처집니다. ChromeOS는 Android와 유사한 샌드박스 기능을 제공하며, macOS는 전체 시스템 권한 제어 기능을 제공합니다(개발자는 애플리케이션의 샌드박스를 적용 여부를 선택할 수 있습니다). 하지만 이러한 운영 체제는 식별 정보를 각 OEM에 전송합니다. Linux는 대체로 시스템 공급 업체에 정보를 보내지 않지만, 취약점 및 악성 앱으로부터의 보호 기능은 미흡합니다. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: 표적 공격(Targeted Attacks) 특정 인물을 대상으로 하는 표적 공격은 더욱 대응하기 어렵습니다. 흔한 예시로는 이메일을 통한 악성 문서 전송, 브라우저 및 운영 체제 등의 취약점 악용, 물리적 공격 등이 있습니다. 표적 공격이 우려된다면, 보다 고급 위협 완화 전략이 필요합니다. -!!! tip "도움말" +
+

Tip

- **웹 브라우저**, **이메일 클라이언트**, **오피스 애플리케이션**은 설계상 외부에서 전송된 신뢰할 수 없는 코드를 실행하도록 되어있습니다. 여러 가상 머신을 사용해 이러한 애플리케이션을 호스트 시스템과 분리하는 것은 애플리케이션 취약점으로부터 시스템의 다른 영역이 손상될 가능성을 줄이는 방법 중 하나입니다. 이런 격리 작업을 편리하게 만들어주는 기술로는 Qubes OS/Microsoft Defender Application Guard 등이 있습니다. +**웹 브라우저**, **이메일 클라이언트**, **오피스 애플리케이션**은 설계상 외부에서 전송된 신뢰할 수 없는 코드를 실행하도록 되어있습니다. 여러 가상 머신을 사용해 이러한 애플리케이션을 호스트 시스템과 분리하는 것은 애플리케이션 취약점으로부터 시스템의 다른 영역이 손상될 가능성을 줄이는 방법 중 하나입니다. 이런 격리 작업을 편리하게 만들어주는 기술로는 Qubes OS/Microsoft Defender Application Guard 등이 있습니다. + +
**물리적 공격**이 우려된다면 Android, iOS, macOS, [Windows(TPM 사용)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process) 등 보안 부팅이 구현된 운영 체제를 사용해야 합니다. 또한 드라이브를 암호화하고, 운영 체제에서 TPM/Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1)/[Element](https://developers.google.com/android/security/android-ready-se)를 이용해 암호 입력 시도를 제한해야 합니다. 대부분의 데스크톱 운영체제는 사용자별 데이터를 암호화하지 않으므로, 신뢰하지 않는 사람과 컴퓨터를 공유하지 말아야 합니다. @@ -61,13 +67,16 @@ description: 위협 모델은 개개인마다 다르지만, 이 사이트의 방 다행히, 송신자와 수신자 간의 통신을 서버로 전송하기 전에 암호화하는 E2EE를 적용하면 이러한 문제를 완화할 수 있습니다. 서비스 제공 업체가 양측 당사자의 개인 키에 접근하지 못한다는 가정 하에, 메시지의 기밀성이 보장됩니다. -!!! note "웹 기반 암호화에 대한 참고 사항" +
+

Note on Web-based Encryption

- 실질적으로 모든 E2EE 구현체가 동일한 유효성을 갖는 것은 아닙니다. [Signal](../real-time-communication.md#signal) 같은 애플리케이션은 기기에서 네이티브로 실행되며, 여러번 설치하더라도 언제나 완벽히 동일한 애플리케이션이 설치됩니다. 서비스 제공 업체가 여러분의 개인 키를 탈취하기 위해 [백도어](https://ko.wikipedia.org/wiki/%EB%B0%B1%EB%8F%84%EC%96%B4)를 도입하더라도, 차후에 [리버스 엔지니어링](https://ko.wikipedia.org/wiki/%EC%97%AD%EA%B3%B5%ED%95%99)을 통해 탐지될 수 있습니다. - - 반면, Proton Mail 웹메일이나 Bitwarden **웹 보관함** 같은 웹 기반 E2EE 구현체의 경우, 서버에서 동적으로 제공하는 자바스크립트 코드에 암호화 처리를 의존합니다. 악성 서버는 사용자를 표적으로 삼아 악성 자바스크립트 코드를 전송해 암호화 키를 탈취 가능하며, 이 경우 사용자는 이를 알아차리기 매우 어렵습니다. 만약 사용자가 공격을 알아차리더라도 제공 업체의 책임을 입증하기란 매우 어렵습니다. 서버에서 사람마다 웹 클라이언트를 다르게 제공하는 것이 가능하기 때문입니다. - - 따라서, 가능하면 웹 클라이언트 대신 네이티브 애플리케이션을 사용해야 합니다. +실질적으로 모든 E2EE 구현체가 동일한 유효성을 갖는 것은 아닙니다. [Signal](../real-time-communication.md#signal) 같은 애플리케이션은 기기에서 네이티브로 실행되며, 여러번 설치하더라도 언제나 완벽히 동일한 애플리케이션이 설치됩니다. 서비스 제공 업체가 여러분의 개인 키를 탈취하기 위해 [백도어](https://ko.wikipedia.org/wiki/%EB%B0%B1%EB%8F%84%EC%96%B4)를 도입하더라도, 차후에 [리버스 엔지니어링](https://ko.wikipedia.org/wiki/%EC%97%AD%EA%B3%B5%ED%95%99)을 통해 탐지될 수 있습니다. + +반면, Proton Mail 웹메일이나 Bitwarden **웹 보관함** 같은 웹 기반 E2EE 구현체의 경우, 서버에서 동적으로 제공하는 자바스크립트 코드에 암호화 처리를 의존합니다. 악성 서버는 사용자를 표적으로 삼아 악성 자바스크립트 코드를 전송해 암호화 키를 탈취 가능하며, 이 경우 사용자는 이를 알아차리기 매우 어렵습니다. 만약 사용자가 공격을 알아차리더라도 제공 업체의 책임을 입증하기란 매우 어렵습니다. 서버에서 사람마다 웹 클라이언트를 다르게 제공하는 것이 가능하기 때문입니다. + +따라서, 가능하면 웹 클라이언트 대신 네이티브 애플리케이션을 사용해야 합니다. + +
E2EE를 적용하더라도 여전히 서비스 제공 업체는 (일반적으로 보호되지 않는) **메타데이터**에 기반하여 여러분의 정보를 수집하고 프로파일링할 수 있습니다. 서비스 제공 업체는 여러분의 메시지를 읽을 수는 없지만, 여러분이 누구와 대화하는지, 얼마나 자주 메시지를 주고받는지, 주로 언제 활동하는지 등 중요한 정보를 관찰 가능합니다. 메타데이터에도 보호가 적용되는 경우는 매우 드뭅니다. 만약 여러분의 [위협 모델](threat-modeling.md)이 메타데이터 보호 또한 필요로 한다면, 사용하는 소프트웨어의 기술 문서를 주의 깊게 확인하여 메타데이터 최소화 혹은 보호가 존재하는지 살펴봐야 합니다. @@ -77,17 +86,23 @@ E2EE를 적용하더라도 여전히 서비스 제공 업체는 (일반적으로 '대중 감시'는 전체(혹은 상당한 부분의) 인구의 '행동, 다양한 활동 혹은 정보'를 모니터링하는 전방위적 노력을 뜻합니다.[^1] [2013년 에드워드 스노든이 폭로한 정부 프로그램](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)) 등을 가리키는 경우가 많습니다. 하지만, 기업이 정부 기관 대신 수행하거나, 기업 자체가 주도적으로 수행하기도 합니다. -!!! abstract "감시 지도" +
+

Atlas of Surveillance

- 감시 방법과, 미국의 특정 도시에서 어떻게 감시 체계를 운용하는지 자세히 알고 싶다면 [Electronic Frontier Foundation](https://www.eff.org/)의 [Atlas of Surveillance](https://atlasofsurveillance.org/)를 살펴보세요. - - 프랑스의 경우, 비영리 단체인 La Quadrature du Net에서 운영하는 [Technolopolice website](https://technopolice.fr/villes/)를 살펴볼 수 있습니다. +감시 방법과, 미국의 특정 도시에서 어떻게 감시 체계를 운용하는지 자세히 알고 싶다면 [Electronic Frontier Foundation](https://www.eff.org/)의 [Atlas of Surveillance](https://atlasofsurveillance.org/)를 살펴보세요. + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
정부는 테러 대응 및 범죄 예방에 필요한 수단으로 대중 감시 프로그램을 정당화하는 경우가 많습니다. 하지만 이는 분명한 인권 침해일 뿐만 아니라, 대중 감시는 소수 집단과 정치적 반체제 인사 등의 대상을 집중적으로 표적삼는 데에 가장 자주 사용됩니다. -!!! quote "ACLU: [*9.11 사건의 프라이버시 교훈: 대중 감시는 앞으로 나아갈 길이 아닙니다*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- 정보 당국은 에드워드 스노든의 정부 프로그램([PRISM](https://en.wikipedia.org/wiki/PRISM), [Upstream](https://en.wikipedia.org/wiki/Upstream_collection) 등) 폭로에 직면하여, NSA가 수년간 사실상 모든 미국인의 전화 통화 기록(누가 누구랑 통화하는지, 언제 통화하는지, 얼마나 오래 통화하는지)을 비밀리에 수집해 왔음을 인정했습니다. NSA가 이러한 정보를 매일 수집할 경우, 어떤 사람이 목사, 낙태 시술자, 중독 상담사, 자살 예방 상담사와 전화했는지 등 사람들의 삶과 관계성에 대해 극도로 민감한 정보를 파악할 수 있습니다. +정보 당국은 에드워드 스노든의 정부 프로그램([PRISM](https://en.wikipedia.org/wiki/PRISM), [Upstream](https://en.wikipedia.org/wiki/Upstream_collection) 등) 폭로에 직면하여, NSA가 수년간 사실상 모든 미국인의 전화 통화 기록(누가 누구랑 통화하는지, 언제 통화하는지, 얼마나 오래 통화하는지)을 비밀리에 수집해 왔음을 인정했습니다. NSA가 이러한 정보를 매일 수집할 경우, 어떤 사람이 목사, 낙태 시술자, 중독 상담사, 자살 예방 상담사와 전화했는지 등 사람들의 삶과 관계성에 대해 극도로 민감한 정보를 파악할 수 있습니다. + +
미국에서 대중 감시가 증가하고 있음에도 불구하고, 정부는 215조항과 같은 대중 감시 프로그램이 실제 범죄나 테러 음모를 저지하는 데 있어 '고유한 가치가 거의 없다'라는 사실을 발견했으며, 대부분의 노력은 FBI의 표적 감시 프로그램과 중복되는 것으로 나타났습니다.[^2] @@ -133,11 +148,14 @@ Twitter, Facebook 같은 플랫폼이 대중의 요구, 시장의 압력, 정부 검열 위협이 우려될 경우, [Tor](../advanced/tor-overview.md) 등의 기술을 사용해 검열을 우회할 수 있으며, [Matrix](../real-time-communication.md#element) 처럼 중앙 집중식 계정 시스템이 없는(플랫폼이 독단적으로 누군가의 계정을 차단할 수 없는) 검열 방지 통신 플랫폼을 지원할 수 있습니다. -!!! tip "도움말" +
+

Tip

- '검열 회피' 자체는 어렵지 않습니다. 하지만 여러분이 검열을 회피하고 있다는 사실을 감추는 것은 매우 문제가 될 수 있습니다. - - 여러분의 적대자가 가진 네트워크 감시 능력은 어느정도인지, 여러분 스스로 자신의 검열 회피 행동에 대해 타당한 구실을 가지고 있는지를 고려해야 합니다. 예를 들어, [암호화 DNS](../advanced/dns-overview.md#what-is-encrypted-dns)를 사용하면 기초적인 DNS 기반 검열 시스템을 우회할 수 있지만, 방문 중인 사이트가 ISP에 노출되는 것을 숨길 수는 없습니다. VPN/Tor를 사용하면 네트워크 관리자로부터 여러분이 어떤 사이트를 방문하는지 숨길 수 있지만, VPN/Tor 네트워크를 사용 중이라는 것 자체는 숨길 수 없습니다. (Obfs4proxy, Meek, Shadowsocks 등) Pluggable transports로는 일반적인 VPN/Tor 프로토콜 차단 방화벽을 우회할 수는 있지만, 프로빙(Probing)이나 [심층 패킷 검사(Deep Packet Inspection)](https://en.wikipedia.org/wiki/Deep_packet_inspection) 같은 방법을 사용하면 우회 시도를 탐지할 수 있습니다. +'검열 회피' 자체는 어렵지 않습니다. 하지만 여러분이 검열을 회피하고 있다는 사실을 감추는 것은 매우 문제가 될 수 있습니다. + +여러분의 적대자가 가진 네트워크 감시 능력은 어느정도인지, 여러분 스스로 자신의 검열 회피 행동에 대해 타당한 구실을 가지고 있는지를 고려해야 합니다. 예를 들어, [암호화 DNS](../advanced/dns-overview.md#what-is-encrypted-dns)를 사용하면 기초적인 DNS 기반 검열 시스템을 우회할 수 있지만, 방문 중인 사이트가 ISP에 노출되는 것을 숨길 수는 없습니다. VPN/Tor를 사용하면 네트워크 관리자로부터 여러분이 어떤 사이트를 방문하는지 숨길 수 있지만, VPN/Tor 네트워크를 사용 중이라는 것 자체는 숨길 수 없습니다. (Obfs4proxy, Meek, Shadowsocks 등) Pluggable transports로는 일반적인 VPN/Tor 프로토콜 차단 방화벽을 우회할 수는 있지만, 프로빙(Probing)이나 [심층 패킷 검사(Deep Packet Inspection)](https://en.wikipedia.org/wiki/Deep_packet_inspection) 같은 방법을 사용하면 우회 시도를 탐지할 수 있습니다. + +
검열을 우회할 경우 발생할 수 있는 위험 및 결과, 적대자의 능력을 항상 고려해야 합니다. 사용할 소프트웨어를 신중하게 선택하고, 적발될 경우를 대비한 백업 계획을 세워야 합니다. diff --git a/i18n/ko/basics/multi-factor-authentication.md b/i18n/ko/basics/multi-factor-authentication.md index fb875fa4..9edaa2b5 100644 --- a/i18n/ko/basics/multi-factor-authentication.md +++ b/i18n/ko/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning "경고" +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/ko/basics/passwords-overview.md b/i18n/ko/basics/passwords-overview.md index 9c87d2eb..93748c50 100644 --- a/i18n/ko/basics/passwords-overview.md +++ b/i18n/ko/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "비밀번호 입문" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: 강력한 비밀번호를 만들고 계정을 안전하게 보호하는 몇 가지 방법을 알려드립니다. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- '비밀번호'는 우리의 일상 디지털 생활에 있어서 필수적인 요소입니다. 우리는 비밀번호를 통해 계정, 기기, 개인 정보를 보호합니다. 간혹 비밀번호는 우리의 개인 정보를 노리는 공격자와 우리 사이의 유일한 방어 수단임에도 불구하고, 사람들은 비밀번호의 중요성을 심각하게 생각하지 않아 쉽게 추측되거나 무차별 대입 공격에 취약한 비밀번호를 사용하는 경우가 흔합니다. @@ -26,9 +26,12 @@ description: 강력한 비밀번호를 만들고 계정을 안전하게 보호 비밀번호 관리자 내에서 관리하는 비밀번호 등, 직접 외울 필요가 없는 비밀번호는 여러분의 [위협 모델](threat-modeling.md)에 따라 중요한 계정(특히 다중 인증을 사용하지 않는 계정)은 아직 공개되지 않은 데이터 유출이 발생했을 경우를 대비해 몇 달마다 비밀번호를 변경할 것을 권장합니다. 대부분의 비밀번호 관리자는 비밀번호 만료일 설정 기능을 제공하기 때문에 더욱 관리하기 쉽습니다. -!!! tip "데이터 유출 확인" +
+

Checking for data breaches

- 비밀번호 관리자에서 유출된 비밀번호 확인 기능을 제공하는 경우, 반드시 해당 기능을 사용해 데이터 유출로 인해 노출됐을 가능성이 있는 비밀번호는 즉시 변경하세요. 혹은 [뉴스 애그리게이터](../news-aggregators.md)를 이용해 [내가 겪은 최근 유출 사례(Have I Been Pwned's Latest Breaches feed)](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches)를 팔로우 해두는 방법도 있습니다. +비밀번호 관리자에서 유출된 비밀번호 확인 기능을 제공하는 경우, 반드시 해당 기능을 사용해 데이터 유출로 인해 노출됐을 가능성이 있는 비밀번호는 즉시 변경하세요. 혹은 [뉴스 애그리게이터](../news-aggregators.md)를 이용해 [내가 겪은 최근 유출 사례(Have I Been Pwned's Latest Breaches feed)](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches)를 팔로우 해두는 방법도 있습니다. + +
## 강력한 비밀번호 만들기 @@ -48,9 +51,12 @@ description: 강력한 비밀번호를 만들고 계정을 안전하게 보호 실물 주사위를 사용해 다이스웨어 패스프레이즈를 생성하는 방법은 다음과 같습니다: -!!! note "참고" +
+

Note

- 본 내용에서는 [EEF 대규모 단어 목록](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)를 활용해 단어당 5번씩 주사위를 굴려 패스프레이즈를 생성한다고 가정합니다. 다른 단어 목록을 사용할 경우에는 주사위를 굴려야 하는 횟수 혹은 동일한 엔트로피를 달성하기 위해 필요한 단어의 양이 달라질 수 있습니다. +본 내용에서는 [EEF 대규모 단어 목록](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)를 활용해 단어당 5번씩 주사위를 굴려 패스프레이즈를 생성한다고 가정합니다. 다른 단어 목록을 사용할 경우에는 주사위를 굴려야 하는 횟수 혹은 동일한 엔트로피를 달성하기 위해 필요한 단어의 양이 달라질 수 있습니다. + +
1. 6면체 주사위를 5번 굴려서 각 주사위를 굴릴 때마다 숫자를 적습니다. @@ -60,31 +66,37 @@ description: 강력한 비밀번호를 만들고 계정을 안전하게 보호 4. 원하는 개수의 단어를 얻을 때까지 이 과정을 반복하고, 각 단어는 공백으로 구분합니다. -!!! warning "중요" +
+

Important

- 단어 조합이 마음에 들지 않는다는 이유로 단어를 다시 선택해서는 **안 됩니다**. 패스프레이즈 생성 과정은 완전히 랜덤으로 진행되어야 합니다. +단어 조합이 마음에 들지 않는다는 이유로 단어를 다시 선택해서는 **안 됩니다**. 패스프레이즈 생성 과정은 완전히 랜덤으로 진행되어야 합니다. + +
실물 주사위가 없거나 사용하고 싶지 않은 경우, 비밀번호 관리자에 내장된 비밀번호 생성기를 사용하면 됩니다. 대부분의 비밀번호 관리자는 일반적인 패스워드 방식뿐만 아니라 다이스웨어 패스프레이즈도 지원합니다. 저희는 원본 목록과 동일한 수준의 보안을 제공하면서 외우기 쉬운 단어로 이루어진 [EEF 대규모 단어 목록](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)을 활용해 다이스웨어 패스프레이즈를 생성할 것을 권장드립니다. 영어 외 언어로 패스프레이즈를 생성하고자 하시는 경우 [다른 언어 단어 목록](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline)도 있습니다. -??? note "다이스웨어 패스프레이즈의 엔트로피 및 강도" +
+Explanation of entropy and strength of diceware passphrases - 다이스웨어 패스프레이즈의 강도를 알려드리기 위해, 앞서 언급한 7 단어 패스프레이즈(`viewable fastness reluctant squishy seventeen shown pencil`) 및 [EEF 대규모 암호 목록](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)을 예로 들어보겠습니다. - - 다이스웨어 패스프레이즈 강도를 결정하는 지표 한 가지는 엔트로피의 크기입니다. 다이스웨어 패스프레이즈의 단어당 엔트로피는 $\text{log}_2(\text{WordsInList})$, 전체 패스프레이즈 엔트로피는 $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$로 계산됩니다. - - 따라서, 앞서 언급한 목록 내 각 단어는 ~12.9비트 엔트로피($\text{log}_2(7776)$)를, 7 단어 패스프레이즈는 ~90.47비트 엔트로피($\text{log}_2(7776^7)$)를 갖습니다. - - [EEF 대규모 단어 목록](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)에 포함된 단어의 수는 7776개입니다. 만들어질 수 있는 패스프레이즈의 양을 계산하면 $\text{WordsInList}^\text{WordsInPhrase}$, 즉 $7776^7$입니다. - - 종합하면, [EEF 대규모 단어 목록](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)을 활용해 생성한 7 단어 패스프레이즈는 1,719,070,799,748,422,500,000,000,000개 경우의 수 중 하나입니다. - - 평균적으로, 누군가의 패스프레이즈를 알아맞히려면 가능한 모든 조합의 50%를 시도해야만 합니다. 이 점을 고려하여 계산해보면 공격자가 만약 초당 1,000,000,000,000번 시도한다고 가정해도 여러분의 패스프레이즈를 알아맞히는 데에는 27,255,689년이 걸립니다. 심지어 이는 다음 조건을 충족하는 경우의 이야기입니다: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - 여러분이 다이스웨어 방식을 사용했다는 점을 공격자가 알고 있습니다. - - 여러분이 어떤 단어 목록을 활용했는지를 공격자가 알고 있습니다. - - 여러분의 패스프레이즈 단어 개수를 공격자가 알고 있습니다. +다이스웨어 패스프레이즈 강도를 결정하는 지표 한 가지는 엔트로피의 크기입니다. 다이스웨어 패스프레이즈의 단어당 엔트로피는 $\text{log}_2(\text{WordsInList})$, 전체 패스프레이즈 엔트로피는 $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$로 계산됩니다. + +따라서, 앞서 언급한 목록 내 각 단어는 ~12.9비트 엔트로피($\text{log}_2(7776)$)를, 7 단어 패스프레이즈는 ~90.47비트 엔트로피($\text{log}_2(7776^7)$)를 갖습니다. + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. 만들어질 수 있는 패스프레이즈의 양을 계산하면 $\text{WordsInList}^\text{WordsInPhrase}$, 즉 $7776^7$입니다. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +평균적으로, 누군가의 패스프레이즈를 알아맞히려면 가능한 모든 조합의 50%를 시도해야만 합니다. 이 점을 고려하여 계산해보면 공격자가 만약 초당 1,000,000,000,000번 시도한다고 가정해도 여러분의 패스프레이즈를 알아맞히는 데에는 27,255,689년이 걸립니다. 심지어 이는 다음 조건을 충족하는 경우의 이야기입니다: + +- 여러분이 다이스웨어 방식을 사용했다는 점을 공격자가 알고 있습니다. +- 여러분이 어떤 단어 목록을 활용했는지를 공격자가 알고 있습니다. +- 여러분의 패스프레이즈 단어 개수를 공격자가 알고 있습니다. + +
요약하자면, 기억하기 쉬우면서*도* 매우 강력한 비밀번호가 필요할 경우에는 다이스웨어 패스프레이즈가 최선의 선택입니다. @@ -98,13 +110,16 @@ description: 강력한 비밀번호를 만들고 계정을 안전하게 보호 [권장 비밀번호 관리자 목록](../passwords.md ""){.md-button} -!!! warning "비밀번호와 TOTP 토큰을 하나의 비밀번호 관리자에 저장하지 마세요" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- TOTP 코드 [다중 인증](../multi-factor-authentication.md) 방식을 사용하는 경우, TOTP 코드는 [별도 앱](../multi-factor-authentication.md#authenticator-apps)에서 보관하는 것이 가장 좋은 방법입니다. - - TOTP 토큰과 비밀번호를 한 곳에서 관리하면 편리하지만, 만약 공격자가 여러분의 비밀번호 관리자에 접근 가능할 경우 다중 인증은 무용지물이 됩니다. - - 일회용 복구 코드 또한 비밀번호 관리자에 저장하지 말 것을 권장드립니다. 이러한 정보는 오프라인 저장 장치의 암호화 컨테이너 등에 별도로 보관해야 합니다. +TOTP 코드 [다중 인증](../multi-factor-authentication.md) 방식을 사용하는 경우, TOTP 코드는 [별도 앱](../multi-factor-authentication.md#authenticator-apps)에서 보관하는 것이 가장 좋은 방법입니다. + +TOTP 토큰과 비밀번호를 한 곳에서 관리하면 편리하지만, 만약 공격자가 여러분의 비밀번호 관리자에 접근 가능할 경우 다중 인증은 무용지물이 됩니다. + +일회용 복구 코드 또한 비밀번호 관리자에 저장하지 말 것을 권장드립니다. 이러한 정보는 오프라인 저장 장치의 암호화 컨테이너 등에 별도로 보관해야 합니다. + +
### 백업 diff --git a/i18n/ko/basics/vpn-overview.md b/i18n/ko/basics/vpn-overview.md index d3909b57..7a8cd256 100644 --- a/i18n/ko/basics/vpn-overview.md +++ b/i18n/ko/basics/vpn-overview.md @@ -1,6 +1,6 @@ --- -meta_title: "VPN은 어떤 방식으로 프라이버시를 보호하나요? VPN 개요 - Privacy Guides" -title: VPN 개요 +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note "참고" +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/ko/os/android-overview.md b/i18n/ko/os/android-overview.md index 33f2b8b5..1bedc444 100644 --- a/i18n/ko/os/android-overview.md +++ b/i18n/ko/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Android 개요 +title: Android Overview icon: simple/android -description: Android는 강력한 보안 및 보호 기능을 갖춘 오픈 소스 운영 체제로, 휴대폰에 있어서 최고의 선택입니다. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android 로고](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Android 13: [Exodus](https://exodus-privacy.eu.org/)는 유사한 용도의 앱을 비교하는 데에 유용합니다. 앱이 과도한 권한을 요구하고 광고 및 분석 기능이 많다면, 해당 앱은 피해야 할지도 모릅니다. Privacy Guides는 각 항목의 차이를 보지 않고 **단순히 총합 수치로 비교**하기보다는 각각의 추적기와 그 설명을 하나씩 읽어보실 것을 권장드립니다. -!!! warning "경고" +
+

Warning

- 앱의 상당 부분이 웹 기반 서비스로 이루어진 경우, 추적은 서버 측에서 이루어질 수도 있습니다. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/)은 '추적기 없음'이라 표시되어 있지만, 사이트 전반에서 사용자의 관심사와 행동을 추적하는 것은 틀림없습니다. 앱이 광고 업계에서 제작한 표준 광고 라이브러리 외의 수단을 사용함으로써 탐지에서 벗어나는 것도 있을 수 있는 일이지만, 가능성은 낮습니다. +앱의 상당 부분이 웹 기반 서비스로 이루어진 경우, 추적은 서버 측에서 이루어질 수도 있습니다. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/)은 '추적기 없음'이라 표시되어 있지만, 사이트 전반에서 사용자의 관심사와 행동을 추적하는 것은 틀림없습니다. 앱이 광고 업계에서 제작한 표준 광고 라이브러리 외의 수단을 사용함으로써 탐지에서 벗어나는 것도 있을 수 있는 일이지만, 가능성은 낮습니다. -!!! note "참고" +
- [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) 처럼 프라이버시 친화적인 앱에서도 [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/) 등의 일부 추적기가 표시될 수 있습니다. 해당 라이브러리는 앱에서 [푸시 알림](https://ko.wikipedia.org/wiki/%ED%91%B8%EC%8B%9C_%EA%B8%B0%EB%B2%95)을 제공할 수 있는 [Firebase 클라우드 메시징(FCM)](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging)이 포함되어 있습니다. Bitwarden이 바로 [이러한 경우](https://fosstodon.org/@bitwarden/109636825700482007)에 해당합니다. Bitwarden에서 Google Firebase Analytics 트래커가 발견됐다는 사실이 Bitwarden에서 Google Firebase Analytics의 모든 분석 기능을 사용한다는 것을 의미하지는 않습니다. +
+

Note

+ +[Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) 처럼 프라이버시 친화적인 앱에서도 [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/) 등의 일부 추적기가 표시될 수 있습니다. 해당 라이브러리는 앱에서 [푸시 알림](https://ko.wikipedia.org/wiki/%ED%91%B8%EC%8B%9C_%EA%B8%B0%EB%B2%95)을 제공할 수 있는 [Firebase 클라우드 메시징(FCM)](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging)이 포함되어 있습니다. Bitwarden이 바로 [이러한 경우](https://fosstodon.org/@bitwarden/109636825700482007)에 해당합니다. Bitwarden에서 Google Firebase Analytics 트래커가 발견됐다는 사실이 Bitwarden에서 Google Firebase Analytics의 모든 분석 기능을 사용한다는 것을 의미하지는 않습니다. + +
## Privacy Features diff --git a/i18n/ko/os/ios-overview.md b/i18n/ko/os/ios-overview.md index eb83324f..2b23e7f5 100644 --- a/i18n/ko/os/ios-overview.md +++ b/i18n/ko/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning "경고" +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/ko/os/macos-overview.md b/i18n/ko/os/macos-overview.md index 648597af..ce54d939 100644 --- a/i18n/ko/os/macos-overview.md +++ b/i18n/ko/os/macos-overview.md @@ -1,5 +1,5 @@ --- -title: macOS 개요 +title: macOS Overview icon: material/apple-finder description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning "경고" +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning "경고" +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/ko/os/qubes-overview.md b/i18n/ko/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/ko/os/qubes-overview.md +++ b/i18n/ko/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/ku-IQ/advanced/payments.md b/i18n/ku-IQ/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/ku-IQ/advanced/payments.md +++ b/i18n/ku-IQ/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/ku-IQ/advanced/tor-overview.md b/i18n/ku-IQ/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/ku-IQ/advanced/tor-overview.md +++ b/i18n/ku-IQ/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/ku-IQ/basics/account-creation.md b/i18n/ku-IQ/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/ku-IQ/basics/account-creation.md +++ b/i18n/ku-IQ/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/ku-IQ/basics/common-misconceptions.md b/i18n/ku-IQ/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/ku-IQ/basics/common-misconceptions.md +++ b/i18n/ku-IQ/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/ku-IQ/basics/common-threats.md b/i18n/ku-IQ/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/ku-IQ/basics/common-threats.md +++ b/i18n/ku-IQ/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/ku-IQ/basics/multi-factor-authentication.md b/i18n/ku-IQ/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/ku-IQ/basics/multi-factor-authentication.md +++ b/i18n/ku-IQ/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/ku-IQ/basics/passwords-overview.md b/i18n/ku-IQ/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/ku-IQ/basics/passwords-overview.md +++ b/i18n/ku-IQ/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/ku-IQ/basics/vpn-overview.md b/i18n/ku-IQ/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/ku-IQ/basics/vpn-overview.md +++ b/i18n/ku-IQ/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/ku-IQ/os/android-overview.md b/i18n/ku-IQ/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/ku-IQ/os/android-overview.md +++ b/i18n/ku-IQ/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/ku-IQ/os/ios-overview.md b/i18n/ku-IQ/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/ku-IQ/os/ios-overview.md +++ b/i18n/ku-IQ/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/ku-IQ/os/macos-overview.md b/i18n/ku-IQ/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/ku-IQ/os/macos-overview.md +++ b/i18n/ku-IQ/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/ku-IQ/os/qubes-overview.md b/i18n/ku-IQ/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/ku-IQ/os/qubes-overview.md +++ b/i18n/ku-IQ/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/nl/advanced/payments.md b/i18n/nl/advanced/payments.md index 1a593c4d..9c7e071b 100644 --- a/i18n/nl/advanced/payments.md +++ b/i18n/nl/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Privé betalingen +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ Dit zijn meestal goede opties voor online terugkerende betalingen/abonnementen, Cryptocurrencies zijn een digitale vorm van valuta die is ontworpen om te werken zonder centrale autoriteiten zoals een overheid of bank. Hoewel *sommige* cryptocurrency-projecten je in staat stellen online privétransacties te verrichten, gebruiken vele een openbare blockchain die geen enkele transactieprivacy biedt. Cryptovaluta's zijn ook zeer volatiele assets, wat betekent dat hun waarde op elk moment snel en aanzienlijk kan veranderen. Als zodanig raden we over het algemeen niet aan om cryptocurrency te gebruiken als een lange termijn opslag van waarde. Als je besluit cryptocurrency online te gebruiken, zorg er dan voor dat je vooraf volledig op de hoogte bent van de privacy-aspecten ervan, en investeer alleen bedragen die niet rampzalig zijn om te verliezen. -!!! danger "Gevaar" +
+

Danger

- De overgrote meerderheid van de cryptocurrencies werkt op een **publieke** blockchain, wat betekent dat elke transactie publiekelijk bekend is. Dit omvat zelfs de meeste bekende cryptocurrencies zoals Bitcoin en Ethereum. Transacties met deze cryptocurrencies mogen niet als privé worden beschouwd en zullen jouw anonimiteit niet beschermen. - - Daarnaast zijn veel of misschien niet de meeste cryptovaluta's oplichters. Voer transacties zorgvuldig uit met alleen projecten die je vertrouwt. +De overgrote meerderheid van de cryptocurrencies werkt op een **publieke** blockchain, wat betekent dat elke transactie publiekelijk bekend is. Dit omvat zelfs de meeste bekende cryptocurrencies zoals Bitcoin en Ethereum. Transacties met deze cryptocurrencies mogen niet als privé worden beschouwd en zullen jouw anonimiteit niet beschermen. + +Daarnaast zijn veel of misschien niet de meeste cryptovaluta's oplichters. Voer transacties zorgvuldig uit met alleen projecten die je vertrouwt. + +
### Privacy Coins diff --git a/i18n/nl/advanced/tor-overview.md b/i18n/nl/advanced/tor-overview.md index 5d63a87a..f56b099d 100644 --- a/i18n/nl/advanced/tor-overview.md +++ b/i18n/nl/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/nl/basics/account-creation.md b/i18n/nl/basics/account-creation.md index 07e4be87..ccd05f93 100644 --- a/i18n/nl/basics/account-creation.md +++ b/i18n/nl/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Hoe maak je anoniem een account aan op het internet = Privacy Guides" -title: "Het aanmaken van accounts" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: Online accounts aanmaken is bijna een internetbehoefte, neem deze stappen om ervoor te zorgen dat je privé blijft. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Vaak melden mensen zich aan voor diensten zonder na te denken. Misschien is het een streamingdienst zodat je die nieuwe show kunt bekijken waar iedereen het over heeft, of een account waarmee je korting krijgt op uw favoriete fastfood zaak. Wat het geval ook is, je moet nu en later rekening houden met de implicaties voor jouw gegevens. @@ -29,9 +29,12 @@ Er zijn meestal meerdere manieren om een account aan te maken, elk met hun eigen De meest gebruikelijke manier om een nieuwe account aan te maken is met een e-mailadres en wachtwoord. Wanneer je deze methode gebruikt, moet je een wachtwoord manager gebruiken en de best practices [volgen](passwords-overview.md) met betrekking tot wachtwoorden. -!!! tip +
+

Tip

- Je kunt jouw wachtwoord manager ook gebruiken om andere verificatiemethoden te organiseren! Voeg gewoon het nieuwe item toe en vul de juiste velden in, u kunt notities toevoegen voor zaken als beveiligingsvragen of een back-up sleutel. +Je kunt jouw wachtwoord manager ook gebruiken om andere verificatiemethoden te organiseren! Voeg gewoon het nieuwe item toe en vul de juiste velden in, u kunt notities toevoegen voor zaken als beveiligingsvragen of een back-up sleutel. + +
Je bent verantwoordelijk voor het beheer van jouw inloggegevens. Voor extra beveiliging kunt je [MFA](multi-factor-authentication.md) instellen op jouw accounts. diff --git a/i18n/nl/basics/common-misconceptions.md b/i18n/nl/basics/common-misconceptions.md index b24e31bc..5aed57be 100644 --- a/i18n/nl/basics/common-misconceptions.md +++ b/i18n/nl/basics/common-misconceptions.md @@ -75,20 +75,23 @@ Dus, hoe zou dit eruit zien? Een van de duidelijkste dreigingsmodellen is een model waarbij mensen *weten wie je bent* en een model waarbij ze dat niet weten. Er zullen altijd situaties zijn waarin je je wettelijke naam moet opgeven en er zijn situaties waarin je dat niet hoeft te doen. -1. **Bekende identiteit** - Een bekende identiteit wordt gebruikt voor zaken waarbij je jouw naam moet opgeven. Er zijn veel juridische documenten en contracten waar een wettelijke identiteit vereist is. Dit kan variëren van het openen van een bankrekening, het ondertekenen van een huurovereenkomst, het verkrijgen van een paspoort, douaneaangiften bij het importeren van spullen, of op andere manieren omgaan met de overheid. Deze dingen zullen meestal leiden tot referenties zoals creditcards, kredietwaardigheidscontroles, rekeningnummers en mogelijk fysieke adressen. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We raden niet aan om een VPN of Tor voor een van deze dingen te gebruiken, omdat je identiteit al op andere manieren bekend is. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - Wanneer je online winkelt, kan het gebruik van een [pakketkluis](https://en.wikipedia.org/wiki/Parcel_locker) helpen om jouw fysieke adres privé te houden. +
+

Tip

+ +Wanneer je online winkelt, kan het gebruik van een [pakketkluis](https://en.wikipedia.org/wiki/Parcel_locker) helpen om jouw fysieke adres privé te houden. + +
2. **Onbekende identiteit** - Een onbekende identiteit kan een stabiel pseudoniem zijn dat je regelmatig gebruikt. Het is niet anoniem omdat het niet verandert. Als je deel uitmaakt van een online gemeenschap, wilt je misschien een identiteit behouden dat anderen kennen. Dit pseudoniem is niet anoniem omdat - indien lang genoeg gevolgd - details over de eigenaar verdere informatie kunnen onthullen, zoals de manier waarop hij of zij schrijft, algemene kennis over interessante onderwerpen, enz. - Je kunt hiervoor eventueel een VPN gebruiken om jouw IP-adres te maskeren. Financiële transacties zijn moeilijker te maskeren: je kunt hier overwegen anonieme crypto valuta te gebruiken, zoals [Monero](https://www.getmonero.org/). Het gebruik van altcoin-shifting kan ook helpen om te verbergen waar jouw valuta vandaan komt. Doorgaans vereisen exchanges dat KYC (know your customer/ ken jouw klant) wordt ingevuld voordat zij u toestaan fiat valuta zoals euro's en dollars om te wisselen in een of andere crypto valuta. Lokale meet-ups kunnen ook een oplossing zijn; deze zijn echter vaak duurder en vereisen soms ook KYC. +Je kunt hiervoor eventueel een VPN gebruiken om jouw IP-adres te maskeren. Financiële transacties zijn moeilijker te maskeren: je kunt hier overwegen anonieme crypto valuta te gebruiken, zoals [Monero](https://www.getmonero.org/). Het gebruik van altcoin-shifting kan ook helpen om te verbergen waar jouw valuta vandaan komt. Doorgaans vereisen exchanges dat KYC (know your customer/ ken jouw klant) wordt ingevuld voordat zij u toestaan fiat valuta zoals euro's en dollars om te wisselen in een of andere crypto valuta. Lokale meet-ups kunnen ook een oplossing zijn; deze zijn echter vaak duurder en vereisen soms ook KYC. 3. **Anonieme identiteit** - zelfs met ervaring, anonieme identiteiten zijn moeilijk te behouden voor lange perioden. Deze identiteiten horen een korte levensduur te hebben, en dienen regelmatig gerouleerd te worden. - Het gebruik van Tor kan hierbij helpen. Ook moet worden opgemerkt dat een grotere anonimiteit mogelijk is door asynchrone communicatie: Real-time communicatie is kwetsbaar voor analyse van typpatronen (d.w.z. meer dan een alinea tekst, verspreid op een forum, via e-mail, enz.) +Het gebruik van Tor kan hierbij helpen. Ook moet worden opgemerkt dat een grotere anonimiteit mogelijk is door asynchrone communicatie: Real-time communicatie is kwetsbaar voor analyse van typpatronen (d.w.z. meer dan een alinea tekst, verspreid op een forum, via e-mail, enz.) [^1]: Een opmerkelijk voorbeeld hiervan is het incident van [2021, waarbij onderzoekers van de Universiteit van Minnesota drie kwetsbaarheden in het Linux-kernelontwikkelingsproject](https://cse.umn.edu/cs/linux-incident)introduceerden. diff --git a/i18n/nl/basics/common-threats.md b/i18n/nl/basics/common-threats.md index 87f3a9ae..8843d4f9 100644 --- a/i18n/nl/basics/common-threats.md +++ b/i18n/nl/basics/common-threats.md @@ -35,19 +35,25 @@ Wat de beveiliging van toepassingen betreft, weten we over het algemeen niet (en Om de potentiële schade van kwaadaardige software tot een minimum te beperken, moet u beveiliging door compartimentering toepassen. Dit kan in de vorm van het gebruik van verschillende computers voor verschillende taken, het gebruik van virtuele machines om verschillende groepen van gerelateerde toepassingen te scheiden, of het gebruik van een veilig besturingssysteem met een sterke nadruk op sandboxing van toepassingen en verplichte toegangscontrole. -!!! tip +
+

Tip

- Mobiele besturingssystemen zijn over het algemeen veiliger dan desktopbesturingssystemen als het gaat om sandboxing van toepassingen. - - Apps kunnen geen root-toegang krijgen en hebben alleen toegang tot systeembronnen die je hen verleent. Desktop besturingssystemen lopen over het algemeen achter op het gebied van goede sandboxing. Chrome OS heeft vergelijkbare sandboxing-eigenschappen als Android, en macOS heeft volledige controle over systeemtoestemmingen en opt-in (voor ontwikkelaars) sandboxing voor applicaties, maar deze besturingssystemen geven wel identificerende informatie door aan hun respectieve OEM's. Linux heeft de neiging geen informatie door te geven aan systeemverkopers, maar het heeft een slechte bescherming tegen exploits en kwaadaardige apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobiele besturingssystemen zijn over het algemeen veiliger dan desktopbesturingssystemen als het gaat om sandboxing van toepassingen. + +Apps kunnen geen root-toegang krijgen en hebben alleen toegang tot systeembronnen die je hen verleent. Desktop besturingssystemen lopen over het algemeen achter op het gebied van goede sandboxing. Chrome OS heeft vergelijkbare sandboxing-eigenschappen als Android, en macOS heeft volledige controle over systeemtoestemmingen en opt-in (voor ontwikkelaars) sandboxing voor applicaties, maar deze besturingssystemen geven wel identificerende informatie door aan hun respectieve OEM's. Linux heeft de neiging geen informatie door te geven aan systeemverkopers, maar het heeft een slechte bescherming tegen exploits en kwaadaardige apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Gerichte aanvallen Gerichte aanvallen tegen een specifieke gebruiker zijn moeilijker aan te pakken. Gangbare aanvalsmethoden zijn het verzenden van schadelijke documenten via e-mails, het uitbuiten van kwetsbaarheden in de browser en het besturingssysteem, en fysieke aanvallen. Als dit voor je een punt van zorg is, moet je mogelijk meer geavanceerde strategieën ter beperking van bedreigingen toepassen. -!!! tip +
+

Tip

- **Webbrowsers**, **e-mailclients**, en **kantoorapplicaties** voeren standaard onvertrouwde code uit die je door derden wordt toegestuurd. Het draaien van meerdere virtuele machines om toepassingen als deze te scheiden van uw hostsysteem en van elkaar is een techniek die je kunt gebruiken om te voorkomen dat een exploit in deze toepassingen de rest van jouw systeem aantast. Technologieën als Qubes OS of Microsoft Defender Application Guard op Windows bieden bijvoorbeeld handige methoden om dit naadloos te doen. +**Webbrowsers**, **e-mailclients**, en **kantoorapplicaties** voeren standaard onvertrouwde code uit die je door derden wordt toegestuurd. Het draaien van meerdere virtuele machines om toepassingen als deze te scheiden van uw hostsysteem en van elkaar is een techniek die je kunt gebruiken om te voorkomen dat een exploit in deze toepassingen de rest van jouw systeem aantast. Technologieën als Qubes OS of Microsoft Defender Application Guard op Windows bieden bijvoorbeeld handige methoden om dit naadloos te doen. + +
Als je zich zorgen maakt over **fysieke aanvallen** moet je een besturingssysteem gebruiken met een veilige geverifieerde opstartimplementatie, zoals Android, iOS, macOS, [Windows (met TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Je moet er ook voor zorgen dat jouw schijf versleuteld is, en dat het besturingssysteem een TPM of Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) of [Element](https://developers.google.com/android/security/android-ready-se) gebruikt voor het beperken van de snelheid waarmee pogingen worden gedaan om de wachtwoordzin voor de versleuteling in te voeren. Je moet voorkomen dat je jouw computer deelt met mensen die je niet vertrouwt, omdat de meeste desktopbesturingssystemen gegevens niet afzonderlijk per gebruiker versleutelen. @@ -61,13 +67,16 @@ Het voor de hand liggende probleem hierbij is dat de dienstverlener (of een hack Gelukkig kan end-to-end encryptie dit probleem verlichten door de communicatie tussen jou en de gewenste ontvangers te versleutelen voordat ze zelfs maar naar de server worden verzonden. De vertrouwelijkheid van jouw berichten is gewaarborgd, zolang de dienstverlener geen toegang heeft tot de particuliere sleutels van beide partijen. -!!! note "Opmerking op webgebaseerde encryptie" +
+

Note on Web-based Encryption

- In de praktijk varieert de doeltreffendheid van verschillende implementaties van end-to-end encryptie. Toepassingen zoals [Signal](../real-time-communication.md#signal) draaien op het toestel zelf, en elke kopie van de toepassing is hetzelfde voor verschillende installaties. Als de dienstverlener een backdoor in zijn applicatie zou aanbrengen om te proberen jouw privé-sleutels te stelen, zou dat later met reverse engineering kunnen worden opgespoord. - - Anderzijds vertrouwen webgebaseerde end-to-end encryptie-implementaties, zoals Proton Mail's webmail of Bitwarden's web vault, erop dat de server dynamisch JavaScript-code naar de browser stuurt om cryptografische operaties uit te voeren. Een kwaadwillende server zou zich op een specifieke gebruiker kunnen richten en hem kwaadwillige JavaScript-code sturen om zijn encryptiesleutel te stelen, en het zou uiterst moeilijk zijn voor de gebruiker om zoiets ooit op te merken. Zelfs als de gebruiker de poging om zijn sleutel te stelen opmerkt, zou het ongelooflijk moeilijk zijn om te bewijzen dat het de provider is die dit probeert, omdat de server ervoor kan kiezen om verschillende webclients aan verschillende gebruikers aan te bieden. - - Wanneer je vertrouwt op end-to-end encryptie, moet je daarom waar mogelijk native applicaties verkiezen boven web clients. +In de praktijk varieert de doeltreffendheid van verschillende implementaties van end-to-end encryptie. Toepassingen zoals [Signal](../real-time-communication.md#signal) draaien op het toestel zelf, en elke kopie van de toepassing is hetzelfde voor verschillende installaties. Als de dienstverlener een backdoor in zijn applicatie zou aanbrengen om te proberen jouw privé-sleutels te stelen, zou dat later met reverse engineering kunnen worden opgespoord. + +Anderzijds vertrouwen webgebaseerde end-to-end encryptie-implementaties, zoals Proton Mail's webmail of Bitwarden's web vault, erop dat de server dynamisch JavaScript-code naar de browser stuurt om cryptografische operaties uit te voeren. Een kwaadwillende server zou zich op een specifieke gebruiker kunnen richten en hem kwaadwillige JavaScript-code sturen om zijn encryptiesleutel te stelen, en het zou uiterst moeilijk zijn voor de gebruiker om zoiets ooit op te merken. Zelfs als de gebruiker de poging om zijn sleutel te stelen opmerkt, zou het ongelooflijk moeilijk zijn om te bewijzen dat het de provider is die dit probeert, omdat de server ervoor kan kiezen om verschillende webclients aan verschillende gebruikers aan te bieden. + +Wanneer je vertrouwt op end-to-end encryptie, moet je daarom waar mogelijk native applicaties verkiezen boven web clients. + +
Zelfs met end-to-end encryptie kunnen dienstverleners je nog steeds profileren op basis van **metadata**, die doorgaans niet beschermd zijn. Hoewel de dienstverlener jouw berichten niet kan lezen om te zien wat je zegt, kan hij wel observeren met wie je praat, hoe vaak je hen berichten stuurt en op welke tijden je doorgaans actief bent. Bescherming van metadata is tamelijk ongewoon, en je zou goed moeten opletten in de technische documentatie van de software die je gebruikt om te zien of er überhaupt sprake is van minimalisering of bescherming van metadata, als dat voor je een punt van zorg is. @@ -77,17 +86,23 @@ Zelfs met end-to-end encryptie kunnen dienstverleners je nog steeds profileren o Massasurveillance is een poging om een groot deel van of een gehele bevolking te surveilleren. Het verwijst vaak naar overheidsprogramma's, zoals de programma's [die in 2013 door Edward Snowden werden onthuld](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- Als je meer wilt weten over bewakingsmethoden en hoe die in jouw stad worden toegepast, kunt je ook de [Atlas of Surveillance](https://atlasofsurveillance.org/) van de [Electronic Frontier Foundation](https://www.eff.org/) bekijken. - - In Frankrijk kunt u een kijkje nemen op de [Technolopolice website](https://technopolice.fr/villes/) die wordt onderhouden door de non-profit vereniging La Quadrature du Net. +Als je meer wilt weten over bewakingsmethoden en hoe die in jouw stad worden toegepast, kunt je ook de [Atlas of Surveillance](https://atlasofsurveillance.org/) van de [Electronic Frontier Foundation](https://www.eff.org/) bekijken. + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Regeringen rechtvaardigen massasurveillanceprogramma's vaak als noodzakelijke middelen om terrorisme te bestrijden en misdaad te voorkomen. Het schendt echter de mensenrechten en wordt meestal gebruikt om zich buitenproportioneel te richten op onder andere minderheidsgroepen en politieke dissidenten. -!!! quote "ACLU: [*De privacyles van 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Het omzeilen van de censuur zelf is betrekkelijk eenvoudig, maar het feit dat je het censuursysteem omzeilt voor de censoren kan zeer problematisch zijn. Je moet nagaan welke aspecten van het netwerk jouw tegenstander kan waarnemen, en of je jouw acties kunt ontkennen. +Het omzeilen van de censuur zelf is betrekkelijk eenvoudig, maar het feit dat je het censuursysteem omzeilt voor de censoren kan zeer problematisch zijn. Je moet nagaan welke aspecten van het netwerk jouw tegenstander kan waarnemen, en of je jouw acties kunt ontkennen. + +
Ondanks de toenemende massasurveillance in de Verenigde Staten heeft de regering vastgesteld dat massasurveillanceprogramma's zoals Section 215 "weinig unieke waarde" hebben gehad wat betreft het stoppen van daadwerkelijke misdaden of terroristische complotten, waarbij de inspanningen grotendeels de eigen gerichte surveillanceprogramma's van de FBI dupliceren.[^2] @@ -133,11 +148,14 @@ Censuur op bedrijfsplatforms komt steeds vaker voor, nu platforms als Twitter en Mensen die bezorgd zijn over de dreiging van censuur kunnen technologieën als [Tor](../advanced/tor-overview.md) gebruiken om die te omzeilen, en steun verlenen aan censuurbestendige communicatieplatforms als [Matrix](../real-time-communication.md#element), dat geen gecentraliseerde accountautoriteit heeft die willekeurig accounts kan sluiten. -!!! tip +
+

Tip

- Het ontwijken van censuur kan gemakkelijk zijn, maar het verbergen van het feit dat je het doet kan heel moeilijk zijn. - - Je zou moeten overwegen welke aspecten van het netwerk je tegenstander kan waarnemen en of je plausibele ontkenningsmogelijkheden voor je actie hebt. Het gebruik van [versleutelde DNS](../advanced/dns-overview.md#what-is-encrypted-dns) kan je bijvoorbeeld helpen om rudimentaire, DNS-gebaseerde censuursystemen te omzeilen, maar het kan niet echt verbergen wat je bezoekt bij je ISP. Een VPN of Tor kan helpen verbergen wat je bezoekt voor netwerkbeheerders, maar je kunt niet verbergen dat je deze netwerken als gebruikt. Pluggable transports (zoals Obfs4proxy, Meek of Shadowsocks) kunnen je helpen firewalls te omzeilen die gangbare VPN-protocollen of Tor blokkeren, maar jouw pogingen tot omzeiling kunnen nog steeds worden ontdekt door methoden als probing of [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +Het ontwijken van censuur kan gemakkelijk zijn, maar het verbergen van het feit dat je het doet kan heel moeilijk zijn. + +Je zou moeten overwegen welke aspecten van het netwerk je tegenstander kan waarnemen en of je plausibele ontkenningsmogelijkheden voor je actie hebt. Het gebruik van [versleutelde DNS](../advanced/dns-overview.md#what-is-encrypted-dns) kan je bijvoorbeeld helpen om rudimentaire, DNS-gebaseerde censuursystemen te omzeilen, maar het kan niet echt verbergen wat je bezoekt bij je ISP. Een VPN of Tor kan helpen verbergen wat je bezoekt voor netwerkbeheerders, maar je kunt niet verbergen dat je deze netwerken als gebruikt. Pluggable transports (zoals Obfs4proxy, Meek of Shadowsocks) kunnen je helpen firewalls te omzeilen die gangbare VPN-protocollen of Tor blokkeren, maar jouw pogingen tot omzeiling kunnen nog steeds worden ontdekt door methoden als probing of [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
Je moet altijd rekening houden met de risico 's van het proberen om censuur te omzeilen, de mogelijke gevolgen en hoe geavanceerd je tegenstander kan zijn. Je moet voorzichtig zijn met jouw software selectie, en een back-up plan hebben voor het geval je betrapt wordt. diff --git a/i18n/nl/basics/multi-factor-authentication.md b/i18n/nl/basics/multi-factor-authentication.md index 2795891a..6be8157e 100644 --- a/i18n/nl/basics/multi-factor-authentication.md +++ b/i18n/nl/basics/multi-factor-authentication.md @@ -173,10 +173,12 @@ Het commando zal voorkomen dat een tegenstander MFA omzeilt wanneer de computer ### Linux -!!! warning +
+

Warning

- Als de hostnaam van jouw systeem verandert (bijvoorbeeld door DHCP), zou je niet kunnen inloggen. Het is van vitaal belang dat je een correcte hostnaam instelt voor jouw computer alvorens deze gids te volgen. - +Als de hostnaam van jouw systeem verandert (bijvoorbeeld door DHCP), zou je niet kunnen inloggen. Het is van vitaal belang dat je een correcte hostnaam instelt voor jouw computer alvorens deze gids te volgen. + +
De `pam_u2f` module op Linux kan twee-factor authenticatie bieden om in te loggen op de meeste populaire Linux distributies. Als je een hardware beveiligingssleutel hebt die U2F ondersteunt, kun je MFA verificatie instellen voor jouw aanmelding. Yubico heeft een gids [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) die zou moeten werken op elke distributie. De commando's van de pakketbeheerder - zoals `apt-get`- en de pakketnamen kunnen echter verschillen. Deze gids is **niet** van toepassing op Qubes OS. diff --git a/i18n/nl/basics/passwords-overview.md b/i18n/nl/basics/passwords-overview.md index 4665cbbe..ea6f396a 100644 --- a/i18n/nl/basics/passwords-overview.md +++ b/i18n/nl/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Inleiding tot wachtwoorden" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Dit zijn enkele tips en trucs om de sterkste wachtwoorden te maken en jouw accounts veilig te houden. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Wachtwoorden zijn een essentieel onderdeel van ons dagelijkse digitale leven. We gebruiken ze om onze accounts, onze apparaten en onze geheimen te beschermen. Hoewel ze vaak het enige zijn tussen ons en een tegenstander die uit is op onze privégegevens, wordt er niet veel aandacht aan besteed, wat er vaak toe leidt dat mensen wachtwoorden gebruiken die gemakkelijk geraden of gebruteforcet kunnen worden. @@ -26,9 +26,12 @@ Wachtwoorden die je moet onthouden (zoals het hoofdwachtwoord van jouw wachtwoor Als het gaat om wachtwoorden die je niet hoeft te onthouden (zoals wachtwoorden die zijn opgeslagen in jouw wachtwoordmanager), adviseren wij, als jouw [dreigingsmodel](threat-modeling.md) daarom vraagt, belangrijke accounts door te nemen (vooral accounts die geen multi-factor authenticatie gebruiken) en hun wachtwoord om de paar maanden te wijzigen, voor het geval ze zijn gecompromitteerd in een datalek dat nog niet openbaar is geworden. Bij de meeste wachtwoordmanagers kunt u een vervaldatum voor uw wachtwoord instellen om dit gemakkelijker te beheren. -!!! tip "Controleren op datalekken" +
+

Checking for data breaches

- Als je met jouw wachtwoordmanager kunt controleren op gecompromitteerde wachtwoorden, doe dat dan en wijzig onmiddellijk alle wachtwoorden die bij een datalek bekend zijn geworden. Je kunt ook de [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) volgen met behulp van een [nieuwsaggregator](../news-aggregators.md). +Als je met jouw wachtwoordmanager kunt controleren op gecompromitteerde wachtwoorden, doe dat dan en wijzig onmiddellijk alle wachtwoorden die bij een datalek bekend zijn geworden. Je kunt ook de [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) volgen met behulp van een [nieuwsaggregator](../news-aggregators.md). + +
## Sterke wachtwoorden maken @@ -48,9 +51,12 @@ Een voorbeeld van een diceware wachtwoord zin is: `zichtbaar snelheid hond teru Volg deze stappen om een diceware passphrase te genereren met echte dobbelstenen: -!!! note +
+

Note

- Deze instructies gaan ervan uit dat je [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) gebruikt om de wachtwoord zin te genereren, waarvoor vijf dobbelsteenworpen per woord nodig zijn. Andere woordenlijsten kunnen meer of minder rollen per woord vereisen, en kunnen een ander aantal woorden nodig hebben om dezelfde entropie te bereiken. +Deze instructies gaan ervan uit dat je [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) gebruikt om de wachtwoord zin te genereren, waarvoor vijf dobbelsteenworpen per woord nodig zijn. Andere woordenlijsten kunnen meer of minder rollen per woord vereisen, en kunnen een ander aantal woorden nodig hebben om dezelfde entropie te bereiken. + +
1. Gooi vijf keer met een zeszijdige dobbelsteen en noteer het getal na elke worp. @@ -60,31 +66,37 @@ Volg deze stappen om een diceware passphrase te genereren met echte dobbelstenen 4. Herhaal dit proces totdat jouw wachtwoord zoveel woorden bevat als je nodig hebt, die je moet scheiden met een spatie. -!!! warning "Belangrijk" +
+

Important

- Je moet **niet** opnieuw woorden rollen totdat je een combinatie van woorden krijgt die je aanspreekt. Het proces moet volledig willekeurig zijn. +Je moet **niet** opnieuw woorden rollen totdat je een combinatie van woorden krijgt die je aanspreekt. Het proces moet volledig willekeurig zijn. + +
Als je geen toegang hebt tot of liever geen echte dobbelstenen gebruikt, kunt je de ingebouwde wachtwoordgenerator van jouw wachtwoord manager gebruiken, omdat de meeste daarvan de optie hebben om naast gewone wachtwoorden ook diceware wachtwoord zinnen te genereren. Wij adviseren het gebruik van [EFF's grote woordenlijst](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) om jouw diceware wachtwoord zinnen te genereren, omdat het exact dezelfde veiligheid biedt als de originele lijst, terwijl het woorden bevat die gemakkelijker te onthouden zijn. Er zijn ook [andere woordenlijsten in verschillende talen](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), als u niet wilt dat uw wachtwoord in het Engels is. -??? note "Uitleg van entropie en sterkte van diceware wachtwoord zinnen" +
+Explanation of entropy and strength of diceware passphrases - Om aan te tonen hoe sterk diceware wachtwoord zin zijn, gebruiken we de eerder genoemde wachtwoord zin van zeven woorden (`kijkbaar snel terughoudend hond zeventien getoond potlood`) en [EFF's grote woordenlijst](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) als voorbeeld. - - Eén meting om de sterkte van een wachtwoord zin te bepalen is hoeveel entropie het heeft. De entropie per woord in een diceware wachtwoord zin wordt berekend als $\text{log}_2(\text{WordsInList})$ en de totale entropie van de wachtwoord zin wordt berekend als $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Daarom resulteert elk woord in de bovengenoemde lijst in ~12,9 bits entropie ($\text{log}_2(7776)$), en een daarvan afgeleide wachtwoord zin van zeven woorden heeft ~90,47 bits entropie ($\text{log}_2(7776^7)$). - - De [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) bevat 7776 unieke woorden. Om het aantal mogelijke passphrases te berekenen, hoeven we alleen maar $\text{WordsInList}^\text{WordsInPhrase}$, of in ons geval, $7776^7$, uit te rekenen. - - Laten we dit alles in perspectief plaatsen: Een passphrase van zeven woorden met [EFF's grote woordenlijst](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is één van ~1,719,070,799,748,422,500,000,000,000 mogelijke wachtwoord zinnen. - - Gemiddeld duurt het proberen van 50% van alle mogelijke combinaties om uw zin te raden. Met dat in gedachten, zelfs als uw tegenstander in staat is tot ~1.000.000.000.000 raden per seconde, zou het hem nog steeds ~27.255.689 jaar kosten om uw wachtwoord te raden. Zelfs als de volgende dingen waar zijn: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Je tegenstander weet dat je de diceware-methode hebt gebruikt. - - Je tegenstander kent de specifieke woordenlijst die je gebruikt hebt. - - Jouw tegenstander weet hoeveel woorden jouw wachtwoord bevat. +Eén meting om de sterkte van een wachtwoord zin te bepalen is hoeveel entropie het heeft. De entropie per woord in een diceware wachtwoord zin wordt berekend als $\text{log}_2(\text{WordsInList})$ en de totale entropie van de wachtwoord zin wordt berekend als $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Daarom resulteert elk woord in de bovengenoemde lijst in ~12,9 bits entropie ($\text{log}_2(7776)$), en een daarvan afgeleide wachtwoord zin van zeven woorden heeft ~90,47 bits entropie ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. Om het aantal mogelijke passphrases te berekenen, hoeven we alleen maar $\text{WordsInList}^\text{WordsInPhrase}$, of in ons geval, $7776^7$, uit te rekenen. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +Gemiddeld duurt het proberen van 50% van alle mogelijke combinaties om uw zin te raden. Met dat in gedachten, zelfs als uw tegenstander in staat is tot ~1.000.000.000.000 raden per seconde, zou het hem nog steeds ~27.255.689 jaar kosten om uw wachtwoord te raden. Zelfs als de volgende dingen waar zijn: + +- Je tegenstander weet dat je de diceware-methode hebt gebruikt. +- Je tegenstander kent de specifieke woordenlijst die je gebruikt hebt. +- Jouw tegenstander weet hoeveel woorden jouw wachtwoord bevat. + +
Kortom, diceware wachtzinnen zijn jouw beste optie wanneer je iets nodig hebt dat zowel gemakkelijk te onthouden is *als* uitzonderlijk sterk. @@ -98,13 +110,16 @@ Er zijn veel goede opties om uit te kiezen, zowel cloud-gebaseerd als lokaal. Ki [Lijst van aanbevolen wachtwoordmanagers](../passwords.md ""){.md-button} -!!! warning "Plaats uw wachtwoorden en TOTP-tokens niet in dezelfde wachtwoordmanager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- Wanneer je TOTP-codes gebruikt als [multi-factor authenticatie](../multi-factor-authentication.md), is de beste beveiligingspraktijk om jouw TOTP-codes in een [aparte app] te bewaren(../multi-factor-authentication.md#authenticator-apps). - - Het opslaan van jouw TOTP-tokens op dezelfde plaats als jouw wachtwoorden is weliswaar handig, maar beperkt de accounts tot één factor in het geval dat een tegenstander toegang krijgt tot jouw wachtwoord manager. - - Verder raden wij af om herstelcodes voor eenmalig gebruik op te slaan in uw wachtwoord manager. Deze moeten apart worden opgeslagen, zoals in een versleutelde container op een offline opslagapparaat. +Wanneer je TOTP-codes gebruikt als [multi-factor authenticatie](../multi-factor-authentication.md), is de beste beveiligingspraktijk om jouw TOTP-codes in een [aparte app] te bewaren(../multi-factor-authentication.md#authenticator-apps). + +Het opslaan van jouw TOTP-tokens op dezelfde plaats als jouw wachtwoorden is weliswaar handig, maar beperkt de accounts tot één factor in het geval dat een tegenstander toegang krijgt tot jouw wachtwoord manager. + +Verder raden wij af om herstelcodes voor eenmalig gebruik op te slaan in uw wachtwoord manager. Deze moeten apart worden opgeslagen, zoals in een versleutelde container op een offline opslagapparaat. + +
### Back-ups diff --git a/i18n/nl/basics/vpn-overview.md b/i18n/nl/basics/vpn-overview.md index 98b2efba..cef5440a 100644 --- a/i18n/nl/basics/vpn-overview.md +++ b/i18n/nl/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "Hoe beschermen VPN's mijn privacy? Ons VPN-overzicht - Privacy Guides" -title: VPN-overzicht +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Virtual Private Networks verleggen het risico van jouw ISP naar een derde partij die je vertrouwt. Je moet deze dingen in gedachten houden. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/nl/os/android-overview.md b/i18n/nl/os/android-overview.md index c8d528cf..45894283 100644 --- a/i18n/nl/os/android-overview.md +++ b/i18n/nl/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Android Overzicht +title: Android Overview icon: simple/android -description: Android is een open-source besturingssysteem met sterke beveiliging, waardoor het onze topkeuze is voor telefoons. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android logo](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Een app kan een toestemming vragen voor een specifieke functie die hij heeft. Bi [Exodus](https://exodus-privacy.eu.org/) kan nuttig zijn bij het vergelijken van apps die vergelijkbare doelen hebben. Als een app veel machtigingen nodig heeft en veel advertenties en analytics heeft, is dit waarschijnlijk een slecht teken. Wij raden aan de individuele trackers te bekijken en hun beschrijvingen te lezen in plaats van eenvoudigweg **het totaal** te tellen en aan te nemen dat alle vermelde items gelijk zijn. -!!! warning +
+

Warning

- Als een app vooral een webdienst is, kan de tracking aan de serverzijde plaatsvinden. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) toont "geen trackers", maar volgt zeker de interesses en het gedrag van gebruikers op de site. Apps kunnen detectie omzeilen door geen gebruik te maken van door de reclame-industrie geproduceerde standaardcodebibliotheken, hoewel dit onwaarschijnlijk is. +Als een app vooral een webdienst is, kan de tracking aan de serverzijde plaatsvinden. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) toont "geen trackers", maar volgt zeker de interesses en het gedrag van gebruikers op de site. Apps kunnen detectie omzeilen door geen gebruik te maken van door de reclame-industrie geproduceerde standaardcodebibliotheken, hoewel dit onwaarschijnlijk is. -!!! note +
- Privacy-vriendelijke apps zoals [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) kunnen sommige trackers tonen zoals [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). Deze bibliotheek bevat [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) die [pushmeldingen](https://en.wikipedia.org/wiki/Push_technology) in apps kan bieden. Dit [is het geval](https://fosstodon.org/@bitwarden/109636825700482007) met Bitwarden. Dat betekent niet dat Bitwarden alle analysefuncties gebruikt die Google Firebase Analytics biedt. +
+

Note

+ +Privacy-vriendelijke apps zoals [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) kunnen sommige trackers tonen zoals [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). Deze bibliotheek bevat [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) die [pushmeldingen](https://en.wikipedia.org/wiki/Push_technology) in apps kan bieden. Dit [is het geval](https://fosstodon.org/@bitwarden/109636825700482007) met Bitwarden. Dat betekent niet dat Bitwarden alle analysefuncties gebruikt die Google Firebase Analytics biedt. + +
## Privacy Features diff --git a/i18n/nl/os/ios-overview.md b/i18n/nl/os/ios-overview.md index 970726a2..0bf3105b 100644 --- a/i18n/nl/os/ios-overview.md +++ b/i18n/nl/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/nl/os/macos-overview.md b/i18n/nl/os/macos-overview.md index ffce9f25..ccb0a777 100644 --- a/i18n/nl/os/macos-overview.md +++ b/i18n/nl/os/macos-overview.md @@ -1,7 +1,7 @@ --- title: macOS Overview icon: material/apple-finder -description: macOS is Apple's desktop besturingssysteem dat met zijn hardware werkt om een sterke beveiliging te bieden. +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- **macOS** is een Unix besturingssysteem ontwikkeld door Apple voor hun Mac computers. Om de privacy op macOS te verbeteren, kun je telemetry functies uitschakelen en bestaande privacy-en beveiligingsinstellingen aanscherpen. @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/nl/os/qubes-overview.md b/i18n/nl/os/qubes-overview.md index 92caac93..131db308 100644 --- a/i18n/nl/os/qubes-overview.md +++ b/i18n/nl/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes gebruikt [compartimentering](https://www.qubes-os.org/intro/) om het systeem veilig te houden. Qubes worden aangemaakt op basis van sjablonen, waarbij de standaard opties Fedora, Debian en [Whonix](../desktop.md#whonix)zijn. Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architectuur](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architectuur, Krediet: Wat is Qubes OS Intro
@@ -41,9 +44,12 @@ Je kunt [tekst kopiëren en plakken](https://www.qubes-os.org/doc/how-to-copy-an To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Het verschil is dat de optie **Verplaatsen** het oorspronkelijke bestand verwijdert. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Dat is niet nodig met het inter-qube kopieersysteem. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Daarbij worden de wijzigingen niet onmiddellijk aangebracht en kunnen ze bij een ongeval gemakkelijk ongedaan worden gemaakt. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Daarbij worden de wijzigingen niet onmiddellijk aangebracht en kunnen ze bij een ongeval gemakkelijk ongedaan worden gemaakt. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interacties diff --git a/i18n/pl/advanced/payments.md b/i18n/pl/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/pl/advanced/payments.md +++ b/i18n/pl/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/pl/advanced/tor-overview.md b/i18n/pl/advanced/tor-overview.md index 5901ce73..d4235518 100644 --- a/i18n/pl/advanced/tor-overview.md +++ b/i18n/pl/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/pl/basics/account-creation.md b/i18n/pl/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/pl/basics/account-creation.md +++ b/i18n/pl/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/pl/basics/common-misconceptions.md b/i18n/pl/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/pl/basics/common-misconceptions.md +++ b/i18n/pl/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/pl/basics/common-threats.md b/i18n/pl/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/pl/basics/common-threats.md +++ b/i18n/pl/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/pl/basics/multi-factor-authentication.md b/i18n/pl/basics/multi-factor-authentication.md index 9259d8b7..ec47a3dc 100644 --- a/i18n/pl/basics/multi-factor-authentication.md +++ b/i18n/pl/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/pl/basics/passwords-overview.md b/i18n/pl/basics/passwords-overview.md index a18b788e..a8bd2a0d 100644 --- a/i18n/pl/basics/passwords-overview.md +++ b/i18n/pl/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Kopie zapasowe diff --git a/i18n/pl/basics/vpn-overview.md b/i18n/pl/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/pl/basics/vpn-overview.md +++ b/i18n/pl/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/pl/os/android-overview.md b/i18n/pl/os/android-overview.md index dc58c8a9..f0b1c888 100644 --- a/i18n/pl/os/android-overview.md +++ b/i18n/pl/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/pl/os/ios-overview.md b/i18n/pl/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/pl/os/ios-overview.md +++ b/i18n/pl/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/pl/os/macos-overview.md b/i18n/pl/os/macos-overview.md index 18646a87..5dc34d2c 100644 --- a/i18n/pl/os/macos-overview.md +++ b/i18n/pl/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/pl/os/qubes-overview.md b/i18n/pl/os/qubes-overview.md index 5a4fc46e..3672ffce 100644 --- a/i18n/pl/os/qubes-overview.md +++ b/i18n/pl/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/pt-BR/advanced/payments.md b/i18n/pt-BR/advanced/payments.md index 6f0c60bd..6b10827f 100644 --- a/i18n/pt-BR/advanced/payments.md +++ b/i18n/pt-BR/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/pt-BR/advanced/tor-overview.md b/i18n/pt-BR/advanced/tor-overview.md index 4ffb5777..c5e75b15 100644 --- a/i18n/pt-BR/advanced/tor-overview.md +++ b/i18n/pt-BR/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/pt-BR/basics/account-creation.md b/i18n/pt-BR/basics/account-creation.md index 380000f7..16f79eb6 100644 --- a/i18n/pt-BR/basics/account-creation.md +++ b/i18n/pt-BR/basics/account-creation.md @@ -1,5 +1,5 @@ --- -meta_title: "Como Criar Contas na Internet de Forma Privada — Privacy Guides" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" title: "Account Creation" icon: 'material/account-plus' description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/pt-BR/basics/common-misconceptions.md b/i18n/pt-BR/basics/common-misconceptions.md index d977e5ff..8fa1aa5b 100644 --- a/i18n/pt-BR/basics/common-misconceptions.md +++ b/i18n/pt-BR/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/pt-BR/basics/common-threats.md b/i18n/pt-BR/basics/common-threats.md index 86518ee2..3a470d8b 100644 --- a/i18n/pt-BR/basics/common-threats.md +++ b/i18n/pt-BR/basics/common-threats.md @@ -35,19 +35,25 @@ Quando se trata de segurança de aplicativos, geralmente não sabemos (e às vez Para minimizar os danos que um aplicativo malicioso *pode* causar, você deve usar a segurança por compartimentalização. Por exemplo, isso pode ser feito usando computadores diferentes para trabalhos diferentes, usando máquinas virtuais para separar grupos diferentes de aplicativos relacionados ou usando um sistema operacional seguro com um forte foco em isolamento (sandboxing) de aplicativos e controle de acesso obrigatório. -!!! tip +
+

Tip

- Sistemas operacionais móveis geralmente têm um isolamento (sandboxing) de aplicativos melhor do que os sistemas operacionais de mesa (desktop): Aplicativos não podem obter acesso à raiz e precisam de permissão para acessar os recursos do sistema. - - Sistemas operacionais de mesa geralmente ficam para trás em termos de isolamento adequado. ChromeOS tem recursos de isolamento semelhantes aos do Android, e o macOS tem controle total de permissões do sistema (e os desenvolvedores podem optar pelo isolamento para aplicativos). No entanto, esses sistemas operacionais transmitem informações de identificação para seus respectivos OEMs. Linux tende a não enviar informações aos fornecedores de sistemas, mas tem pouca proteção contra explorações e aplicativos mal-intencionados. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Sistemas operacionais móveis geralmente têm um isolamento (sandboxing) de aplicativos melhor do que os sistemas operacionais de mesa (desktop): Aplicativos não podem obter acesso à raiz e precisam de permissão para acessar os recursos do sistema. + +Sistemas operacionais de mesa geralmente ficam para trás em termos de isolamento adequado. ChromeOS tem recursos de isolamento semelhantes aos do Android, e o macOS tem controle total de permissões do sistema (e os desenvolvedores podem optar pelo isolamento para aplicativos). No entanto, esses sistemas operacionais transmitem informações de identificação para seus respectivos OEMs. Linux tende a não enviar informações aos fornecedores de sistemas, mas tem pouca proteção contra explorações e aplicativos mal-intencionados. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Ataques Direcionados Ataques direcionados contra uma pessoa específica são mais problemáticos de lidar. Os ataques comuns incluem o envio de documentos maliciosos por e-mail, a exploração de vulnerabilidades (por exemplo, em navegadores e sistemas operacionais) e ataques físicos. Se isso for uma preocupação para você, deverá empregar estratégias mais avançadas de atenuação de ameaças. -!!! tip +
+

Tip

- Por padrão, **navegadores da Internet**, **clientes de e-mail** e **aplicativos de escritório** normalmente executam códigos não confiáveis, enviados a você por terceiros. A execução de várias máquinas virtuais — para separar aplicativos como esses do sistema host, bem como uns dos outros — é uma técnica que pode ser usada para reduzir a chance de uma exploração nesses aplicativos comprometer o restante do sistema. Por exemplo, tecnologias como o Qubes OS ou o Microsoft Defender Application Guard no Windows oferecem métodos confortáveis para fazer isso. +Por padrão, **navegadores da Internet**, **clientes de e-mail** e **aplicativos de escritório** normalmente executam códigos não confiáveis, enviados a você por terceiros. A execução de várias máquinas virtuais — para separar aplicativos como esses do sistema host, bem como uns dos outros — é uma técnica que pode ser usada para reduzir a chance de uma exploração nesses aplicativos comprometer o restante do sistema. Por exemplo, tecnologias como o Qubes OS ou o Microsoft Defender Application Guard no Windows oferecem métodos confortáveis para fazer isso. + +
Se você está preocupado com **ataques físicos**, você deve usar um sistema operacional com uma implementação de inicialização verificada segura, tais como Android, iOS, macOS ou [Windows (com TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - Na França, você pode dar uma olhada no [site da Technopolicy](https://technopolice.fr/villes/) mantido pela associação sem fins lucrativos La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/pt-BR/basics/multi-factor-authentication.md b/i18n/pt-BR/basics/multi-factor-authentication.md index 0e9fb706..3db2ce0a 100644 --- a/i18n/pt-BR/basics/multi-factor-authentication.md +++ b/i18n/pt-BR/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/pt-BR/basics/passwords-overview.md b/i18n/pt-BR/basics/passwords-overview.md index b201b6ff..9b75cd62 100644 --- a/i18n/pt-BR/basics/passwords-overview.md +++ b/i18n/pt-BR/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/pt-BR/basics/vpn-overview.md b/i18n/pt-BR/basics/vpn-overview.md index ed0b3f85..3d2443f0 100644 --- a/i18n/pt-BR/basics/vpn-overview.md +++ b/i18n/pt-BR/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "Como As VPNs Protegem Sua Privacidade? Nossa Visão Geral Sobre VPN — Privacy Guides" -title: Visão geral da VPN +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: As Redes Privadas Virtuais transferem o risco do seu ISP para um terceiro em quem você confia. Você deve ter isso em mente. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/pt-BR/os/android-overview.md b/i18n/pt-BR/os/android-overview.md index be89d613..7414e63b 100644 --- a/i18n/pt-BR/os/android-overview.md +++ b/i18n/pt-BR/os/android-overview.md @@ -1,5 +1,5 @@ --- -title: Visão geral do Android +title: Android Overview icon: simple/android description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/pt-BR/os/ios-overview.md b/i18n/pt-BR/os/ios-overview.md index d8ef83ff..54464daf 100644 --- a/i18n/pt-BR/os/ios-overview.md +++ b/i18n/pt-BR/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/pt-BR/os/macos-overview.md b/i18n/pt-BR/os/macos-overview.md index 10b5c92f..0431d91c 100644 --- a/i18n/pt-BR/os/macos-overview.md +++ b/i18n/pt-BR/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/pt-BR/os/qubes-overview.md b/i18n/pt-BR/os/qubes-overview.md index 29f23e2c..fae7cce1 100644 --- a/i18n/pt-BR/os/qubes-overview.md +++ b/i18n/pt-BR/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes usa [compartimentação](https://www.qubes-os.org/intro/) para manter o sistema seguro. Os Qubes são criados a partir de modelos, sendo as predefinições para Fedora, Debian e [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ Você pode [copiar e colar texto](https://www.qubes-os.org/doc/how-to-copy-and-p To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/pt/advanced/payments.md b/i18n/pt/advanced/payments.md index 4a2a09e3..5328021d 100644 --- a/i18n/pt/advanced/payments.md +++ b/i18n/pt/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Pagamentos com privacidade +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ Estes serviços tendem a ser boas opções para pagamentos recorrentes/assinatur As criptomoedas são uma forma digital de moeda concebida para funcionar sem autoridades centrais, como um governo ou um banco. Enquanto *alguns* projetos de criptomoeda podem permitir transações online com privacidade, muitos deles utilizam uma blockchain pública que não proporciona qualquer privacidade nas transações. As criptomoedas também tendem a ser ativos muito voláteis, o que significa que o seu valor pode mudar rápida e significativamente a qualquer momento. Como tal, não recomendamos a utilização de criptomoeda como uma reserva de valor a longo prazo. Se decidir utilizar criptomoedas online, certifique-se de que conhece previamente todos os aspetos da sua política de privacidade e invista apenas em montantes que não signifiquem uma perda avultada. -!!! perigo +
+

Danger

- A grande maioria das criptomoedas opera numa blockchain **pública**, o que significa que todas as transações são do conhecimento público. Isto inclui até as criptomoedas mais conhecidas, como a Bitcoin e a Ethereum. As transações com estas criptomoedas não garantem privacidade, não protegendo o anonimato. - - Além disso, muitas das criptomoedas, se não a maioria, são burlas. Faça transações com cuidado, escolhendo apenas projetos em que confia. +A grande maioria das criptomoedas opera numa blockchain **pública**, o que significa que todas as transações são do conhecimento público. Isto inclui até as criptomoedas mais conhecidas, como a Bitcoin e a Ethereum. As transações com estas criptomoedas não garantem privacidade, não protegendo o anonimato. + +Além disso, muitas das criptomoedas, se não a maioria, são burlas. Faça transações com cuidado, escolhendo apenas projetos em que confia. + +
### Moedas orientadas para a privacidade diff --git a/i18n/pt/advanced/tor-overview.md b/i18n/pt/advanced/tor-overview.md index 7da73ee7..9006d5a1 100644 --- a/i18n/pt/advanced/tor-overview.md +++ b/i18n/pt/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/pt/basics/account-creation.md b/i18n/pt/basics/account-creation.md index df1bc2a3..486e7f74 100644 --- a/i18n/pt/basics/account-creation.md +++ b/i18n/pt/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Como Criar Contas Na Internet Privadamente - Privacy Guides" -title: "Criação de Contas" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: A criação de contas online é praticamente uma necessidade da Internet, siga estes passos para garantir a sua privacidade. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Muitas vezes, as pessoas inscrevem-se em serviços sem pensar. Talvez seja um serviço de streaming para poder ver aquela nova série de que todos falam, ou uma conta que lhe dá um desconto no seu restaurante de fast food favorito. Seja qual for o caso, deve considerar as implicações para os seus dados agora e mais tarde. @@ -29,10 +29,12 @@ Normalmente, existem várias formas de registar uma conta, cada uma com as suas A forma mais comum de criar uma nova conta é por um endereço de correio eletrónico e de uma palavra-passe. Ao utilizar este método, deve utilizar um gestor de palavras-passe e seguir as [melhores práticas](passwords-overview.md) relativamente a palavras-passe. -!!! aviso - Backup `BitLocker-Recovery-Key. txt` em um dispositivo de armazenamento separado +
+

Tip

- Também pode utilizar o seu gestor de palavra-passes para organizar outros métodos de autenticação! Basta adicionar a nova entrada e preencher os campos adequados, pode adicionar notas para coisas como perguntas de segurança ou uma chave de segurança. +Também pode utilizar o seu gestor de palavra-passes para organizar outros métodos de autenticação! Basta adicionar a nova entrada e preencher os campos adequados, pode adicionar notas para coisas como perguntas de segurança ou uma chave de segurança. + +
Será responsável pela gestão das suas credenciais de início de sessão. Para maior segurança, pode configurar [MFA](multi-factor-authentication.md) nas suas contas. diff --git a/i18n/pt/basics/common-misconceptions.md b/i18n/pt/basics/common-misconceptions.md index 596ee474..425af8e9 100644 --- a/i18n/pt/basics/common-misconceptions.md +++ b/i18n/pt/basics/common-misconceptions.md @@ -75,20 +75,23 @@ Então, o que isto pode parecer? Um dos modelos de ameaça mais claros é aquele no qual as pessoas *sabem quem é* e aquele em que não sabem. Haverá sempre situações em que tem de declarar o seu nome legal e outras em que não precisa de o fazer. -1. **Identidade conhecida** - A identidade conhecida é utilizada para situações em que é necessário declarar o seu nome. Existem muitos documentos jurídicos e contratos que exigem uma identidade legal. Pode tratar-se da abertura de uma conta bancária, da assinatura de um contrato de arrendamento de um imóvel, da obtenção de um passaporte, de declarações aduaneiras aquando da importação de artigos ou de qualquer outra forma de contacto com o seu governo. Estas coisas conduzem normalmente a credenciais como cartões de crédito, verificações de notação de crédito, números de conta e, possivelmente, endereços físicos. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Não sugerimos utilizar uma VPN ou Tor para qualquer uma destas coisas, uma vez que a sua identidade já é conhecida mediante outros meios. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! dica - - Nas compras online, a utilização de um [armário de encomendas](https://en.wikipedia.org/wiki/Parcel_locker) pode ajudar a manter o seu endereço físico privado. +
+

Tip

+ +Nas compras online, a utilização de um [armário de encomendas](https://en.wikipedia.org/wiki/Parcel_locker) pode ajudar a manter o seu endereço físico privado. + +
2. **Identidade desconhecida** - Uma identidade desconhecida pode ser um pseudónimo estável que utiliza regularmente. Não é anónimo porque não muda. Se faz parte de uma comunidade online, pode querer manter uma personalidade que os outros conheçam. Este pseudónimo não é anónimo porque — se for monitorizado durante tempo suficiente — os detalhes sobre o proprietário podem revelar mais informações, como a forma como escreve, o seu conhecimento geral sobre tópicos de interesse, etc. - Para o efeito, poderá utilizar uma VPN para ocultar o seu endereço IP. As transações financeiras são mais difíceis de mascarar: pode considerar a utilização de criptomoedas anónimas, como [Monero](https://www.getmonero.org/). A utilização da mudança de altcoin também pode ajudar a disfarçar a origem da sua moeda. Normalmente, as bolsas exigem que o COSC (conheça o seu cliente) seja concluído antes de permitirem a troca de moeda fiduciária por qualquer tipo de moeda criptográfica. As opções de encontros locais também podem ser uma solução; no entanto, estas são frequentemente mais caras e, por vezes, também exigem COSC. +Para o efeito, poderá utilizar uma VPN para ocultar o seu endereço IP. As transações financeiras são mais difíceis de mascarar: pode considerar a utilização de criptomoedas anónimas, como [Monero](https://www.getmonero.org/). A utilização da mudança de altcoin também pode ajudar a disfarçar a origem da sua moeda. Normalmente, as bolsas exigem que o COSC (conheça o seu cliente) seja concluído antes de permitirem a troca de moeda fiduciária por qualquer tipo de moeda criptográfica. As opções de encontros locais também podem ser uma solução; no entanto, estas são frequentemente mais caras e, por vezes, também exigem COSC. 3. **Identidade anónima** - Mesmo com experiência, as identidades anónimas são difíceis de manter durante longos períodos de tempo. Devem ser identidades de curto prazo e de curta duração, sendo objeto de rotação regular. - A utilização do Tor pode ajudar neste aspeto. É também de salientar que é possível um maior anonimato através da comunicação assíncrona: A comunicação em tempo real é vulnerável à análise de padrões de digitação (ou seja, mais do que um parágrafo de texto, distribuído num fórum, por correio eletrónico, etc.) +A utilização do Tor pode ajudar neste aspeto. É também de salientar que é possível um maior anonimato através da comunicação assíncrona: A comunicação em tempo real é vulnerável à análise de padrões de digitação (ou seja, mais do que um parágrafo de texto, distribuído num fórum, por correio eletrónico, etc.) [^1]: Um exemplo notável é o incidente [2021 em que investigadores da Universidade do Minnesota introduziram três vulnerabilidades no projeto de desenvolvimento do kernel Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/pt/basics/common-threats.md b/i18n/pt/basics/common-threats.md index 247ae053..556db61b 100644 --- a/i18n/pt/basics/common-threats.md +++ b/i18n/pt/basics/common-threats.md @@ -35,19 +35,25 @@ No que diz respeito à segurança das aplicações, geralmente não sabemos (e p Para minimizar os danos que um software malicioso *pode* causar, deve utilizar a segurança por compartimentação. Essa compartimentação pode ser conseguida na forma de utilização de computadores diferentes para trabalhos diferentes, utilização de máquinas virtuais para separar diferentes grupos de aplicações relacionadas ou utilização de um sistema operativo seguro com uma forte ênfase na solução de sandbox das aplicações e no controlo de acesso obrigatório. -!!! dica +
+

Tip

- Os sistemas operativos móveis têm geralmente uma melhor proteção das aplicações do que os sistemas operativos de secretária: as aplicações não podem obter acesso à raiz e necessitam de permissão para aceder aos recursos do sistema. - - Os sistemas operativos para desktop deixam a desejar no que diz respeito a uma adequada proteção. O ChromeOS tem capacidades de sandbox semelhantes às do Android e o macOS tem controlo total das permissões do sistema (e os programadores podem optar pela sandbox para as aplicações). No entanto, estes sistemas operativos transmitem informações de identificação aos respectivos OEMs. O Linux tende a não enviar informações aos fornecedores de sistemas, mas tem uma fraca proteção contra exploits e aplicações maliciosas. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Os sistemas operativos móveis têm geralmente uma melhor proteção das aplicações do que os sistemas operativos de secretária: as aplicações não podem obter acesso à raiz e necessitam de permissão para aceder aos recursos do sistema. + +Os sistemas operativos para desktop deixam a desejar no que diz respeito a uma adequada proteção. O ChromeOS tem capacidades de sandbox semelhantes às do Android e o macOS tem controlo total das permissões do sistema (e os programadores podem optar pela sandbox para as aplicações). No entanto, estes sistemas operativos transmitem informações de identificação aos respectivos OEMs. O Linux tende a não enviar informações aos fornecedores de sistemas, mas tem uma fraca proteção contra exploits e aplicações maliciosas. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Ataques direcionados Os ataques direcionados contra uma pessoa específica são mais problemáticos de tratar. Os ataques mais comuns incluem o envio de documentos maliciosos por e-mail, a exploração de vulnerabilidades (por exemplo, em navegadores e sistemas operativos) e ataques físicos. Se isto for uma preocupação para si, deve utilizar estratégias de mitigação de ameaças mais avançadas. -!!! dica +
+

Tip

- Por definição, os **browsers**, os **clientes de e-mail** e as **suites de escritório** executam normalmente código não fiável, enviado por terceiros. Executar várias máquinas virtuais - para separar aplicações como estas do seu sistema anfitrião, bem como umas das outras - é uma técnica que pode utilizar para reduzir a possibilidade de uma exploração nestas aplicações poder comprometer o resto do seu sistema. Por exemplo, tecnologias como o Qubes OS ou o Microsoft Defender Application Guard no Windows fornecem métodos convenientes para o fazer. +Por definição, os **browsers**, os **clientes de e-mail** e as **suites de escritório** executam normalmente código não fiável, enviado por terceiros. Executar várias máquinas virtuais - para separar aplicações como estas do seu sistema anfitrião, bem como umas das outras - é uma técnica que pode utilizar para reduzir a possibilidade de uma exploração nestas aplicações poder comprometer o resto do seu sistema. Por exemplo, tecnologias como o Qubes OS ou o Microsoft Defender Application Guard no Windows fornecem métodos convenientes para o fazer. + +
Se estiver preocupado com **ataques físicos** deve utilizar um sistema operativo com uma implementação de arranque seguro verificado, como o Android, iOS, macOS ou [Windows (com TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Deve também certificar-se de que a sua unidade está encriptada e que o sistema operativo utiliza um TPM, Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) ou [Element](https://developers.google.com/android/security/android-ready-se) para limitar as tentativas de introdução da frase-chave de encriptação. Deve evitar partilhar o seu computador com pessoas em quem não confia, uma vez que a maioria dos sistemas operativos de computador de secretária não encripta os dados separadamente por utilizador. @@ -61,13 +67,16 @@ Há um problema óbvio devido ao facto do fornecedor de serviços (ou um hacker Felizmente, a E2EE pode aliviar este problema, através da encriptação das comunicações entre si e os seus destinatários, antes mesmo de serem enviadas para o servidor. A confidencialidade das suas mensagens é garantida, assumindo que o fornecedor de serviços não tem acesso às chaves privadas de nenhuma das partes. -!!! nota "Nota sobre a encriptação baseada na Web" +
+

Note on Web-based Encryption

- Na prática, a eficácia das diferentes implementações E2EE varia. As aplicações, como o [Signal](../real-time-communication.md#signal), são executadas nativamente no seu dispositivo e todas as cópias da aplicação são as mesmas em diferentes instalações. Se o fornecedor de serviços introduzisse um [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) na sua aplicação - numa tentativa de roubar as suas chaves privadas - esse facto poderia mais tarde ser detetado através de [engenharia inversa] (https://en.wikipedia.org/wiki/Reverse_engineering). - - Por outro lado, as implementações E2EE baseadas na Web, como o webmail do Proton Mail ou o *Web Vault* da Bitwarden, dependem do servidor que fornece dinamicamente código JavaScript ao browser para tratar da criptografia. Um servidor malicioso pode visá-lo e enviar-lhe código JavaScript malicioso para roubar a sua chave de encriptação (e seria extremamente difícil de notar). Uma vez que o servidor pode optar por servir clientes Web diferentes a pessoas diferentes - mesmo que se tenha apercebido do ataque - seria incrivelmente difícil provar a culpa do fornecedor. - - Por conseguinte, sempre que possível, deve utilizar aplicações nativas em vez de clientes Web. +Na prática, a eficácia das diferentes implementações E2EE varia. As aplicações, como o [Signal](../real-time-communication.md#signal), são executadas nativamente no seu dispositivo e todas as cópias da aplicação são as mesmas em diferentes instalações. Se o fornecedor de serviços introduzisse um [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) na sua aplicação - numa tentativa de roubar as suas chaves privadas - esse facto poderia mais tarde ser detetado através de [engenharia inversa] (https://en.wikipedia.org/wiki/Reverse_engineering). + +Por outro lado, as implementações E2EE baseadas na Web, como o webmail do Proton Mail ou o *Web Vault* da Bitwarden, dependem do servidor que fornece dinamicamente código JavaScript ao browser para tratar da criptografia. Um servidor malicioso pode visá-lo e enviar-lhe código JavaScript malicioso para roubar a sua chave de encriptação (e seria extremamente difícil de notar). Uma vez que o servidor pode optar por servir clientes Web diferentes a pessoas diferentes - mesmo que se tenha apercebido do ataque - seria incrivelmente difícil provar a culpa do fornecedor. + +Por conseguinte, sempre que possível, deve utilizar aplicações nativas em vez de clientes Web. + +
Mesmo com a E2EE, os fornecedores de serviços podem ainda traçar o seu perfil com base nos **metadados**, que normalmente não estão protegidos. Embora o fornecedor de serviços não possa ler as suas mensagens, pode observar coisas importantes, como com quem está a falar, com que frequência lhes envia mensagens e quando está normalmente ativo. A proteção de metadados é bastante invulgar e, se estiver incluída no seu [modelo de ameaças](threat-modeling.md), deve prestar muita atenção à documentação técnica do software que está a utilizar, de forma a verificar se existe alguma minimização ou proteção de metadados. @@ -77,17 +86,23 @@ Mesmo com a E2EE, os fornecedores de serviços podem ainda traçar o seu perfil A vigilância em massa é o esforço intrincado para monitorizar o "comportamento, atividades ou informações" de toda uma população (ou de uma sua fração substancial).[^1] Refere-se frequentemente a programas governamentais, como os [ revelados por Edward Snowden em 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). No entanto, também pode ser efetuada por empresas, quer em nome de agências governamentais, quer por sua própria iniciativa. -!!! resumo "Atlas da Vigilância" +
+

Atlas of Surveillance

- Se quiser saber mais sobre os métodos de vigilância e a forma como são aplicados na sua cidade, pode consultar o [Atlas da Vigilância] (https://atlasofsurveillance.org/) da [Electronic Frontier Foundation] (https://www.eff.org/). - - Em França, pode consultar o [site Technolopolice] (https://technopolice.fr/villes/), mantido pela associação sem fins lucrativos La Quadrature du Net. +Se quiser saber mais sobre os métodos de vigilância e a forma como são aplicados na sua cidade, pode consultar o [Atlas da Vigilância] (https://atlasofsurveillance.org/) da [Electronic Frontier Foundation] (https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Os governos justificam frequentemente os programas de vigilância em massa como meios necessários para combater o terrorismo e prevenir a criminalidade. No entanto, e violando os direitos humanos, é mais frequentemente utilizado para atingir de forma desproporcionada grupos minoritários e dissidentes políticos, entre outros. -!!! quote "ACLU: [*A lição de privacidade do 11 de setembro: A vigilância em massa não é o caminho a seguir*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Perante [as revelações de Edward Snowden sobre programas governamentais como [PRISM](https://en.wikipedia.org/wiki/PRISM) e [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], os funcionários dos serviços secretos também admitiram que a NSA recolhia secretamente, há anos, registos sobre praticamente todas as chamadas telefónicas dos americanos - quem liga a quem, quando são feitas e quanto tempo duram. Este tipo de informação, quando recolhida pela NSA dia após dia, pode revelar pormenores incrivelmente sensíveis sobre a vida e as associações das pessoas, como por exemplo, se telefonaram a um pastor, a um fornecedor de abortos, a um conselheiro de toxicodependência ou a uma linha de apoio ao suicídio. +Perante [as revelações de Edward Snowden sobre programas governamentais como [PRISM](https://en.wikipedia.org/wiki/PRISM) e [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], os funcionários dos serviços secretos também admitiram que a NSA recolhia secretamente, há anos, registos sobre praticamente todas as chamadas telefónicas dos americanos - quem liga a quem, quando são feitas e quanto tempo duram. Este tipo de informação, quando recolhida pela NSA dia após dia, pode revelar pormenores incrivelmente sensíveis sobre a vida e as associações das pessoas, como por exemplo, se telefonaram a um pastor, a um fornecedor de abortos, a um conselheiro de toxicodependência ou a uma linha de apoio ao suicídio. + +
Apesar da crescente vigilância em massa nos Estados Unidos, o governo concluiu que os programas de vigilância em massa, como a Secção 215, têm tido "pouco valor único" no que diz respeito a impedir crimes reais ou conspirações terroristas, com esforços que duplicam em grande parte os programas de vigilância direcionada do próprio FBI.[^2] @@ -133,11 +148,14 @@ A censura nas plataformas corporativas é cada vez mais comum, uma vez que plata As pessoas que se preocupam com a ameaça da censura podem usar tecnologias como o [Tor](../advanced/tor-overview.md) para contorná-la, e utilizar plataformas de comunicação resistentes à censura, como o [Matrix](../real-time-communication.md#element), que não tem uma autoridade de conta centralizada que pode fechar as contas arbitrariamente. -!!! dica +
+

Tip

- Enquanto evitar a censura em si pode ser fácil, esconder esse facto pode ser muito problemático. - - Deve considerar quais os aspetos da rede que o seu adversário pode observar e se tem negação plausível das suas ações. Por exemplo, usar [DNS criptografado](../advanced/dns-overview.md#what-is-encrypted-dns) pode ajudá-lo a contornar sistemas rudimentares de censura baseados em DNS, mas não pode realmente esconder as suas atividades online do seu ISP. Uma VPN ou o Tor podem ajudar a esconder o que está a visitar dos administradores de rede, mas não pode esconder o facto de estar a usar essas redes. Transportes conectáveis (como Obfs4proxy, Meek ou Shadowsocks) podem ajudá-lo a evitar firewalls que bloqueiam protocolos VPN comuns ou Tor, mas as suas tentativas de contornar o problema podem ser detetadas através de métodos como sondagem ou [inspeção profunda de pacotes](https://en. wikipedia.org/wiki/Deep_packet_inspection). +Enquanto evitar a censura em si pode ser fácil, esconder esse facto pode ser muito problemático. + +Deve considerar quais os aspetos da rede que o seu adversário pode observar e se tem negação plausível das suas ações. Por exemplo, usar [DNS criptografado](../advanced/dns-overview.md#what-is-encrypted-dns) pode ajudá-lo a contornar sistemas rudimentares de censura baseados em DNS, mas não pode realmente esconder as suas atividades online do seu ISP. Uma VPN ou o Tor podem ajudar a esconder o que está a visitar dos administradores de rede, mas não pode esconder o facto de estar a usar essas redes. Transportes conectáveis (como Obfs4proxy, Meek ou Shadowsocks) podem ajudá-lo a evitar firewalls que bloqueiam protocolos VPN comuns ou Tor, mas as suas tentativas de contornar o problema podem ser detetadas através de métodos como sondagem ou [inspeção profunda de pacotes](https://en. wikipedia.org/wiki/Deep_packet_inspection). + +
Deve sempre considerar os riscos de tentar contornar a censura, as possíveis consequências e o quão sofisticado o seu adversário pode ser. Deve ser cauteloso com a sua seleção de software e ter um plano de backup, caso seja apanhado. diff --git a/i18n/pt/basics/multi-factor-authentication.md b/i18n/pt/basics/multi-factor-authentication.md index 76c19b50..b5954d42 100644 --- a/i18n/pt/basics/multi-factor-authentication.md +++ b/i18n/pt/basics/multi-factor-authentication.md @@ -133,16 +133,19 @@ Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://suppor After your smartcard/security key is set up, we recommend running this command in the Terminal: ```text -sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool SIM +sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES ``` The command will prevent an adversary from bypassing MFA when the computer boots. ### Linux -!!! Recomendamos que você verifique o [documentação](https://developers.yubico.com/SSH/) de Yubico sobre como configurar isso. +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. A maioria das coisas deve ser a mesma independentemente da distribuição, no entanto os comandos do gerenciador de pacotes, como "apt-get" e nomes de pacotes podem ser diferentes. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/pt/basics/passwords-overview.md b/i18n/pt/basics/passwords-overview.md index 2eb98f81..f005d57f 100644 --- a/i18n/pt/basics/passwords-overview.md +++ b/i18n/pt/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -Recomendamos armazenar uma chave de recuperação local em um local seguro, em vez de utilizar a recuperação do iCloud FileVault. note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Cópias de segurança diff --git a/i18n/pt/basics/vpn-overview.md b/i18n/pt/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/pt/basics/vpn-overview.md +++ b/i18n/pt/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/pt/os/android-overview.md b/i18n/pt/os/android-overview.md index e59fcf26..ec306298 100644 --- a/i18n/pt/os/android-overview.md +++ b/i18n/pt/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! Recomendamos que você verifique o [documentação](https://developers.yubico.com/SSH/) de Yubico sobre como configurar isso. +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/pt/os/ios-overview.md b/i18n/pt/os/ios-overview.md index 583ee314..7848e75b 100644 --- a/i18n/pt/os/ios-overview.md +++ b/i18n/pt/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! Recomendamos que você verifique o [documentação](https://developers.yubico.com/SSH/) de Yubico sobre como configurar isso. +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/pt/os/macos-overview.md b/i18n/pt/os/macos-overview.md index 89a9feb0..62ebdced 100644 --- a/i18n/pt/os/macos-overview.md +++ b/i18n/pt/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! Recomendamos que você verifique o [documentação](https://developers.yubico.com/SSH/) de Yubico sobre como configurar isso. +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! Recomendamos que você verifique o [documentação](https://developers.yubico.com/SSH/) de Yubico sobre como configurar isso. +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/pt/os/qubes-overview.md b/i18n/pt/os/qubes-overview.md index 820a7d80..abd8dbb6 100644 --- a/i18n/pt/os/qubes-overview.md +++ b/i18n/pt/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -Recomendamos armazenar uma chave de recuperação local em um local seguro, em vez de utilizar a recuperação do iCloud FileVault. "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -Recomendamos armazenar uma chave de recuperação local em um local seguro, em vez de utilizar a recuperação do iCloud FileVault. "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/ru/advanced/payments.md b/i18n/ru/advanced/payments.md index b6be4aa0..3cff932f 100644 --- a/i18n/ru/advanced/payments.md +++ b/i18n/ru/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: Приватные платежи +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ icon: material/hand-coin Криптовалюты - это цифровая форма валюты, разработанная для работы без центральных органов власти, таких как правительство или банк. Хотя *некоторые* криптовалютные проекты могут позволить вам совершать приватные транзакции онлайн, многие из них используют публичный блокчейн, который не обеспечивает конфиденциальности транзакций. Криптовалюты также имеют тенденцию быть очень волатильными активами, то есть их стоимость может быстро и значительно измениться в любой момент. Поэтому мы обычно не рекомендуем использовать криптовалюту в качестве долгосрочного хранилища финансов. Если вы решили использовать криптовалюту для онлайн-платежей, убедитесь, что вы заранее полностью изучили аспекты ее конфиденциальности, и вкладывайте только те суммы, потеря которых не будет катастрофической. -!!! danger "Опасность" +
+

Danger

- Подавляющее большинство криптовалют работает на **публичном** блокчейне, что означает, что каждая транзакция является общеизвестной. Это касается даже самых известных криптовалют, таких как Bitcoin и Ethereum. Операции с этими криптовалютами не должны считаться приватными и они не защитят вашу анонимность. - - Кроме того, многие, если не большинство криптовалют, являются скамом. Осуществляйте транзакции осторожно, используя только те проекты, которым вы доверяете. +Подавляющее большинство криптовалют работает на **публичном** блокчейне, что означает, что каждая транзакция является общеизвестной. Это касается даже самых известных криптовалют, таких как Bitcoin и Ethereum. Операции с этими криптовалютами не должны считаться приватными и они не защитят вашу анонимность. + +Кроме того, многие, если не большинство криптовалют, являются скамом. Осуществляйте транзакции осторожно, используя только те проекты, которым вы доверяете. + +
### Конфиденциальные монеты diff --git a/i18n/ru/advanced/tor-overview.md b/i18n/ru/advanced/tor-overview.md index 4ca356da..1267ca75 100644 --- a/i18n/ru/advanced/tor-overview.md +++ b/i18n/ru/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/ru/basics/account-creation.md b/i18n/ru/basics/account-creation.md index fd908609..ac071a28 100644 --- a/i18n/ru/basics/account-creation.md +++ b/i18n/ru/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Как создавать аккаунты в интернете конфиденциально - Privacy Guides" -title: "Создание аккаунтов" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: Создание аккаунтов в интернете является, практически, необходимостью, предпримите следующие шаги, чтобы сохранить вашу конфиденциальность. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Часто люди регистрируются на сайтах, не задумываясь. Возможно, это стриминг, позволяющий смотреть новое шоу, о котором все говорят, или аккаунт, предоставляющий скидку в любимом заведении быстрого питания. В любом случае вы должны рассмотреть сегодняшние и последующие последствия для ваших данных. @@ -29,9 +29,12 @@ description: Создание аккаунтов в интернете явля Самый распространенный способ создания новой учетной записи - это адрес электронной почты и пароль. При использовании этого метода следует использовать менеджер паролей и следовать [лучшим практикам](passwords-overview.md) при выборе паролей. -!!! tip "Совет" +
+

Tip

- Вы можете использовать свой менеджер паролей также и для организации других методов аутентификации! Просто добавьте новую запись и заполните соответствующие поля, вы можете добавить примечания для таких вещей, как вопросы безопасности или резервный код. +Вы можете использовать свой менеджер паролей также и для организации других методов аутентификации! Просто добавьте новую запись и заполните соответствующие поля, вы можете добавить примечания для таких вещей, как вопросы безопасности или резервный код. + +
Вы будете ответственны за управление своими данными для входа в систему. Для дополнительной безопасности вы можете настроить [МФА](multi-factor-authentication.md) в своих аккаунтах. diff --git a/i18n/ru/basics/common-misconceptions.md b/i18n/ru/basics/common-misconceptions.md index b4fd75ce..c38829af 100644 --- a/i18n/ru/basics/common-misconceptions.md +++ b/i18n/ru/basics/common-misconceptions.md @@ -75,20 +75,23 @@ schema: Одна из самых четких моделей угроз - это модель, в которой люди *знают, кто вы*, и модель, в которой они этого не знают. Всегда будут ситуации, когда вы должны объявить свое юридическое имя, а есть такие, где это не нужно. -1. **Известная личность** - известная личность используется в случаях, когда необходимо объявить свое имя. Существует множество юридических документов и контрактов, где требуется удостоверение личности. Это может быть открытие банковского счета, подписание договора аренды недвижимости, получение паспорта, оформление таможенных деклараций при импорте товаров или другие действия, связанные с вашим правительством. Обычно это связано с такими учетными данными, как кредитные карты, проверка кредитного рейтинга, номера счетов и, возможно, физические адреса. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Мы не рекомендуем использовать VPN или Tor для этих целей, поскольку ваша личность уже известна другими способами. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "Совет" - - При совершении покупок онлайн, использование [постамата](https://ru.wikipedia.org/wiki/%D0%90%D0%B2%D1%82%D0%BE%D0%BC%D0%B0%D1%82%D0%B8%D0%B7%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D0%B0%D1%8F_%D0%BF%D0%BE%D1%87%D1%82%D0%BE%D0%B2%D0%B0%D1%8F_%D1%81%D1%82%D0%B0%D0%BD%D1%86%D0%B8%D1%8F) поможет сохранить ваш физический адрес в тайне. +
+

Tip

+ +При совершении покупок онлайн, использование [постамата](https://ru.wikipedia.org/wiki/%D0%90%D0%B2%D1%82%D0%BE%D0%BC%D0%B0%D1%82%D0%B8%D0%B7%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D0%B0%D1%8F_%D0%BF%D0%BE%D1%87%D1%82%D0%BE%D0%B2%D0%B0%D1%8F_%D1%81%D1%82%D0%B0%D0%BD%D1%86%D0%B8%D1%8F) поможет сохранить ваш физический адрес в тайне. + +
2. **Неизвестная личность** - неизвестная личность может быть устойчивым псевдонимом, который вы регулярно используете. Она не анонимна, потому что не меняется. Если вы являетесь частью онлайн-сообщества, вы можете захотеть сохранить личность, которую знают другие. Этот псевдоним не является анонимным, поскольку, если достаточно долго понаблюдать, можно заметить некоторые детали, которые раскроют дополнительную информацию, такую как манера письма, общие знания по интересующим темам и т.д. - Для этого вы можете использовать VPN, чтобы замаскировать свой IP-адрес. Финансовые операции сложнее замаскировать: вы можете рассмотреть возможность использования анонимных криптовалют, таких как [Monero](https://www.getmonero.org/). Использование альткоин-шифтинга также может помочь замаскировать место происхождения вашей валюты. Как правило, биржи требуют заполнения KYC (знай своего клиента), прежде чем они позволят вам обменять фиатную валюту на любую криптовалюту. Варианты местных встреч также могут быть решением проблемы; однако они часто более дорогие и иногда требуют KYC. +Для этого вы можете использовать VPN, чтобы замаскировать свой IP-адрес. Финансовые операции сложнее замаскировать: вы можете рассмотреть возможность использования анонимных криптовалют, таких как [Monero](https://www.getmonero.org/). Использование альткоин-шифтинга также может помочь замаскировать место происхождения вашей валюты. Как правило, биржи требуют заполнения KYC (знай своего клиента), прежде чем они позволят вам обменять фиатную валюту на любую криптовалюту. Варианты местных встреч также могут быть решением проблемы; однако они часто более дорогие и иногда требуют KYC. 3. **Анонимная личность** - даже при наличии опыта анонимные личности трудно поддерживать в течение длительного времени. Это должны быть краткосрочные и недолговечные личности, которые регулярно меняются. - Использование Tor может помочь в этом. Стоит также отметить, что большая анонимность возможна при асинхронном общении: общение в реальном времени уязвимо для анализа шаблонов набора текста (т.е. более чем абзац текста, распространяемый на форуме, по электронной почте и т.д.) +Использование Tor может помочь в этом. Стоит также отметить, что большая анонимность возможна при асинхронном общении: общение в реальном времени уязвимо для анализа шаблонов набора текста (т.е. более чем абзац текста, распространяемый на форуме, по электронной почте и т.д.) [^1]: Одним из ярких примеров этого является инцидент [2021, когда исследователи из университета Миннесоты внедрили три уязвимости в проект разработки ядра Linux](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/ru/basics/common-threats.md b/i18n/ru/basics/common-threats.md index 0f4adbd3..60cdae9d 100644 --- a/i18n/ru/basics/common-threats.md +++ b/i18n/ru/basics/common-threats.md @@ -35,19 +35,25 @@ description: Модель угрозы уникальна для каждого, Чтобы минимизировать возможный ущерб, которое *может* причинить вредоносное ПО, следует использовать защиту путём разделения. К примеру, это может выражаться в использовании разных компьютеров для разных задач, использовании виртуальных машин для разделения различных групп связанных приложений или использовании безопасной операционной системы с сильным акцентом на "песочницу" приложений и обязательный контроль доступа. -!!! tip "Совет" +
+

Tip

- Мобильные операционные системы, как правило, имеют лучшую "песочницу" для приложений, чем настольные операционные системы: приложения не могут получить root-доступ и требуют разрешения на доступ к системным ресурсам. - - Настольные операционные системы, как правило, отстают по части надлежащей "песочницы". ChromeOS имеет возможности "песочницы", аналогичные Android, а macOS имеет полный контроль системных разрешений (и разработчики могут отказаться от "песочницы" для приложений). Однако эти операционные системы передают идентифицирующую информацию своим соответствующим OEM-производителям. Linux, как правило, не предоставляет информацию поставщикам систем, но имеет слабую защиту от эксплойтов и вредоносных приложений. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Мобильные операционные системы, как правило, имеют лучшую "песочницу" для приложений, чем настольные операционные системы: приложения не могут получить root-доступ и требуют разрешения на доступ к системным ресурсам. + +Настольные операционные системы, как правило, отстают по части надлежащей "песочницы". ChromeOS имеет возможности "песочницы", аналогичные Android, а macOS имеет полный контроль системных разрешений (и разработчики могут отказаться от "песочницы" для приложений). Однако эти операционные системы передают идентифицирующую информацию своим соответствующим OEM-производителям. Linux, как правило, не предоставляет информацию поставщикам систем, но имеет слабую защиту от эксплойтов и вредоносных приложений. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Целевые атаки С целенаправленными атаками на конкретного человека бороться сложнее. К распространенным атакам относятся рассылка вредоносных документов по электронной почте, использование уязвимостей (например, в браузерах и операционных системах) и физические атаки. Если это вас беспокоит, вам следует использовать более продвинутые стратегии защиты от угроз. -!!! tip "Совет" +
+

Tip

- По своей конструкции **веб-браузеры**, **почтовые клиенты** и **офисные приложения** обычно выполняют ненадёжный код, переданный вам третьими лицами. Запуск нескольких виртуальных машин для отделения подобных приложений от хост-системы, а также друг от друга - это одна из техник, которую можно использовать для снижения вероятности того, что эксплойт в этих приложениях скомпрометирует остальную часть вашей системы. Например, такие технологии, как Qubes OS или Microsoft Defender Application Guard в Windows, предоставляют удобные методы для этого. +По своей конструкции **веб-браузеры**, **почтовые клиенты** и **офисные приложения** обычно выполняют ненадёжный код, переданный вам третьими лицами. Запуск нескольких виртуальных машин для отделения подобных приложений от хост-системы, а также друг от друга - это одна из техник, которую можно использовать для снижения вероятности того, что эксплойт в этих приложениях скомпрометирует остальную часть вашей системы. Например, такие технологии, как Qubes OS или Microsoft Defender Application Guard в Windows, предоставляют удобные методы для этого. + +
Если вы опасаетесь **физических атак**, вам следует использовать операционную систему с реализацией безопасной проверенной загрузки, например Android, iOS, macOS или [Windows (с TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Также следует убедиться, что диск зашифрован и что операционная система использует TPM или [Secure Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) или [Secure Element](https://developers.google.com/android/security/android-ready-se) для ограничения количества попыток ввода парольной фразы шифрования. Вам следует избегать совместного использования компьютера с людьми, которым вы не доверяете, поскольку большинство настольных операционных систем не шифруют данные отдельно для каждого пользователя. @@ -61,13 +67,16 @@ description: Модель угрозы уникальна для каждого, К счастью, сквозное шифрование (далее - E2EE) может облегчить эту проблему, шифруя сообщения между вами и желаемыми получателями еще до того, как они будут отправлены на сервер. Конфиденциальность ваших сообщений гарантирована при условии, что поставщик услуг не имеет доступа к закрытым ключам ни одной из сторон. -!!! note "Примечание о шифровании на основе веб-технологий" +
+

Note on Web-based Encryption

- На практике эффективность различных реализаций E2EE может варьироваться. Приложения, такие как [Signal](../real-time-communication.md#signal), работают на вашем устройстве, и каждая копия приложения является одинаковой при различных установках. Если поставщик услуг внедрит [backdoor](https://ru.wikipedia.org/wiki/%D0%91%D1%8D%D0%BA%D0%B4%D0%BE%D1%80) в свое приложение - в попытке украсть ваши закрытые ключи - это можно будет обнаружить с помощью [reverse engineering](https://ru.wikipedia.org/wiki/%D0%9E%D0%B1%D1%80%D0%B0%D1%82%D0%BD%D0%B0%D1%8F_%D1%80%D0%B0%D0%B7%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B0). - - С другой стороны, реализации E2EE, такие, как почта Proton Mail или *Web Vault* от Bitwarden, полагаются на то, что сервер динамически предоставляет браузеру код JavaScript для обработки криптографии. Вредоносный сервер может нацелиться на вас и отправить вам вредоносный код JavaScript, чтобы украсть ваш ключ шифрования (и это будет крайне сложно заметить). Поскольку сервер может выбирать для обслуживания разных веб-клиентов разных людей - даже если вы заметили атаку - доказать вину провайдера будет невероятно сложно. - - Поэтому при любой возможности следует использовать нативные приложения вместо веб-клиентов. +На практике эффективность различных реализаций E2EE может варьироваться. Приложения, такие как [Signal](../real-time-communication.md#signal), работают на вашем устройстве, и каждая копия приложения является одинаковой при различных установках. Если поставщик услуг внедрит [backdoor](https://ru.wikipedia.org/wiki/%D0%91%D1%8D%D0%BA%D0%B4%D0%BE%D1%80) в свое приложение - в попытке украсть ваши закрытые ключи - это можно будет обнаружить с помощью [reverse engineering](https://ru.wikipedia.org/wiki/%D0%9E%D0%B1%D1%80%D0%B0%D1%82%D0%BD%D0%B0%D1%8F_%D1%80%D0%B0%D0%B7%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B0). + +С другой стороны, реализации E2EE, такие, как почта Proton Mail или *Web Vault* от Bitwarden, полагаются на то, что сервер динамически предоставляет браузеру код JavaScript для обработки криптографии. Вредоносный сервер может нацелиться на вас и отправить вам вредоносный код JavaScript, чтобы украсть ваш ключ шифрования (и это будет крайне сложно заметить). Поскольку сервер может выбирать для обслуживания разных веб-клиентов разных людей - даже если вы заметили атаку - доказать вину провайдера будет невероятно сложно. + +Поэтому при любой возможности следует использовать нативные приложения вместо веб-клиентов. + +
Даже при использовании E2EE поставщики услуг все равно могут составить ваш профиль на основе **метаданных**, которые, как правило, не защищены. Хотя поставщик услуг не может читать ваши сообщения, он все же может наблюдать за такими важными вещами, как то, с кем вы общаетесь, как часто вы пишете им сообщения и когда вы обычно активны. Защита метаданных - довольно редкое явление, и, если это входит в вашу [модель угроз](threat-modeling.md), вам следует обратить пристальное внимание на техническую документацию используемого вами программного обеспечения, чтобы узнать, есть ли в нем минимизация или защита метаданных вообще. @@ -77,17 +86,23 @@ description: Модель угрозы уникальна для каждого, Массовое наблюдение - это изощренные способы по отслеживанию "поведения, многих действий или информации" всего населения (или значительной его части).[^1] Часто это относится к правительственным программам, например[раскрытым Эдвардом Сноуденом в 2013 году](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). Однако она может осуществляться и корпорациями, либо по поручению государственных органов, либо по собственной инициативе. -!!! abstract "Атлас наблюдений" +
+

Atlas of Surveillance

- Если вы хотите узнать больше о методах наблюдения и о том, как они применяются в вашем городе, вы также можете взглянуть на [Атлас наблюдения](https://atlasofsurveillance.org/) от [Electronic Frontier Foundation](https://www.eff.org/). - - Во Франции вы можете заглянуть на сайт [Technolopolice](https://technopolice.fr/villes/), поддерживаемый некоммерческой ассоциацией La Quadrature du Net. +Если вы хотите узнать больше о методах наблюдения и о том, как они применяются в вашем городе, вы также можете взглянуть на [Атлас наблюдения](https://atlasofsurveillance.org/) от [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Правительства часто оправдывают программы массовой слежки как необходимые средства для борьбы с терроризмом и предотвращения преступлений. Однако, нарушая права человека, она чаще всего используется для непропорционального преследования меньшинств и политических диссидентов. -!!! quote "ACLU: [*Урок конфиденциальности после 11 сентября: Массовое наблюдение - не путь вперед*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Перед лицом [разоблачений Эдварда Сноудена о таких правительственных программах, как [PRISM](https://en.wikipedia.org/wiki/PRISM) и [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], представители разведки также признали, что АНБ в течение многих лет тайно собирало записи о телефонных звонках практически каждого американца - кто кому звонит, когда эти звонки совершаются и как долго они длятся. Подобная информация, накапливаемая АНБ день за днем, может раскрыть невероятно чувствительные детали о жизни и связях людей, например, звонили ли они пастору, специалисту по абортам, консультанту по наркомании или на горячую линию для самоубийц. +Перед лицом [разоблачений Эдварда Сноудена о таких правительственных программах, как [PRISM](https://en.wikipedia.org/wiki/PRISM) и [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], представители разведки также признали, что АНБ в течение многих лет тайно собирало записи о телефонных звонках практически каждого американца - кто кому звонит, когда эти звонки совершаются и как долго они длятся. Подобная информация, накапливаемая АНБ день за днем, может раскрыть невероятно чувствительные детали о жизни и связях людей, например, звонили ли они пастору, специалисту по абортам, консультанту по наркомании или на горячую линию для самоубийц. + +
Несмотря на растущую массовую слежку в Соединенных Штатах, правительство обнаружило, что программы массовой слежки, такие как Раздел 215, имеют "мало уникальной ценности" в отношении пресечения реальных преступлений или террористических заговоров, а усилия в основном дублируют собственные целевые программы слежки ФБР.[^2] @@ -133,11 +148,14 @@ description: Модель угрозы уникальна для каждого, Люди, обеспокоенные угрозой цензуры, могут использовать такие технологии, как [Tor](../advanced/tor-overview.md), чтобы обойти ее, и поддерживать устойчивые к цензуре платформы для общения, такие как [Matrix](../real-time-communication.md#element), где нет централизованного органа, который может произвольно закрыть учетные записи. -!!! tip "Совет" +
+

Tip

- Хотя уклонение от цензуры само по себе может быть легким, скрыть тот факт, что вы это делаете, может быть очень проблематично. - - Вы должны учитывать, какие аспекты сети может наблюдать ваш оппонент и имеете ли вы достаточные основания для отрицания своих действий (англ. - plausible deniability). Например, использование [шифрованного DNS](../advanced/dns-overview.md#what-is-encrypted-dns) может помочь вам обойти примитивные системы цензуры, основанные на DNS, но оно не может действительно скрыть то, что вы посещаете, от вашего интернет-провайдера. VPN или Tor могут помочь скрыть от администраторов сетей то, что вы посещаете, но не могут скрыть, что вы вообще пользуетесь этими сетями. Шифрованные сетевые туннели (такие, как Obfs4proxy, Meek или Shadowsocks) могут помочь вам обойти брандмауэры, блокирующие распространенные протоколы VPN или Tor, но ваши попытки обхода блокировки могут быть обнаружены методами, такими как сканирование или [DPI](https://ru.wikipedia.org/wiki/Deep_packet_inspection). +Хотя уклонение от цензуры само по себе может быть легким, скрыть тот факт, что вы это делаете, может быть очень проблематично. + +Вы должны учитывать, какие аспекты сети может наблюдать ваш оппонент и имеете ли вы достаточные основания для отрицания своих действий (англ. - plausible deniability). Например, использование [шифрованного DNS](../advanced/dns-overview.md#what-is-encrypted-dns) может помочь вам обойти примитивные системы цензуры, основанные на DNS, но оно не может действительно скрыть то, что вы посещаете, от вашего интернет-провайдера. VPN или Tor могут помочь скрыть от администраторов сетей то, что вы посещаете, но не могут скрыть, что вы вообще пользуетесь этими сетями. Шифрованные сетевые туннели (такие, как Obfs4proxy, Meek или Shadowsocks) могут помочь вам обойти брандмауэры, блокирующие распространенные протоколы VPN или Tor, но ваши попытки обхода блокировки могут быть обнаружены методами, такими как сканирование или [DPI](https://ru.wikipedia.org/wiki/Deep_packet_inspection). + +
Вы всегда должны учитывать риски при попытке обойти цензуру, возможные последствия и то, насколько изощренным может быть ваш враг. Вы должны быть осторожны в выборе программного обеспечения и иметь запасной план на случай, если вас поймают. diff --git a/i18n/ru/basics/multi-factor-authentication.md b/i18n/ru/basics/multi-factor-authentication.md index 60256e96..a7d5808b 100644 --- a/i18n/ru/basics/multi-factor-authentication.md +++ b/i18n/ru/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLog ### Linux -!!! warning "Осторожно" +
+

Предупреждение

- Если имя хоста вашей системы изменится (например, из-за DHCP), вы не сможете залогиниться. Очень важно, чтобы вы установили правильное имя хоста для своего компьютера, прежде чем следовать этому руководству. +Если имя хоста вашей системы изменится (например, из-за DHCP), вы не сможете залогиниться. Очень важно, чтобы вы установили правильное имя хоста для своего компьютера, прежде чем следовать этому руководству. + +
Модуль `pam_u2f` в Linux может обеспечить двухфакторную аутентификацию для входа в систему в большинстве популярных дистрибутивов Linux. Если у вас есть аппаратный ключ безопасности, поддерживающий U2F, вы можете настроить МФА для входа в систему. На сайте Yubico есть руководство [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F), которое должно работать в любом дистрибутиве. Команды менеджера пакетов - например, `apt-get`- и названия пакетов могут отличаться. Данное руководство **не** применимо к Qubes OS. diff --git a/i18n/ru/basics/passwords-overview.md b/i18n/ru/basics/passwords-overview.md index 87c29994..4dad8d52 100644 --- a/i18n/ru/basics/passwords-overview.md +++ b/i18n/ru/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Введение в пароли" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Вот несколько советов и рекомендаций о том, как создавать самые надежные пароли и обеспечивать безопасность своих учетных записей. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Пароли являются неотъемлемой частью нашей повседневной цифровой жизни. Мы используем их для защиты наших аккаунтов, девайсов и секретов. Очень часто пароли, это единственное, что защищает нас от злоумышленников, которые хотят получить нашу личную информацию или деньги. Несмотря на это, паролям не уделяют должного внимания, что часто приводит к использованию простых паролей, которые легко угадать или подобрать. @@ -26,9 +26,12 @@ description: Вот несколько советов и рекомендаци Что касается паролей, которые вам не нужно запоминать (например, пароли, хранящиеся в менеджере паролей), если [модель угроз](threat-modeling.md) требует этого, мы рекомендуем просматривать важные учетные записи (особенно те, которые не используют многофакторную аутентификацию) и менять их пароль каждые пару месяцев, на случай, если они были скомпрометированы в результате утечки данных, которая еще не стала известной. Большинство менеджеров паролей позволяют установить срок действия пароля, чтобы облегчить отслеживание их давности. -!!! tip "Проверка утечек данных" +
+

Checking for data breaches

- Если ваш менеджер паролей позволяет проверять скомпрометированные пароли, обязательно сделайте это и незамедлительно измените любой пароль, который мог быть раскрыт в результате утечки данных. В качестве альтернативы вы можете подписаться на [ленту последних взломов от Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) с помощью [агрегатора новостей](../news-aggregators.md). +Если ваш менеджер паролей позволяет проверять скомпрометированные пароли, обязательно сделайте это и незамедлительно измените любой пароль, который мог быть раскрыт в результате утечки данных. В качестве альтернативы вы можете подписаться на [ленту последних взломов от Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) с помощью [агрегатора новостей](../news-aggregators.md). + +
## Создание надежных паролей @@ -48,9 +51,12 @@ description: Вот несколько советов и рекомендаци Чтобы сгенерировать парольную фразу с использованием настоящих игральных кубиков, выполните следующие действия: -!!! note "Примечание" +
+

Note

- Эти инструкции предполагают, что вы используете [большой список слов EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) для генерации парольной фразы, что требует пяти бросков кубика на слово. Другие списки слов могут требовать больше или меньше бросков на слово, и могут потребоваться другое количество слов для достижения той же энтропии. +Эти инструкции предполагают, что вы используете [большой список слов EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) для генерации парольной фразы, что требует пяти бросков кубика на слово. Другие списки слов могут требовать больше или меньше бросков на слово, и могут потребоваться другое количество слов для достижения той же энтропии. + +
1. Бросьте шестигранный кубик пять раз, записывая число после каждого броска. @@ -60,31 +66,37 @@ description: Вот несколько советов и рекомендаци 4. Повторяйте этот процесс до тех пор, пока ваша парольная фраза не будет содержать столько слов, сколько вам нужно, которые следует разделять пробелом. -!!! warning "Важно" +
+

Important

- Вы **не** должны перебрасывать кубик, в надежде получить комбинацию слов, которая вам нравится. Процесс должен быть полностью случайным. +Вы **не** должны перебрасывать кубик, в надежде получить комбинацию слов, которая вам нравится. Процесс должен быть полностью случайным. + +
Если у вас нет доступа к настоящим игральным костям или вы предпочитаете не использовать их, вы можете воспользоваться встроенным в менеджере паролей генератором паролей, поскольку большинство из них имеют возможность генерировать парольные фразы в дополнение к обычным паролям. Мы рекомендуем использовать [большой список слов EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) для генерации парольных фраз, поскольку он обеспечивает точно такую же безопасность, как и оригинальный список, но содержит слова, которые легче запомнить. Есть также [другие списки слов на разных языках](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), если вы не хотите, чтобы ваша парольная фраза была на английском языке. -??? note "Объяснение энтропии и прочности парольных фраз, созданных с помощью кубика" +
+Explanation of entropy and strength of diceware passphrases - Чтобы продемонстрировать, насколько сильны такие парольные фразы, мы воспользуемся вышеупомянутой парольной фразой из семи слов (`viewable fastness reluctant squishy seventeen shown pencil`) и [большим списком слов EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) в качестве примера. - - Одним из показателей для определения силы парольной фразы является ее энтропия. Энтропия каждого слова в парольной фразе вычисляется как $\text{log}_2(\text{Слов-в-списке})$, а общая энтропия парольной фразы вычисляется как $\text{log}_2(\text{Слов-в-списке}^\text{Слов-в-фразе})$. - - Таким образом, каждое слово в вышеупомянутом списке дает ~12,9 бит энтропии ($\text{log}_2(7776)$), а парольная фраза из семи слов имеет ~90,47 бит энтропии ($\text{log}_2(7776^7)$). - - [Большой список слов EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) содержит 7776 уникальных слов. Чтобы вычислить количество возможных парольных фраз, достаточно $\text{Слов-в-списке}^\text{Слов-в-фразе}$, или, в нашем случае, $7776^7$. - - Давайте представим все это в перспективе: парольная фраза из семи слов, использующая [большой список слов EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt), является одной из ~1 719 070 799 748 422 500 000 000 000 000 возможных парольных фраз. - - В среднем, чтобы угадать вашу фразу, нужно попробовать 50% всех возможных комбинаций. Учитывая это, даже если ваш противник способен на ~1 000 000 000 000 000 000 угадываний в секунду, ему все равно потребуется ~27 255 689 лет, чтобы угадать вашу кодовую фразу. Это так, даже если верны следующие вещи: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Ваш противник знает, что вы использовали метод с кубиком. - - Ваш противник знает конкретный список слов, который вы использовали. - - Ваш противник знает, сколько слов содержит ваша парольная фраза. +Одним из показателей для определения силы парольной фразы является ее энтропия. Энтропия каждого слова в парольной фразе вычисляется как $\text{log}_2(\text{Слов-в-списке})$, а общая энтропия парольной фразы вычисляется как $\text{log}_2(\text{Слов-в-списке}^\text{Слов-в-фразе})$. + +Таким образом, каждое слово в вышеупомянутом списке дает ~12,9 бит энтропии ($\text{log}_2(7776)$), а парольная фраза из семи слов имеет ~90,47 бит энтропии ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. Чтобы вычислить количество возможных парольных фраз, достаточно $\text{Слов-в-списке}^\text{Слов-в-фразе}$, или, в нашем случае, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +В среднем, чтобы угадать вашу фразу, нужно попробовать 50% всех возможных комбинаций. Учитывая это, даже если ваш противник способен на ~1 000 000 000 000 000 000 угадываний в секунду, ему все равно потребуется ~27 255 689 лет, чтобы угадать вашу кодовую фразу. Это так, даже если верны следующие вещи: + +- Ваш противник знает, что вы использовали метод с кубиком. +- Ваш противник знает конкретный список слов, который вы использовали. +- Ваш противник знает, сколько слов содержит ваша парольная фраза. + +
Подводя итог, можно сказать, что парольные фразы с помощью кубика - это лучший вариант, если вам нужно что-то такое, что легко запомнить *и* исключительно сильное. @@ -98,13 +110,16 @@ description: Вот несколько советов и рекомендаци [Список рекомендуемых менеджеров паролей](../passwords.md ""){.md-button} -!!! warning "Не размещайте пароли и TOTP-токены в одном менеджере паролей" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- При использовании TOTP-кодов в качестве [многофакторной аутентификации](../multi-factor-authentication.md), лучшей практикой безопасности является хранение TOTP-кодов в [отдельном приложении](../multi-factor-authentication.md#authenticator-apps). - - Хранение TOTP-токенов в том же месте, что и паролей, хотя и удобно, но сводит защиту учетных записей к одному фактору в случае, если злоумышленник получит доступ к вашему менеджеру паролей. - - Кроме того, мы не рекомендуем хранить одноразовые коды восстановления в менеджере паролей. Их следует хранить отдельно, например, в зашифрованном контейнере на автономном устройстве хранения. +При использовании TOTP-кодов в качестве [многофакторной аутентификации](../multi-factor-authentication.md), лучшей практикой безопасности является хранение TOTP-кодов в [отдельном приложении](../multi-factor-authentication.md#authenticator-apps). + +Хранение TOTP-токенов в том же месте, что и паролей, хотя и удобно, но сводит защиту учетных записей к одному фактору в случае, если злоумышленник получит доступ к вашему менеджеру паролей. + +Кроме того, мы не рекомендуем хранить одноразовые коды восстановления в менеджере паролей. Их следует хранить отдельно, например, в зашифрованном контейнере на автономном устройстве хранения. + +
### Резервное копирование diff --git a/i18n/ru/basics/vpn-overview.md b/i18n/ru/basics/vpn-overview.md index d4984918..6cc199ac 100644 --- a/i18n/ru/basics/vpn-overview.md +++ b/i18n/ru/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "Как VPN защищает вашу конфиденциальность? Наш обзор VPN - Privacy Guides" -title: Обзор VPN +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Виртуальные частные сети переносят риск от вашего провайдера на третью сторону, которой вы доверяете. Вам следует помнить об этих вещах. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note "Примечание" +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/ru/os/android-overview.md b/i18n/ru/os/android-overview.md index 2374eb81..59ffb51b 100644 --- a/i18n/ru/os/android-overview.md +++ b/i18n/ru/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Обзор Android +title: Android Overview icon: simple/android -description: Android - это операционная система с открытым исходным кодом, которая предоставляет надежную защиту, что делает ее нашим главным выбором для телефонов. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Логотип Android](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ Android 13: [Exodus](https://exodus-privacy.eu.org/) может быть полезен при сравнении приложений с похожими функциями. Если приложение запрашивает много разрешений и имеет много рекламы и аналитики, это вероятно плохой знак. Мы рекомендуем обращать внимание на конкретные трекеры и читать их описание, вместо того, чтобы просто **посчитать их общее количество** и предположить, что они все одинаковые. -!!! warning "Осторожно" +
+

Предупреждение

- Если приложение в основном представляет собой веб-сервис, отслеживание может происходить на стороне сервера. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) показывает 0 трекеров, но, безусловно, отслеживает интересы и поведение пользователей на сайте. Приложения могут избежать обнаружения, не используя стандартные библиотеки кода, созданные рекламной индустрией, хотя это маловероятно. +Если приложение в основном представляет собой веб-сервис, отслеживание может происходить на стороне сервера. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) показывает 0 трекеров, но, безусловно, отслеживает интересы и поведение пользователей на сайте. Приложения могут избежать обнаружения, не используя стандартные библиотеки кода, созданные рекламной индустрией, хотя это маловероятно. -!!! note "Примечание" +
- Приложения, уважающие вашу конфиденциальность, например [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/), могут показывать некоторые трекеры, например [Google Firebase Analytics] (https://reports.exodus-privacy.eu.org/en/trackers/49/). Эта библиотека включает [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging), которая нужна для поддержки [push-уведомлений](https://en.wikipedia.org/wiki/Push_technology) в приложениях. Именно [это относится](https://fosstodon.org/@bitwarden/109636825700482007) к Bitwarden. Это не означает, что Bitwarden использует все возможности аналитики, которые предоставляет Google Firebase Analytics. +
+

Note

+ +Приложения, уважающие вашу конфиденциальность, например [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/), могут показывать некоторые трекеры, например [Google Firebase Analytics] (https://reports.exodus-privacy.eu.org/en/trackers/49/). Эта библиотека включает [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging), которая нужна для поддержки [push-уведомлений](https://en.wikipedia.org/wiki/Push_technology) в приложениях. Именно [это относится](https://fosstodon.org/@bitwarden/109636825700482007) к Bitwarden. Это не означает, что Bitwarden использует все возможности аналитики, которые предоставляет Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/ru/os/ios-overview.md b/i18n/ru/os/ios-overview.md index 5297c8d9..d303d97a 100644 --- a/i18n/ru/os/ios-overview.md +++ b/i18n/ru/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning "Осторожно" +
+

Предупреждение

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/ru/os/macos-overview.md b/i18n/ru/os/macos-overview.md index 8ce2a3ae..3e741537 100644 --- a/i18n/ru/os/macos-overview.md +++ b/i18n/ru/os/macos-overview.md @@ -1,5 +1,5 @@ --- -title: Обзор macOS +title: macOS Overview icon: material/apple-finder description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning "Осторожно" +
+

Предупреждение

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning "Осторожно" +
+

Предупреждение

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/ru/os/qubes-overview.md b/i18n/ru/os/qubes-overview.md index 7cdeab30..c9279254 100644 --- a/i18n/ru/os/qubes-overview.md +++ b/i18n/ru/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes использует [компартментализацию(разделение)](https://www.qubes-os.org/intro/) для обеспечения безопасности системы. Qubes создаются на основе шаблонов, по умолчанию Fedora, Debian и [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Архитектура Qubes](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for contr To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Разница в том, что опция **Move** удалит исходный файл. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Этого не требуется при использовании системы копирования между несколькими Qubes. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. При этом изменения вносятся не сразу и могут быть легко отменены в случае аварии. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. При этом изменения вносятся не сразу и могут быть легко отменены в случае аварии. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Взаимодействие между ВМ diff --git a/i18n/sv/advanced/payments.md b/i18n/sv/advanced/payments.md index 6758c2a2..df356a03 100644 --- a/i18n/sv/advanced/payments.md +++ b/i18n/sv/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! fara +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/sv/advanced/tor-overview.md b/i18n/sv/advanced/tor-overview.md index a123abae..dda1435b 100644 --- a/i18n/sv/advanced/tor-overview.md +++ b/i18n/sv/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/sv/basics/account-creation.md b/i18n/sv/basics/account-creation.md index 9db38ff7..16f79eb6 100644 --- a/i18n/sv/basics/account-creation.md +++ b/i18n/sv/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tips +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/sv/basics/common-misconceptions.md b/i18n/sv/basics/common-misconceptions.md index 0fd4d28d..74650997 100644 --- a/i18n/sv/basics/common-misconceptions.md +++ b/i18n/sv/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tips - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/sv/basics/common-threats.md b/i18n/sv/basics/common-threats.md index bd77d721..c9351259 100644 --- a/i18n/sv/basics/common-threats.md +++ b/i18n/sv/basics/common-threats.md @@ -35,19 +35,25 @@ När det gäller applikationssäkerhet vet vi i allmänhet inte (och kan ibland För att minimera den skada som en skadlig programvara ** kan orsaka bör du använda säkerhet genom uppdelning. Det kan till exempel handla om att använda olika datorer för olika jobb, att använda virtuella maskiner för att separera olika grupper av relaterade program eller att använda ett säkert operativsystem med starkt fokus på sandlåda för program och obligatorisk åtkomstkontroll. -!!! tips +
+

Tip

- Mobila operativsystem har i allmänhet bättre applikationssandlåda än stationära operativsystem: Appar kan inte få root-åtkomst och kräver tillstånd för åtkomst till systemresurser. - - Skrivbordsoperativsystem släpar i allmänhet efter vid korrekt sandlåda. ChromeOS har liknande sandlådor som Android och macOS har fullständig kontroll över systembehörigheter (och utvecklare kan välja att sandlådor ska användas för program). Dessa operativsystem överför dock identifieringsinformation till sina respektive OEM-tillverkare. Linux tenderar att inte lämna information till systemleverantörer, men har dåligt skydd mot exploateringar och skadliga program. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobila operativsystem har i allmänhet bättre applikationssandlåda än stationära operativsystem: Appar kan inte få root-åtkomst och kräver tillstånd för åtkomst till systemresurser. + +Skrivbordsoperativsystem släpar i allmänhet efter vid korrekt sandlåda. ChromeOS har liknande sandlådor som Android och macOS har fullständig kontroll över systembehörigheter (och utvecklare kan välja att sandlådor ska användas för program). Dessa operativsystem överför dock identifieringsinformation till sina respektive OEM-tillverkare. Linux tenderar att inte lämna information till systemleverantörer, men har dåligt skydd mot exploateringar och skadliga program. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Riktade attacker Riktade attacker mot en specifik person är mer problematiska att hantera. Vanliga attacker är att skicka skadliga dokument via e-post, utnyttja sårbarheter (t.ex. i webbläsare och operativsystem) och fysiska attacker. Om detta är ett problem för dig bör du använda mer avancerade strategier för att minska hoten. -!!! tips +
+

Tip

- I **webbläsare**, **emailklienter** och **kontorsprogram** körs vanligtvis kod som inte är tillförlitlig och som skickas till dig från tredje part. Att köra flera virtuella maskiner för att separera sådana här program från värdsystemet och från varandra är en teknik som du kan använda för att minska risken för att en exploatering i dessa program ska kunna äventyra resten av systemet. Tekniker som Qubes OS eller Microsoft Defender Application Guard på Windows ger till exempel praktiska metoder för att göra detta. +I **webbläsare**, **emailklienter** och **kontorsprogram** körs vanligtvis kod som inte är tillförlitlig och som skickas till dig från tredje part. Att köra flera virtuella maskiner för att separera sådana här program från värdsystemet och från varandra är en teknik som du kan använda för att minska risken för att en exploatering i dessa program ska kunna äventyra resten av systemet. Tekniker som Qubes OS eller Microsoft Defender Application Guard på Windows ger till exempel praktiska metoder för att göra detta. + +
Om du är orolig för **fysiska attacker** bör du använda ett operativsystem med en säker verifierad uppstart, t.ex. Android, iOS, macOS eller [Windows (med TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Du bör också se till att enheten är krypterad och att operativsystemet använder en TPM eller Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) eller [Element](https://developers.google.com/android/security/android-ready-se) för att begränsa försöken att ange krypteringsfrasen. Du bör undvika att dela din dator med personer du inte litar på, eftersom de flesta stationära operativsystem inte krypterar data separat per användare. @@ -61,13 +67,16 @@ Det uppenbara problemet med detta är att tjänsteleverantören (eller en hackar Tack och lov kan E2EE lindra detta problem genom att kryptera kommunikationen mellan dig och dina önskade mottagare innan den ens skickas till servern. Sekretessen för dina meddelanden garanteras, förutsatt att tjänsteleverantören inte har tillgång till någon av parternas privata nycklar. -!!! anmärkning "Anmärkning om webbaserad kryptering" +
+

Note on Web-based Encryption

- I praktiken varierar effektiviteten i olika E2EE-genomföranden. Applikationer, till exempel [Signal](../real-time-communication.md#signal), körs naturligt på din enhet, och varje kopia av applikationen är densamma över olika installationer. Om tjänsteleverantören skulle införa en [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) i sitt program - i ett försök att stjäla dina privata nycklar - skulle det senare kunna upptäckas med [reverse engineering] (https://en.wikipedia.org/wiki/Reverse_engineering). - - Å andra sidan är webbaserade E2EE-implementationer, som Proton Mail-webmail eller Bitwardens *Web Vault*, beroende av att servern dynamiskt serverar JavaScript-kod till webbläsaren för att hantera kryptografi. En skadlig server kan rikta dig och skicka skadlig JavaScript-kod för att stjäla din krypteringsnyckel (och det skulle vara extremt svårt att märka). Eftersom servern kan välja att betjäna olika webbklienter till olika människor - även om du märkte attacken - skulle det vara otroligt svårt att bevisa leverantörens skuld. - - Därför bör du använda inbyggda applikationer över webbklienter när det är möjligt. +I praktiken varierar effektiviteten i olika E2EE-genomföranden. Applikationer, till exempel [Signal](../real-time-communication.md#signal), körs naturligt på din enhet, och varje kopia av applikationen är densamma över olika installationer. Om tjänsteleverantören skulle införa en [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) i sitt program - i ett försök att stjäla dina privata nycklar - skulle det senare kunna upptäckas med [reverse engineering] (https://en.wikipedia.org/wiki/Reverse_engineering). + +Å andra sidan är webbaserade E2EE-implementationer, som Proton Mail-webmail eller Bitwardens *Web Vault*, beroende av att servern dynamiskt serverar JavaScript-kod till webbläsaren för att hantera kryptografi. En skadlig server kan rikta dig och skicka skadlig JavaScript-kod för att stjäla din krypteringsnyckel (och det skulle vara extremt svårt att märka). Eftersom servern kan välja att betjäna olika webbklienter till olika människor - även om du märkte attacken - skulle det vara otroligt svårt att bevisa leverantörens skuld. + +Därför bör du använda inbyggda applikationer över webbklienter när det är möjligt. + +
Även med E2EE kan tjänsteleverantörer fortfarande profilera dig utifrån **metadata**, som vanligtvis inte är skyddade. Medan tjänsteleverantören inte kan läsa dina meddelanden kan de fortfarande observera viktiga saker, till exempel vem du pratar med, hur ofta du skickar meddelanden till dem och när du vanligtvis är aktiv. Skydd av metadata är ganska ovanligt, och om det ingår i din hotmodell [](threat-modeling.md)- bör du vara uppmärksam på den tekniska dokumentationen för den programvara du använder för att se om det finns någon minimering eller något skydd av metadata överhuvudtaget. @@ -77,17 +86,23 @@ Tack och lov kan E2EE lindra detta problem genom att kryptera kommunikationen me Massövervakning är ett komplicerat försök att övervaka "beteende, många aktiviteter eller information" hos en hel (eller en stor del av en) befolkning.[^1] Det hänvisar ofta till statliga program, t.ex. de [som Edward Snowden avslöjade 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). Det kan dock också utföras av företag, antingen på uppdrag av myndigheter eller på eget initiativ. -!!! sammanfattning av "Atlas of Surveillance" +
+

Atlas of Surveillance

- Om du vill veta mer om övervakningsmetoder och hur de tillämpas i din stad kan du också ta en titt på [Atlas of Surveillance] (https://atlasofsurveillance.org/) från [Electronic Frontier Foundation] (https://www.eff.org/). - - I Frankrike kan du ta en titt på [Technolopolices webbplats](https://technopolice.fr/villes/) som upprätthålls av den ideella föreningen La Quadrature du Net. +Om du vill veta mer om övervakningsmetoder och hur de tillämpas i din stad kan du också ta en titt på [Atlas of Surveillance] (https://atlasofsurveillance.org/) från [Electronic Frontier Foundation] (https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Regeringar rättfärdigar ofta massövervakningsprogram som nödvändiga medel för att bekämpa terrorism och förebygga brottslighet. Men kränker de mänskliga rättigheterna, är det oftast används för att oproportionerligt rikta minoritetsgrupper och politiska dissidenter, bland annat. -!!! citat "ACLU: [*Det är en viktig fråga för den personliga integriteten: Massövervakning är inte vägen framåt*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Med anledning av [Edward Snowdens avslöjanden om regeringsprogram som [PRISM](https://en.wikipedia.org/wiki/PRISM) och [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)] erkände underrättelsetjänstemännen också att NSA i åratal i hemlighet hade samlat in uppgifter om praktiskt taget alla amerikaners telefonsamtal - vem som ringer till vem, när samtalen görs och hur länge de varar. Den här typen av information kan, när den samlas in av NSA dag efter dag, avslöja otroligt känsliga detaljer om människors liv och umgänge, t. ex. om de har ringt till en pastor, en abortvårdare, en missbruksrådgivare eller en självmordshotline. +Med anledning av [Edward Snowdens avslöjanden om regeringsprogram som [PRISM](https://en.wikipedia.org/wiki/PRISM) och [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)] erkände underrättelsetjänstemännen också att NSA i åratal i hemlighet hade samlat in uppgifter om praktiskt taget alla amerikaners telefonsamtal - vem som ringer till vem, när samtalen görs och hur länge de varar. Den här typen av information kan, när den samlas in av NSA dag efter dag, avslöja otroligt känsliga detaljer om människors liv och umgänge, t. ex. om de har ringt till en pastor, en abortvårdare, en missbruksrådgivare eller en självmordshotline. + +
Trots den ökande massövervakningen i USA har regeringen konstaterat att massövervakningsprogram som avsnitt 215 har haft "litet unikt värde" när det gäller att stoppa faktiska brott eller terroristplaner, och att insatserna i stort sett har varit en kopia av FBI:s egna riktade övervakningsprogram.[^2] @@ -133,11 +148,14 @@ Censur på företagsplattformar blir allt vanligare, eftersom plattformar som Tw Människor som oroar sig för hotet om censur kan använda teknik som [Tor](../advanced/tor-overview.md) för att kringgå den och stödja censurresistenta kommunikationsplattformar som [Matrix](../real-time-communication.md#element), som inte har någon centraliserad kontoinspektion som kan stänga konton godtyckligt. -!!! tips +
+

Tip

- Även om det kan vara lätt att undvika censur, kan det vara mycket problematiskt att dölja det faktum att du gör det. - - Du bör överväga vilka aspekter av nätverket din motståndare kan observera, och om du har trovärdigt förnekande för dina handlingar. Om du till exempel använder [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) kan det hjälpa dig att kringgå rudimentära DNS-baserade censursystem, men det kan inte dölja vad du besöker för din internetleverantör. En VPN eller Tor kan hjälpa till att dölja vad du besöker för nätverksadministratörer, men kan inte dölja att du använder nätverken överhuvudtaget. Pluggable transports (t.ex. Obfs4proxy, Meek eller Shadowsocks) kan hjälpa dig att undvika brandväggar som blockerar vanliga VPN-protokoll eller Tor, men dina försök att kringgå dem kan fortfarande upptäckas med metoder som probing eller [deep packet inspection] (https://en.wikipedia.org/wiki/Deep_packet_inspection). +Även om det kan vara lätt att undvika censur, kan det vara mycket problematiskt att dölja det faktum att du gör det. + +Du bör överväga vilka aspekter av nätverket din motståndare kan observera, och om du har trovärdigt förnekande för dina handlingar. Om du till exempel använder [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) kan det hjälpa dig att kringgå rudimentära DNS-baserade censursystem, men det kan inte dölja vad du besöker för din internetleverantör. En VPN eller Tor kan hjälpa till att dölja vad du besöker för nätverksadministratörer, men kan inte dölja att du använder nätverken överhuvudtaget. Pluggable transports (t.ex. Obfs4proxy, Meek eller Shadowsocks) kan hjälpa dig att undvika brandväggar som blockerar vanliga VPN-protokoll eller Tor, men dina försök att kringgå dem kan fortfarande upptäckas med metoder som probing eller [deep packet inspection] (https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
Du måste alltid överväga riskerna med att försöka kringgå censur, de potentiella konsekvenserna och hur sofistikerad din motståndare kan vara. Du bör vara försiktig när du väljer programvara och ha en backup-plan om du skulle bli upptäckt. diff --git a/i18n/sv/basics/multi-factor-authentication.md b/i18n/sv/basics/multi-factor-authentication.md index ac27dacf..b60e01a5 100644 --- a/i18n/sv/basics/multi-factor-authentication.md +++ b/i18n/sv/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ Kommandot förhindrar att en motståndare kringgår MFA när datorn startar. ### Linux -!!! varning +
+

Warning

- Om värdnamnet på ditt system ändras (till exempel på grund av DHCP), skulle du inte kunna logga in. Det är viktigt att du skapar ett korrekt värdnamn för din dator innan du följer den här guiden. +Om värdnamnet på ditt system ändras (till exempel på grund av DHCP), skulle du inte kunna logga in. Det är viktigt att du skapar ett korrekt värdnamn för din dator innan du följer den här guiden. + +
Modulen `pam_u2f` på Linux kan ge tvåfaktorsautentisering för inloggning på de flesta populära Linuxdistributioner. Om du har en maskinvarusäkerhetsnyckel som stöder U2F kan du konfigurera MFA-autentisering för inloggning. Yubico har en guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) som borde fungera för alla distributioner. Pakethanteraren kommandon-såsom `apt-get`-och paketnamn kan dock skilja sig. Den här guiden gäller **inte** för Qubes OS. diff --git a/i18n/sv/basics/passwords-overview.md b/i18n/sv/basics/passwords-overview.md index 00a21179..74e62bf1 100644 --- a/i18n/sv/basics/passwords-overview.md +++ b/i18n/sv/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! anmärkning +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Säkerhetskopior diff --git a/i18n/sv/basics/vpn-overview.md b/i18n/sv/basics/vpn-overview.md index e0f0a52a..e3c25d95 100644 --- a/i18n/sv/basics/vpn-overview.md +++ b/i18n/sv/basics/vpn-overview.md @@ -1,6 +1,6 @@ --- meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" -title: VPN-översikt +title: VPN Overview icon: material/vpn description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! anmärkning +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/sv/os/android-overview.md b/i18n/sv/os/android-overview.md index 0fda2cd5..1ffa3cdc 100644 --- a/i18n/sv/os/android-overview.md +++ b/i18n/sv/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! varning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! anmärkning +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/sv/os/ios-overview.md b/i18n/sv/os/ios-overview.md index bb4d692a..1f4dfbdc 100644 --- a/i18n/sv/os/ios-overview.md +++ b/i18n/sv/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! varning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/sv/os/macos-overview.md b/i18n/sv/os/macos-overview.md index e36af8fe..b10408a2 100644 --- a/i18n/sv/os/macos-overview.md +++ b/i18n/sv/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! varning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! varning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/sv/os/qubes-overview.md b/i18n/sv/os/qubes-overview.md index 2c63bc16..ecfb71b7 100644 --- a/i18n/sv/os/qubes-overview.md +++ b/i18n/sv/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes använder [compartmentalization](https://www.qubes-os.org/intro/) för att hålla systemet säkert. Qubes skapas från mallar, med Fedora, Debian och [Whonix](../desktop.md#whonix)som standard. Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes arkitektur](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes arkitektur, kredit: Vad är Qubes OS Intro
@@ -41,9 +44,12 @@ Du kan [kopiera och klistra in text](https://www.qubes-os.org/doc/how-to-copy-an To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Skillnaden är att alternativet **Move** raderar den ursprungliga filen. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Detta är inte nödvändigt med inter-qube-kopieringssystemet. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. När du gör det görs inte ändringarna omedelbart och kan lätt ångras i händelse av en olycka. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. När du gör det görs inte ändringarna omedelbart och kan lätt ångras i händelse av en olycka. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM-interaktioner diff --git a/i18n/tr/advanced/payments.md b/i18n/tr/advanced/payments.md index 4f000a01..df356a03 100644 --- a/i18n/tr/advanced/payments.md +++ b/i18n/tr/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! uyarı +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/tr/advanced/tor-overview.md b/i18n/tr/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/tr/advanced/tor-overview.md +++ b/i18n/tr/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/tr/basics/account-creation.md b/i18n/tr/basics/account-creation.md index cadf5427..61bae1f2 100644 --- a/i18n/tr/basics/account-creation.md +++ b/i18n/tr/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "Nasıl Gizli bir Şekilde İnternet Hesapları Oluşturulur - Privacy Guides" -title: "Hesap Oluşturma" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: Çevrimiçi hesaplar oluşturmak neredeyse bir internet gerekliliğidir, gizli kaldığınızdan emin olmak için bu adımları takip edin. +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- Çoğu zaman insanlar düşünmeden hizmetlere kaydolurlar. Bu, herkesin konuştuğu yeni diziyi izleyebileceğiniz bir yayın hizmeti ya da en sevdiğiniz fast food restoranında indirim sağlayan bir hesap olabilir. Her ne için olursa olsun, şimdi ve daha sonrası için verileriniz üzerindeki etkilerini göz önünde bulundurmalısınız. @@ -29,9 +29,12 @@ Bir hesap oluşturmak için genellikle birden fazla yol olur, ve her birinin ken Yeni bir hesap oluşturmanın en yaygın yolu e-posta adresi ve paroladır. Bu yöntemi kullanırken bir parola yöneticisi kullanmalı ve parolalarla ilgili [en iyi uygulamaları](passwords-overview.md)takip etmelisiniz. -!!! ipucu +
+

Tip

- Parola yöneticinizi diğer kimlik doğrulama yöntemlerini düzenlemek için de kullanabilirsiniz! Yeni bir giriş ekleyin ve uygun alanları doldurun, güvenlik soruları veya yedek anahtar gibi şeyler için notlar ekleyebilirsiniz. +Parola yöneticinizi diğer kimlik doğrulama yöntemlerini düzenlemek için de kullanabilirsiniz! Yeni bir giriş ekleyin ve uygun alanları doldurun, güvenlik soruları veya yedek anahtar gibi şeyler için notlar ekleyebilirsiniz. + +
Oturum açma kimlik bilgilerinizi yönetmekten siz sorumlu olacaksınız. Daha fazla güvenlik için hesaplarınızda [MFA](multi-factor-authentication.md) ayarlayabilirsiniz. diff --git a/i18n/tr/basics/common-misconceptions.md b/i18n/tr/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/tr/basics/common-misconceptions.md +++ b/i18n/tr/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/tr/basics/common-threats.md b/i18n/tr/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/tr/basics/common-threats.md +++ b/i18n/tr/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/tr/basics/multi-factor-authentication.md b/i18n/tr/basics/multi-factor-authentication.md index 6a84bd85..6c7f7743 100644 --- a/i18n/tr/basics/multi-factor-authentication.md +++ b/i18n/tr/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/tr/basics/passwords-overview.md b/i18n/tr/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/tr/basics/passwords-overview.md +++ b/i18n/tr/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/tr/basics/vpn-overview.md b/i18n/tr/basics/vpn-overview.md index 2c5e5ded..77e9a2d9 100644 --- a/i18n/tr/basics/vpn-overview.md +++ b/i18n/tr/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "VPN'ler Gizliliğinizi Nasıl Korur? VPN'e Genel Bakış - Privacy Guides" -title: VPN'e Genel Bakış +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: Sanal Özel Ağlar, riski İnternet Sağlayıcınızdan alıp güvendiğiniz bir üçüncü tarafa aktarır. Bunları aklınızda tutmalısınız. +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/tr/os/android-overview.md b/i18n/tr/os/android-overview.md index fb30c217..b0fb0560 100644 --- a/i18n/tr/os/android-overview.md +++ b/i18n/tr/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Android'e Genel Bakış +title: Android Overview icon: simple/android -description: Android, güçlü güvenlik korumalarına sahip açık kaynaklı bir işletim sistemidir ve bu da yüzden telefonlar için en iyi seçimimizdir. +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android logo](../assets/img/android/android.svg){ align=right } @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/tr/os/ios-overview.md b/i18n/tr/os/ios-overview.md index 6ee72d90..868757f7 100644 --- a/i18n/tr/os/ios-overview.md +++ b/i18n/tr/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/tr/os/macos-overview.md b/i18n/tr/os/macos-overview.md index 78d8e3e2..9e4a745d 100644 --- a/i18n/tr/os/macos-overview.md +++ b/i18n/tr/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/tr/os/qubes-overview.md b/i18n/tr/os/qubes-overview.md index 0a3a095a..c76924d9 100644 --- a/i18n/tr/os/qubes-overview.md +++ b/i18n/tr/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/uk/advanced/payments.md b/i18n/uk/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/uk/advanced/payments.md +++ b/i18n/uk/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/uk/advanced/tor-overview.md b/i18n/uk/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/uk/advanced/tor-overview.md +++ b/i18n/uk/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/uk/basics/account-creation.md b/i18n/uk/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/uk/basics/account-creation.md +++ b/i18n/uk/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/uk/basics/common-misconceptions.md b/i18n/uk/basics/common-misconceptions.md index 978187b1..b14bd796 100644 --- a/i18n/uk/basics/common-misconceptions.md +++ b/i18n/uk/basics/common-misconceptions.md @@ -75,20 +75,23 @@ schema: Однією з найяскравіших моделей загроз є та, коли люди *знають, хто ви*, і та, коли вони цього не знають. Завжди будуть ситуації, коли ви повинні заявити своє юридичне ім 'я, і є інші, де в цьому нема потреби. -1. **Відома особистість** — відома особистість використовується для речей, де ви повинні оголошувати своє ім'я. Існує багато юридичних документів та договорів, де потрібна юридична особа. Це може бути відкриття банківського рахунку, підписання договору оренди нерухомості, отримання паспорта, митних декларацій при імпорті товарів або інші питання, пов'язані з вашим урядом. Зазвичай це призводить до отримання облікових даних, таких як кредитні картки, перевірка кредитного рейтингу, номерів рахунків і, можливо, фізичних адрес. +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - Ми не рекомендуємо використовувати VPN або Tor для цих цілей, оскільки ваша особистість вже відома за допомогою інших засобів. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - При покупках в Інтернеті використання [поштомата] (https://uk.wikipedia.org/wiki/Поштомат) може допомогти зберегти вашу фізичну адресу в конфіденційності. +
+

Tip

+ +При покупках в Інтернеті використання [поштомата] (https://uk.wikipedia.org/wiki/Поштомат) може допомогти зберегти вашу фізичну адресу в конфіденційності. + +
2. **Невідома особистість** — невідома особистість може бути стабільним псевдонімом, який ви регулярно використовуєте. Він не є анонімним, бо не змінюється. Якщо ви є частиною онлайн-спільноти, можливо, ви захочете зберегти образ, який знають інші. Цей псевдонім не є анонімним, оскільки за умови тривалого спостереження за ним можна отримати додаткову інформацію про його власника, наприклад, про те, як він пише, його загальні знання про теми, які його цікавлять, тощо. - Ви можете використовувати VPN для цього, щоб приховати свою IP-адресу. Фінансові транзакції складніше приховати: Ви можете розглянути можливість використання анонімних криптовалют, таких як [Monero](https://www.getmonero.org/). Використання зміни альткоїнів також може допомогти приховати, звідки походить ваша валюта. Як правило, обмінники вимагають пройти процедуру KYC (знай свого клієнта), перш ніж вони дозволять вам обміняти фіатну валюту на будь-який вид криптовалюти. Місцеві варіанти зустрічей також можуть бути рішенням, але вони часто дорожчі, а іноді також вимагають KYC. +Ви можете використовувати VPN для цього, щоб приховати свою IP-адресу. Фінансові транзакції складніше приховати: Ви можете розглянути можливість використання анонімних криптовалют, таких як [Monero](https://www.getmonero.org/). Використання зміни альткоїнів також може допомогти приховати, звідки походить ваша валюта. Як правило, обмінники вимагають пройти процедуру KYC (знай свого клієнта), перш ніж вони дозволять вам обміняти фіатну валюту на будь-який вид криптовалюти. Місцеві варіанти зустрічей також можуть бути рішенням, але вони часто дорожчі, а іноді також вимагають KYC. 3. **Анонімна особистість** — навіть маючи досвід, анонімну особистість важко підтримувати тривалий час. Це мають бути короткострокові та недовговічні ідентичності, які регулярно змінюються. - Використання Tor може допомогти в цьому. Варто також зазначити, що більша анонімність можлива через асинхронне спілкування: Спілкування в режимі реального часу вразливе до аналізу шаблонів набору тексту (тобто більше за абзац тексту, поширеного на форумі, електронною поштою тощо). +Використання Tor може допомогти в цьому. Варто також зазначити, що більша анонімність можлива через асинхронне спілкування: Спілкування в режимі реального часу вразливе до аналізу шаблонів набору тексту (тобто більше за абзац тексту, поширеного на форумі, електронною поштою тощо). [^1]: Одним із помітних прикладів цього є [інцидент 2021 року, в якому дослідники Університету Міннесоти впровадили три вразливості у проект розробки ядра Лінукса](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/uk/basics/common-threats.md b/i18n/uk/basics/common-threats.md index b65d8c26..f76944b4 100644 --- a/i18n/uk/basics/common-threats.md +++ b/i18n/uk/basics/common-threats.md @@ -35,19 +35,25 @@ description: Ваша модель загроз є особистою, але ц Щоб мінімізувати шкоду, яку може завдати шкідливе програмне забезпечення **, вам слід застосовувати захист за допомогою розмежування. Наприклад, це може бути використання різних комп'ютерів для різних завдань, використання віртуальних машин для розділення різних груп пов'язаних додатків або використання безпечної операційної системи з сильним акцентом на ізоляцію додатків і обов'язковим контролем доступу. -!!! tip +
+

Tip

- Мобільні операційні системи зазвичай мають кращу ізоляцію додатків, ніж операційні системи для ПК: програми не можуть отримати root-доступ і потребують дозволу для доступу до системних ресурсів. - - Десктопні операційні системи зазвичай відстають у створенні належної ізоляції. ChromeOS має схожі можливості ізоляції з Android, а macOS має повний контроль прав у системі (і розробники можуть ввімкнути ізоляцію додатків). Однак ці операційні системи передають ідентифікаційну інформацію відповідним виробникам обладнання. Linux, як правило, не надає інформацію постачальникам систем, але має слабкий захист від експлойтів та шкідливих програм. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Мобільні операційні системи зазвичай мають кращу ізоляцію додатків, ніж операційні системи для ПК: програми не можуть отримати root-доступ і потребують дозволу для доступу до системних ресурсів. + +Десктопні операційні системи зазвичай відстають у створенні належної ізоляції. ChromeOS має схожі можливості ізоляції з Android, а macOS має повний контроль прав у системі (і розробники можуть ввімкнути ізоляцію додатків). Однак ці операційні системи передають ідентифікаційну інформацію відповідним виробникам обладнання. Linux, як правило, не надає інформацію постачальникам систем, але має слабкий захист від експлойтів та шкідливих програм. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Цілеспрямовані атаки З цілеспрямованими атаками на конкретну особу боротися складніше. Поширені атаки включають надсилання шкідливих документів електронною поштою, експлуатацію вразливостей (наприклад, у браузерах та операційних системах) і фізичні атаки. Якщо це викликає у вас занепокоєння, вам слід використовувати більш просунуті стратегії пом'якшення загроз. -!!! tip +
+

Tip

- За своєю суттю **веб-браузери**, **поштові клієнти** та **офісні програми** зазвичай виконують ненадійний код, надісланий вам третіми сторонами. Запуск декількох віртуальних машин для відокремлення таких додатків від основної системи, а також один від одного - це один зі способів зменшити ймовірність того, що експлойт в цих додатках може скомпрометувати решту системи. Наприклад, такі технології, як Qubes OS або Microsoft Defender Application Guard на Windows, надають зручні методи для цього. +За своєю суттю **веб-браузери**, **поштові клієнти** та **офісні програми** зазвичай виконують ненадійний код, надісланий вам третіми сторонами. Запуск декількох віртуальних машин для відокремлення таких додатків від основної системи, а також один від одного - це один зі способів зменшити ймовірність того, що експлойт в цих додатках може скомпрометувати решту системи. Наприклад, такі технології, як Qubes OS або Microsoft Defender Application Guard на Windows, надають зручні методи для цього. + +
Якщо ви стурбовані **фізичними атаками**, вам слід використовувати операційну систему з безпечною перевіреною реалізацією завантаження, таку як Android, iOS, macOS або [Windows (з TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). Також слід переконатися, що ваш диск зашифровано, а операційна система використовує TPM або Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) чи [Element](https://developers.google.com/android/security/android-ready-se) для обмеження кількості спроб введення ключової фрази шифрування. Вам слід уникати спільного використання комп'ютера з людьми, яким ви не довіряєте, оскільки більшість настільних операційних систем не шифрують дані окремо для кожного користувача. @@ -61,13 +67,16 @@ description: Ваша модель загроз є особистою, але ц На щастя, E2EE може вирішити цю проблему, шифруючи повідомлення між вами й вашими бажаними одержувачами ще до того, як вони будуть відправлені на сервер. Конфіденційність ваших повідомлень гарантується, якщо постачальник послуг не має доступу до приватних ключів жодної зі сторін. -!!! note "Примітка про веб-шифрування" +
+

Note on Web-based Encryption

- На практиці ефективність різних реалізацій E2EE відрізняється. Такі додатки як [Signal](../real-time-communication.md#signal) працюють на вашому пристрої за замовчуванням, і кожна копія програми однакова для різних інсталяцій. Якщо постачальник послуг впровадить [бекдор](https://uk.wikipedia.org/wiki/Бекдор) у свій додаток — у спробі викрасти ваші приватні ключі — це можна буде пізніше виявити за допомогою [зворотної розробки](https://uk.wikipedia.org/wiki/Зворотня_розробка). - - З іншого боку, веб-реалізації E2EE, такі як веб-пошта Proton Mail або *Web Vault* від Bitwarden, покладаються на сервер, який динамічно надає браузеру код JavaScript для провадження криптографії. Шкідливий сервер може вибрати вас і надіслати вам шкідливий JavaScript-код, щоб викрасти ваш ключ шифрування (і це буде надзвичайно важко помітити). Оскільки сервер може обслуговувати різних веб-клієнтів для різних людей — навіть якщо ви помітили атаку — довести провину провайдера буде неймовірно складно. - - Тому вам слід використовувати нативні додатки замість веб-клієнтів, коли це можливо. +На практиці ефективність різних реалізацій E2EE відрізняється. Такі додатки як [Signal](../real-time-communication.md#signal) працюють на вашому пристрої за замовчуванням, і кожна копія програми однакова для різних інсталяцій. Якщо постачальник послуг впровадить [бекдор](https://uk.wikipedia.org/wiki/Бекдор) у свій додаток — у спробі викрасти ваші приватні ключі — це можна буде пізніше виявити за допомогою [зворотної розробки](https://uk.wikipedia.org/wiki/Зворотня_розробка). + +З іншого боку, веб-реалізації E2EE, такі як веб-пошта Proton Mail або *Web Vault* від Bitwarden, покладаються на сервер, який динамічно надає браузеру код JavaScript для провадження криптографії. Шкідливий сервер може вибрати вас і надіслати вам шкідливий JavaScript-код, щоб викрасти ваш ключ шифрування (і це буде надзвичайно важко помітити). Оскільки сервер може обслуговувати різних веб-клієнтів для різних людей — навіть якщо ви помітили атаку — довести провину провайдера буде неймовірно складно. + +Тому вам слід використовувати нативні додатки замість веб-клієнтів, коли це можливо. + +
Навіть з E2EE постачальники послуг все ще можуть профілювати вас на основі **метаданих**, які, як правило, не захищені. Хоча провайдер не може читати ваші повідомлення, він може спостерігати за важливими речами, наприклад, за тим, з ким ви розмовляєте, як часто ви надсилаєте їм повідомлення і коли ви зазвичай активні. Захист метаданих є досить рідкісним явищем, і — якщо це входить до вашої [моделі загроз](threat-modeling.md) — вам слід звернути пильну увагу на технічну документацію програмного забезпечення, яке ви використовуєте, щоб дізнатися, чи передбачено мінімізацію або захист метаданих взагалі. @@ -77,17 +86,23 @@ description: Ваша модель загроз є особистою, але ц Масове спостереження — це складні зусилля з моніторингу "поведінки, багатьох видів діяльності або інформації" всього (або значної частини) населення.[^1] Часто йдеться про урядові програми, такі як ті, що [розкрив Едвард Сноуден у 2013 році](https://uk.wikipedia.org/wiki/Викриття_масового_стеження_у_2013_році). Однак це також може здійснюватися корпораціями, як від імені державних органів, так і за власною ініціативою. -!!! abstract "Атлас спостереження" +
+

Atlas of Surveillance

- Якщо ви хочете дізнатися більше про методи спостереження і про те, як вони застосовуються у вашому місті, ви також можете ознайомитися з [Атласом спостереження] (https://atlasofsurveillance.org/) від [Electronic Frontier Foundation] (https://www.eff.org/). - - У Франції ви можете зазирнути на [веб-сайт Технополісу] (https://technopolice.fr/villes/), який підтримує некомерційна асоціація La Quadrature du Net. +Якщо ви хочете дізнатися більше про методи спостереження і про те, як вони застосовуються у вашому місті, ви також можете ознайомитися з [Атласом спостереження] (https://atlasofsurveillance.org/) від [Electronic Frontier Foundation] (https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Уряди часто виправдовують програми масового спостереження як необхідні засоби для боротьби з тероризмом і запобігання злочинності. Однак, порушуючи права людини, це найчастіше використовується для непропорційного переслідування груп меншин та політичних дисидентів, серед інших. -!!! quote "ACLU: [*Урок конфіденційності 9/11: Масове спостереження — це не шлях вперед*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- Після викриттів [Едвардом Сноуденом таких урядових програм як [PRISM](https://uk.wikipedia.org/wiki/PRISM_(розвідувальна_програма)) і [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], співробітники розвідки також визнали, що АНБ роками таємно збирало записи про телефонні дзвінки практично кожного американця - хто кому дзвонить, коли ці дзвінки здійснюються і як довго вони тривають. Така інформація, яку АНБ збирає день за днем, може розкрити неймовірно делікатні подробиці про життя людей і їхні зв'язки, наприклад, чи телефонували вони до пастора, лікаря, який робить аборти, консультанта з питань залежності або на гарячу лінію для самогубців. +Після викриттів [Едвардом Сноуденом таких урядових програм як [PRISM](https://uk.wikipedia.org/wiki/PRISM_(розвідувальна_програма)) і [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], співробітники розвідки також визнали, що АНБ роками таємно збирало записи про телефонні дзвінки практично кожного американця - хто кому дзвонить, коли ці дзвінки здійснюються і як довго вони тривають. Така інформація, яку АНБ збирає день за днем, може розкрити неймовірно делікатні подробиці про життя людей і їхні зв'язки, наприклад, чи телефонували вони до пастора, лікаря, який робить аборти, консультанта з питань залежності або на гарячу лінію для самогубців. + +
Незважаючи на зростання масового стеження в США, уряд виявив, що програми масового стеження, такі як Розділ 215, мають "невелику унікальну цінність" щодо припинення реальних злочинів або терористичних змов, а їхні зусилля значною мірою дублюють власні програми цільового стеження, що проводяться ФБР.[^2] @@ -133,11 +148,14 @@ description: Ваша модель загроз є особистою, але ц Люди, стурбовані загрозою цензури, можуть використовувати такі технології, як [Tor](../advanced/tor-overview.md), щоб обійти її, і підтримувати стійкі до цензури комунікаційні платформи, такі як [Matrix](../real-time-communication.md#element), які не мають централізованого облікового органу, що може довільно закривати акаунти. -!!! tip +
+

Tip

- У той час як уникнути цензури може бути легко, приховати той факт, що ви це робите, може бути дуже проблематично. - - Ви повинні враховувати, які аспекти мережі може спостерігати ваш супротивник, і чи є у вас правдоподібне заперечення ваших дій. Наприклад, використання [зашифрованого DNS](../advanced/dns-overview.md#what-is-encrypted-dns) може допомогти вам обійти рудиментарні системи цензури, засновані на DNS, але це не може по-справжньому приховати те, що ви відвідуєте, від вашого Інтернет-провайдера. VPN або Tor можуть допомогти приховати від мережевих адміністраторів що саме ви відвідуєте, але не можуть приховати сам факт використання цих мереж. Підключувані засоби передачі (такі як Obfs4proxy, Meek або Shadowsocks) можуть допомогти вам обійти брандмауери, які блокують поширені VPN-протоколи або Tor, але ваші спроби обходу все одно можуть бути виявлені такими методами, як зондування або [Deep Packet Inspection] (https://uk.wikipedia.org/wiki/Deep_packet_inspection). +У той час як уникнути цензури може бути легко, приховати той факт, що ви це робите, може бути дуже проблематично. + +Ви повинні враховувати, які аспекти мережі може спостерігати ваш супротивник, і чи є у вас правдоподібне заперечення ваших дій. Наприклад, використання [зашифрованого DNS](../advanced/dns-overview.md#what-is-encrypted-dns) може допомогти вам обійти рудиментарні системи цензури, засновані на DNS, але це не може по-справжньому приховати те, що ви відвідуєте, від вашого Інтернет-провайдера. VPN або Tor можуть допомогти приховати від мережевих адміністраторів що саме ви відвідуєте, але не можуть приховати сам факт використання цих мереж. Підключувані засоби передачі (такі як Obfs4proxy, Meek або Shadowsocks) можуть допомогти вам обійти брандмауери, які блокують поширені VPN-протоколи або Tor, але ваші спроби обходу все одно можуть бути виявлені такими методами, як зондування або [Deep Packet Inspection] (https://uk.wikipedia.org/wiki/Deep_packet_inspection). + +
Ви завжди повинні враховувати ризики, пов'язані зі спробами обійти цензуру, потенційні наслідки і те, наскільки витонченим може бути ваш супротивник. Ви повинні бути обережними у виборі програмного забезпечення та мати запасний план на випадок, якщо вас спіймають. diff --git a/i18n/uk/basics/multi-factor-authentication.md b/i18n/uk/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/uk/basics/multi-factor-authentication.md +++ b/i18n/uk/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/uk/basics/passwords-overview.md b/i18n/uk/basics/passwords-overview.md index b24344ca..9178bded 100644 --- a/i18n/uk/basics/passwords-overview.md +++ b/i18n/uk/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "Вступ до паролів" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: Це кілька порад та підказок про те, як створювати найнадійніші паролі та зберігати свої акаунти в безпеці. +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- Паролі є важливою частиною нашого повсякденного цифрового життя. Ми використовуємо їх для захисту наших облікових записів, пристроїв і секретів. Попри те, що часто вони є єдиною перешкодою між нами та зловмисником, який хоче отримати нашу особисту інформацію, ми не замислюємося над ними, що часто призводить до того, що люди використовують паролі, які можна легко вгадати або підібрати грубим перебором. @@ -26,9 +26,12 @@ description: Це кілька порад та підказок про те, я Що стосується паролів, які вам не потрібно запам'ятовувати (наприклад, паролі, що зберігаються у вашому менеджері паролів), якщо цього вимагає ваша [модель загроз](threat-modeling.md), ми рекомендуємо переглядати важливі акаунти (особливо ті, що не використовують багатофакторну автентифікацію) і змінювати їхні паролі кожні два місяці, на випадок, якщо вони були скомпрометовані в результаті витоку даних, який ще не став публічним. Більшість менеджерів паролів дозволяють встановити дату закінчення терміну дії пароля, щоб полегшити керування ним. -!!! tip "Перевірка на витік даних" +
+

Checking for data breaches

- Якщо ваш менеджер паролів дозволяє перевіряти скомпрометовані паролі, переконайтеся, що ви це робите, і негайно змінюйте будь-який пароль, який, можливо, був розкритий під час витоку даних. Крім того, ви можете стежити за [стрічкою останніх порушень Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) за допомогою [новинного агрегатора](../news-aggregators.md). +Якщо ваш менеджер паролів дозволяє перевіряти скомпрометовані паролі, переконайтеся, що ви це робите, і негайно змінюйте будь-який пароль, який, можливо, був розкритий під час витоку даних. Крім того, ви можете стежити за [стрічкою останніх порушень Have I Been Pwned](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) за допомогою [новинного агрегатора](../news-aggregators.md). + +
## Створення надійних паролів @@ -48,9 +51,12 @@ description: Це кілька порад та підказок про те, я Щоб згенерувати кодову фразу з використанням справжніх гральних кубиків, виконайте такі дії: -!!! примітка +
+

Note

- Ці інструкції припускають, що ви використовуєте [великий список слів EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) для генерації парольної фрази, яка вимагає п'ять кидків кубика на слово. Інші словники можуть вимагати більшої або меншої кількості кидків на слово, а також іншої кількості слів для досягнення тієї ж самої ентропії. +Ці інструкції припускають, що ви використовуєте [великий список слів EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) для генерації парольної фрази, яка вимагає п'ять кидків кубика на слово. Інші словники можуть вимагати більшої або меншої кількості кидків на слово, а також іншої кількості слів для досягнення тієї ж самої ентропії. + +
1. Киньте шестигранний кубик п'ять разів, записуючи число після кожного кидка. @@ -60,31 +66,37 @@ description: Це кілька порад та підказок про те, я 4. Повторюйте цей процес до тих пір, поки у вашій парольній фразі не буде стільки слів, скільки вам потрібно, слова слід відокремлювати пробілами. -!!! попередження "Важливо" +
+

Important

- Ви **не** повинні повторювати слова до тих пір, поки не отримаєте комбінацію слів, яка вам подобається. Процес має бути абсолютно випадковим. +Ви **не** повинні повторювати слова до тих пір, поки не отримаєте комбінацію слів, яка вам подобається. Процес має бути абсолютно випадковим. + +
Якщо у вас немає доступу до справжніх гральних кубиків або ви не хочете використовувати їх, ви можете скористатися вбудованим генератором паролів вашого менеджера паролів, оскільки більшість з них мають можливість генерувати парольні фрази на додачу до звичайних паролів. Ми рекомендуємо використовувати [великий список слів EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) для генерації паролів для diceware, оскільки він забезпечує таку ж безпеку, як і оригінальний список, але містить слова, які легше запам'ятовувати. Існують також [інші списки слів різними мовами](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), якщо ви не хочете, щоб ваша парольна фраза була англійською. -??? примітка "Пояснення ентропії та стійкості ключових фраз" +
+Explanation of entropy and strength of diceware passphrases - Щоб продемонструвати, наскільки сильними є ключові фрази, ми використаємо вищезгадану фразу з семи слів (`viewable fastness reluctant squishy seventeen shown pencil`) та [великий список слів EFF] (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) як приклад. - - Одним із показників для визначення сили парольної фрази є її ентропія. Ентропія кожного слова у фразі обчислюється як $\text{log}_2(\text{WordsInList})$, а загальна ентропія фрази обчислюється як $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Отже, кожне слово у вищезгаданому списку дає ~12.9 біт ентропії ($\text{log}_2(7776)$), а похідна від нього фраза з семи слів має ~90.47 біт ентропії ($\text{log}_2(7776^7)$). - - [Великий список слів EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) містить 7776 унікальних слів. Щоб підрахувати кількість можливих ключових фраз, все, що нам потрібно зробити, це $\text{WordsInList}^\text{WordsInPhrase}$, або у нашому випадку, $7776^7$. - - Розгляньмо все це в перспективі: Ключова фраза з семи слів з використанням [великого списку слів EFF](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) - це одна з ~1,719,070,799,748,422,500,000,000,000,000 можливих ключових фраз. - - В середньому, щоб вгадати вашу фразу, потрібно спробувати 50% всіх можливих комбінацій. Враховуючи це, навіть якщо ваш супротивник здатний робити ~1 000 000 000 000 000 спроб за секунду, йому все одно знадобиться ~27 255 689 років, щоб вгадати вашу парольну фразу. Це так, навіть якщо чинні наступні умови: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Ваш супротивник знає, що ви використовували парольну фразу. - - Ваш супротивник знає конкретний список слів, який ви використовували. - - Ваш супротивник знає, скільки слів містить ваша парольна фраза. +Одним із показників для визначення сили парольної фрази є її ентропія. Ентропія кожного слова у фразі обчислюється як $\text{log}_2(\text{WordsInList})$, а загальна ентропія фрази обчислюється як $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Отже, кожне слово у вищезгаданому списку дає ~12.9 біт ентропії ($\text{log}_2(7776)$), а похідна від нього фраза з семи слів має ~90.47 біт ентропії ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. Щоб підрахувати кількість можливих ключових фраз, все, що нам потрібно зробити, це $\text{WordsInList}^\text{WordsInPhrase}$, або у нашому випадку, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +В середньому, щоб вгадати вашу фразу, потрібно спробувати 50% всіх можливих комбінацій. Враховуючи це, навіть якщо ваш супротивник здатний робити ~1 000 000 000 000 000 спроб за секунду, йому все одно знадобиться ~27 255 689 років, щоб вгадати вашу парольну фразу. Це так, навіть якщо чинні наступні умови: + +- Ваш супротивник знає, що ви використовували парольну фразу. +- Ваш супротивник знає конкретний список слів, який ви використовували. +- Ваш супротивник знає, скільки слів містить ваша парольна фраза. + +
Підсумовуючи, парольні фрази - це найкращий варіант, коли вам потрібно щось, що легко запам'ятовується *та* є надзвичайно надійним. @@ -98,13 +110,16 @@ description: Це кілька порад та підказок про те, я [Список рекомендованих менеджерів паролів](../passwords.md ""){.md-button} -!!! warning "Не зберігайте паролі та TOTP-токени в одному менеджері паролів" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- При використанні кодів TOTP як [багатофакторної автентифікації](../multi-factor-authentication.md), найкращим вибором є зберігання кодів TOTP в [окремому додатку](../multi-factor-authentication.md#authenticator-apps). - - Зберігання токенів TOTP в одному місці з паролями хоч і зручно, але зводить облікові записи до одного фактору в разі, якщо зловмисник отримає доступ до вашого менеджера паролів. - - Крім того, ми не рекомендуємо зберігати в менеджері паролів одноразові коди відновлення. Їх слід зберігати окремо, наприклад, у зашифрованому контейнері на автономному накопичувачі. +При використанні кодів TOTP як [багатофакторної автентифікації](../multi-factor-authentication.md), найкращим вибором є зберігання кодів TOTP в [окремому додатку](../multi-factor-authentication.md#authenticator-apps). + +Зберігання токенів TOTP в одному місці з паролями хоч і зручно, але зводить облікові записи до одного фактору в разі, якщо зловмисник отримає доступ до вашого менеджера паролів. + +Крім того, ми не рекомендуємо зберігати в менеджері паролів одноразові коди відновлення. Їх слід зберігати окремо, наприклад, у зашифрованому контейнері на автономному накопичувачі. + +
### Резервні копії diff --git a/i18n/uk/basics/vpn-overview.md b/i18n/uk/basics/vpn-overview.md index 7e0cb195..77e9a2d9 100644 --- a/i18n/uk/basics/vpn-overview.md +++ b/i18n/uk/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! примітка +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/uk/os/android-overview.md b/i18n/uk/os/android-overview.md index 6b6c5941..d8462bdc 100644 --- a/i18n/uk/os/android-overview.md +++ b/i18n/uk/os/android-overview.md @@ -1,5 +1,5 @@ --- -title: Огляд Android +title: Android Overview icon: simple/android description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! примітка +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/uk/os/ios-overview.md b/i18n/uk/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/uk/os/ios-overview.md +++ b/i18n/uk/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/uk/os/macos-overview.md b/i18n/uk/os/macos-overview.md index 6de57b9a..9cbde7f5 100644 --- a/i18n/uk/os/macos-overview.md +++ b/i18n/uk/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/uk/os/qubes-overview.md b/i18n/uk/os/qubes-overview.md index 55ac44f7..590ec180 100644 --- a/i18n/uk/os/qubes-overview.md +++ b/i18n/uk/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/vi/advanced/payments.md b/i18n/vi/advanced/payments.md index 7e046ecd..df356a03 100644 --- a/i18n/vi/advanced/payments.md +++ b/i18n/vi/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! danger +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/vi/advanced/tor-overview.md b/i18n/vi/advanced/tor-overview.md index 3a642929..8a6ab1ce 100644 --- a/i18n/vi/advanced/tor-overview.md +++ b/i18n/vi/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/vi/basics/account-creation.md b/i18n/vi/basics/account-creation.md index 30337e41..16f79eb6 100644 --- a/i18n/vi/basics/account-creation.md +++ b/i18n/vi/basics/account-creation.md @@ -29,9 +29,12 @@ There are usually multiple ways to sign up for an account, each with their own b The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords. -!!! tip +
+

Tip

- You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. +You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. + +
You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts. diff --git a/i18n/vi/basics/common-misconceptions.md b/i18n/vi/basics/common-misconceptions.md index 507ce025..74650997 100644 --- a/i18n/vi/basics/common-misconceptions.md +++ b/i18n/vi/basics/common-misconceptions.md @@ -77,18 +77,21 @@ One of the clearest threat models is one where people *know who you are* and one 1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. +
+

Tip

+ +When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private. + +
2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. +You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. - Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) +Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.) [^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/vi/basics/common-threats.md b/i18n/vi/basics/common-threats.md index 9b0680e9..a8102469 100644 --- a/i18n/vi/basics/common-threats.md +++ b/i18n/vi/basics/common-threats.md @@ -35,19 +35,25 @@ When it comes to application security, we generally don't (and sometimes can't) To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control. -!!! tip +
+

Tip

- Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. - - Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. + +Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: Targeted Attacks Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies. -!!! tip +
+

Tip

- By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. +By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this. + +
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user. @@ -61,13 +67,16 @@ The obvious problem with this is that the service provider (or a hacker who has Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party. -!!! note "Note on Web-based Encryption" +
+

Note on Web-based Encryption

- In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). - - On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. - - Therefore, you should use native applications over web clients whenever possible. +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). + +On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. + +Therefore, you should use native applications over web clients whenever possible. + +
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. @@ -77,17 +86,23 @@ Even with E2EE, service providers can still profile you based on **metadata**, w Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative. -!!! abstract "Atlas of Surveillance" +
+

Atlas of Surveillance

- If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). - - In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. +If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/). + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others. -!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. +In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline. + +
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2] @@ -133,11 +148,14 @@ Censorship on corporate platforms is increasingly common, as platforms like Twit People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. -!!! tip +
+

Tip

- While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. - - You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. + +You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). + +
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/i18n/vi/basics/multi-factor-authentication.md b/i18n/vi/basics/multi-factor-authentication.md index ae57848d..75cb7e9b 100644 --- a/i18n/vi/basics/multi-factor-authentication.md +++ b/i18n/vi/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ The command will prevent an adversary from bypassing MFA when the computer boots ### Linux -!!! warning +
+

Warning

- If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. +If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide. + +
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS. diff --git a/i18n/vi/basics/passwords-overview.md b/i18n/vi/basics/passwords-overview.md index 6858d8b5..63b87498 100644 --- a/i18n/vi/basics/passwords-overview.md +++ b/i18n/vi/basics/passwords-overview.md @@ -26,9 +26,12 @@ You should avoid changing passwords that you have to remember (such as your pass When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. -!!! tip "Checking for data breaches" +
+

Checking for data breaches

- If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md). + +
## Creating strong passwords @@ -48,9 +51,12 @@ An example of a diceware passphrase is `viewable fastness reluctant squishy seve To generate a diceware passphrase using real dice, follow these steps: -!!! note +
+

Note

- These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. +These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy. + +
1. Roll a six-sided die five times, noting down the number after each roll. @@ -60,31 +66,37 @@ To generate a diceware passphrase using real dice, follow these steps: 4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space. -!!! warning "Important" +
+

Important

- You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. +You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random. + +
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords. We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? note "Explanation of entropy and strength of diceware passphrases" +
+Explanation of entropy and strength of diceware passphrases - To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. - - Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). - - The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. - - Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. - - On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - Your adversary knows that you used the diceware method. - - Your adversary knows the specific wordlist that you used. - - Your adversary knows how many words your passphrase contains. +One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$. + +Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$). + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$. + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true: + +- Your adversary knows that you used the diceware method. +- Your adversary knows the specific wordlist that you used. +- Your adversary knows how many words your passphrase contains. + +
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong. @@ -98,13 +110,16 @@ There are many good options to choose from, both cloud-based and local. Choose o [List of recommended password managers](../passwords.md ""){.md-button} -!!! warning "Don't place your passwords and TOTP tokens inside the same password manager" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). - - Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. - - Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. +When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps). + +Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. + +Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device. + +
### Backups diff --git a/i18n/vi/basics/vpn-overview.md b/i18n/vi/basics/vpn-overview.md index 2f34dd6e..77e9a2d9 100644 --- a/i18n/vi/basics/vpn-overview.md +++ b/i18n/vi/basics/vpn-overview.md @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/vi/os/android-overview.md b/i18n/vi/os/android-overview.md index dcce280f..1ffa3cdc 100644 --- a/i18n/vi/os/android-overview.md +++ b/i18n/vi/os/android-overview.md @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! warning +
+

Warning

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/vi/os/ios-overview.md b/i18n/vi/os/ios-overview.md index c8abf8cf..949d360e 100644 --- a/i18n/vi/os/ios-overview.md +++ b/i18n/vi/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! warning +
+

Warning

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/vi/os/macos-overview.md b/i18n/vi/os/macos-overview.md index 6a38f1f1..584d1acc 100644 --- a/i18n/vi/os/macos-overview.md +++ b/i18n/vi/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! warning +
+

Warning

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! warning +
+

Warning

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/vi/os/qubes-overview.md b/i18n/vi/os/qubes-overview.md index 55ac44f7..590ec180 100644 --- a/i18n/vi/os/qubes-overview.md +++ b/i18n/vi/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system. -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### Inter-VM Interactions diff --git a/i18n/zh-Hant/advanced/payments.md b/i18n/zh-Hant/advanced/payments.md index 598ea3ec..2b16a58c 100644 --- a/i18n/zh-Hant/advanced/payments.md +++ b/i18n/zh-Hant/advanced/payments.md @@ -1,5 +1,5 @@ --- -title: 私密支付 +title: Private Payments icon: material/hand-coin --- @@ -45,11 +45,14 @@ icon: material/hand-coin 加密貨幣是一種數位形式的貨幣，其設計上沒有中央機構如政府或銀行即自行運作。 *有些* 加密貨幣可以在線上私密交易，但許多使用公開區塊錬則無法保障交易隱私。 加密貨幣是非常不穩定的資產，這它們的價值可能隨時發生急速顯著變化。 因此，不建議加密貨幣作為長期價值儲存。 如果決定使用加密貨幣，請確保已充分了解其隱私，且投資金額不會變成災難性損失。 -!!! danger "危險" +
+

Danger "危險"

- 絕大多數加密貨幣都在* *公共* *區塊鏈上運作，這意味著每筆交易都可公開知道。 這包括最知名的加密貨幣，如比特幣和以太坊。 加密貨幣的交易不應被視為私密，也不會保護您的匿名性。 - - 此外，許多（如果不是大多數）加密貨幣都是騙局。 只用你信任的項目小心進行交易。 +絕大多數加密貨幣都在* *公共* *區塊鏈上運作，這意味著每筆交易都可公開知道。 這包括最知名的加密貨幣，如比特幣和以太坊。 加密貨幣的交易不應被視為私密，也不會保護您的匿名性。 + +此外，許多（如果不是大多數）加密貨幣都是騙局。 只用你信任的項目小心進行交易。 + +
### 隱私幣 diff --git a/i18n/zh-Hant/advanced/tor-overview.md b/i18n/zh-Hant/advanced/tor-overview.md index 13417041..c357a8b1 100644 --- a/i18n/zh-Hant/advanced/tor-overview.md +++ b/i18n/zh-Hant/advanced/tor-overview.md @@ -51,14 +51,16 @@ Tor 是一個免費使用的去中心化網路，其讓用戶在使用網際網 --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- Tor 專案 [註](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) *理論上*使用 VPN 隱藏 Tor 活動到 ISP 可能不容易。 人們發現 VPN 很容易受到網站流量指紋辨識的影響，攻擊者仍然可猜測正在造訪哪個網站，因為所有網站都有特定的流量模式。 - - 因此，相信 VPN 隱藏的加密 Tor 流量也可以透過類似的方法被偵測，這並非沒道理。 沒有這個主題的研究論文，我們仍然認為使用 VPN 的好處遠遠超過這些風險，但需要記住這點。 - - 如果仍認為可插拔傳輸（橋接器）可以針對網站流量指紋識別提供 VPN 無法提供的額外保護，那麼可以選擇結合使用橋接器**和** VPN。 - +Tor 專案 [註](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) *理論上*使用 VPN 隱藏 Tor 活動到 ISP 可能不容易。 人們發現 VPN 很容易受到網站流量指紋辨識的影響，攻擊者仍然可猜測正在造訪哪個網站，因為所有網站都有特定的流量模式。 + +因此，相信 VPN 隱藏的加密 Tor 流量也可以透過類似的方法被偵測，這並非沒道理。 沒有這個主題的研究論文，我們仍然認為使用 VPN 的好處遠遠超過這些風險，但需要記住這點。 + +如果仍認為可插拔傳輸（橋接器）可以針對網站流量指紋識別提供 VPN 無法提供的額外保護，那麼可以選擇結合使用橋接器**和** VPN。 + +
確定是否應該先使用 VPN 連接到 Tor 網絡需要一些常識和了解當地政府和 ISP 與所連接內容的政策。 然而在多數情況下，最好被視為連接到商業 VPN 網絡，而不是直接連到 Tor 網路。 如果VPN 服務商在您的地區受到審查，那麼也可以考慮使用Tor 可插拔傳輸（例如 Snowflake 或 meek ）作為替代方案，但使用這些橋接器可能比標準WireGuard/OpenVPN 隧道引起更多懷疑。 diff --git a/i18n/zh-Hant/basics/account-creation.md b/i18n/zh-Hant/basics/account-creation.md index dfb1ed9a..516e33c6 100644 --- a/i18n/zh-Hant/basics/account-creation.md +++ b/i18n/zh-Hant/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "如何私下創建網際網路帳戶 - Privacy Guides" -title: "帳號創建" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: 創建帳戶為實際連線網際網路所必要，請採取下列步驟確保您的線上隱私。 +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- 人們經常不假思索地註冊網路服務。 這些帳號也許是一個串流媒體服務可觀看人人都在談論的新節目，或是取得喜歡的快餐店折扣。 無論在什麼樣的場景，您都應該考慮現在和以後對個資的影響。 @@ -29,9 +29,12 @@ description: 創建帳戶為實際連線網際網路所必要，請採取下列 建立新帳戶的最常見方式是使用電子郵件地址和密碼。 使用此方法時，您應該使用密碼管理器，並遵循 [關於密碼的最佳做法](passwords-overview.md) 。 -!!! tip "提示" +
+

Tip

- 您也可以使用密碼管理器來管理其他驗證方式！ 只要新增一則條目並填寫相關欄位資訊，您也可註記安全問題或備份密鑰等事項。 +您也可以使用密碼管理器來管理其他驗證方式！ 只要新增一則條目並填寫相關欄位資訊，您也可註記安全問題或備份密鑰等事項。 + +
您自己負責管理您的登入憑證。 為了增加安全性，您可以在帳戶上設置 [MFA](multi-factor-authentication.md) 。 diff --git a/i18n/zh-Hant/basics/common-misconceptions.md b/i18n/zh-Hant/basics/common-misconceptions.md index b3ec2638..95ee7899 100644 --- a/i18n/zh-Hant/basics/common-misconceptions.md +++ b/i18n/zh-Hant/basics/common-misconceptions.md @@ -75,20 +75,23 @@ schema: 最清晰的威胁模型之一是，部分人*，知道你是谁* ，而另一部分人不知道。 有些必須提出您的法定姓名的情況，但也有其他情況不需要提供全名。 -1. **已知身份** - 已知身份是用于必須告之姓名的事務。 有許多法律文件和合同需要合法身份。 這可能包括開設銀行帳戶、簽署財產租賃、獲得護照、進口物品時的海關申報，或其他與政府打交道的方式。 這些東西通常會需要憑證，如信用卡，信用評級檢查，帳戶號碼，以及實際地址等。 +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - 我們不建議您使用 VPN 或 Tor 來處理這些事情，因為您的身份已經通過其他方式被對方知道。 +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip "提示" - - 在網上購物時，使用[包裹儲物櫃](https://zh.wikipedia.org/wiki/Parcel_locker)有助於保護您實際地址的私密性。 +
+

Tip

+ +在網上購物時，使用[包裹儲物櫃](https://zh.wikipedia.org/wiki/Parcel_locker)有助於保護您實際地址的私密性。 + +
2. **未知身份** - 未知身份可能是您經常使用的穩定假名。 它已不算匿名了，因為不會變動。 如果您是線上社群的一員，您可能希望保留其他人知道的角色。 這個假名不是匿名的，因為如果監控時間足夠長，關於所有者的詳細信息可以透露更多信息，例如他們的寫作方式，他們對感興趣主題的一般知識等。 - 您可能希望使用 VPN 來隱藏您的 IP 地址。 金融交易更難掩蓋：您可以考慮使用匿名加密貨幣，例如 [Monero](https://www.getmonero.org/)。 採用山寨幣轉移也可能有助於偽裝您的貨幣來源。 通常情況下，交易所需要完成 KYC （了解您的客戶） ，然後才能將法定貨幣兌換為任何類型的加密貨幣。 線下操作也可能是一個解決方案；然而，這些往往更昂貴，有時也需要 KYC。 +您可能希望使用 VPN 來隱藏您的 IP 地址。 金融交易更難掩蓋：您可以考慮使用匿名加密貨幣，例如 [Monero](https://www.getmonero.org/)。 採用山寨幣轉移也可能有助於偽裝您的貨幣來源。 通常情況下，交易所需要完成 KYC （了解您的客戶） ，然後才能將法定貨幣兌換為任何類型的加密貨幣。 線下操作也可能是一個解決方案；然而，這些往往更昂貴，有時也需要 KYC。 3. **匿名身份** - 即使有經驗的專家，也很難長時間保持一個帳號的匿名性。 它們應該是短期和短暫的身份，定期輪流。 - 使用 Tor 可以幫助我們做到這一點。 同樣值得注意的是，通過異步溝通可以實現更大的匿名性：實時溝通容易受到打字模式分析的影響（即不止一段文字，在論壇上分發，通過電子郵件等）。 +使用 Tor 可以幫助我們做到這一點。 同樣值得注意的是，通過異步溝通可以實現更大的匿名性：實時溝通容易受到打字模式分析的影響（即不止一段文字，在論壇上分發，通過電子郵件等）。 [^1]: 一個值得注意的例子是 [發生在2021年，明尼蘇達大學的研究人員在 Linux 內核開發項目中引入了三個漏洞](https://cse.umn.edu/cs/linux-incident). diff --git a/i18n/zh-Hant/basics/common-threats.md b/i18n/zh-Hant/basics/common-threats.md index 4541e51a..25f7fc29 100644 --- a/i18n/zh-Hant/basics/common-threats.md +++ b/i18n/zh-Hant/basics/common-threats.md @@ -35,19 +35,25 @@ description: 您的威脅模型雖說是個人的事，但它也是本站許多 減少惡意軟體*可能造成的破壞* ，最好能落實安全劃分方案。 例如，用不同電腦作不同的事、利用虛擬器來分組不同的相關應用程式，或者使用一個高集中的應用程式沙盒和強制訪問控制的安全操作系統。 -!!! tip "提示" +
+

Tip

- 行動作業系統通常具有比桌面作業系統具備更好的應用程式沙盒：應用程式沒有根存取權限，且需要存取系統資源的權限。 - - 桌面操作系統通常在適當的沙盒化上落後。 ChromeOS 具備與 Android 相似的沙盒功能， macOS 具有完整的系統權限控制（開發人員可以選擇為應用程式加入沙盒）。 然而，這些作業系統確實會將識別資料傳回給各自的原始設備製造商。 Linux 傾向於不對系統供應商提交資料，但它在漏洞和惡意應用程式的保護很差。 這可以通過專門的發行版來緩解，這些發行版大量使用虛擬器或容器，例如 [Qubes OS](../desktop.md#qubes-os).。 +行動作業系統通常具有比桌面作業系統具備更好的應用程式沙盒：應用程式沒有根存取權限，且需要存取系統資源的權限。 + +桌面操作系統通常在適當的沙盒化上落後。 ChromeOS 具備與 Android 相似的沙盒功能， macOS 具有完整的系統權限控制（開發人員可以選擇為應用程式加入沙盒）。 然而，這些作業系統確實會將識別資料傳回給各自的原始設備製造商。 Linux 傾向於不對系統供應商提交資料，但它在漏洞和惡意應用程式的保護很差。 這可以通過專門的發行版來緩解，這些發行版大量使用虛擬器或容器，例如 [Qubes OS](../desktop.md#qubes-os).。 + +
:material-target-account: 目標攻擊 針對特定人士的針對性攻擊更難處理。 常見的攻擊包括通過電子郵件發送惡意文件、利用(瀏覽器和操作系統的)漏洞以及物理攻擊。 如果這是您擔心這點，應該採用更先進的威脅減輕策略。 -!!! tip "提示" +
+

Tip

- 在設計上， **網頁瀏覽器**、**電子郵件用戶端** 和 **辦公室應用程式** 常常運行第三方發送無法信任的代碼。 運行多個虛擬器-將這些應用程序與主機系統相互分開，此技術可減少系統遭到應用程序攻擊的機會。 例如， Qubes OS 或 Windows 上的 Microsoft Defender Application Guard 等技術提供了方便的作法。 +在設計上， **網頁瀏覽器**、**電子郵件用戶端** 和 **辦公室應用程式** 常常運行第三方發送無法信任的代碼。 運行多個虛擬器-將這些應用程序與主機系統相互分開，此技術可減少系統遭到應用程序攻擊的機會。 例如， Qubes OS 或 Windows 上的 Microsoft Defender Application Guard 等技術提供了方便的作法。 + +
若您特別擔心 **物理攻擊**，就應選用具安全驗證開機的作業系統，例如 Android, iOS, macOS, 或[Windows (帶 TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process)。 應確保您的驅動器是加密的，並且操作系統使用 TPM或 Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) 或 [Element](https://developers.google.com/android/security/android-ready-se) 來限制輸入加密密碼的嘗試率。 您應該避免與不信任的人共享您的電腦，因為大多數桌面作業系統不會單獨加密每個用戶的數據。 @@ -61,13 +67,16 @@ description: 您的威脅模型雖說是個人的事，但它也是本站許多 慶幸的是， E2EE 可以加密您與收件人之間的通信，甚至在訊息送到伺服器之前，緩解此問題。 假設服務提供商無法訪問任何一方的私鑰，您的訊息保密性得到保證。 -!!! note "Web 加密備註" +
+

Note on Web-based Encryption

- 實際上，不同 E2EE 操作的效力各不相同。 應用程式，例如 [Signal](../real-time-communication.md#signal) ，會在您的裝置上原生執行，且此應用程式在不同設備的安裝上都是如此。 如果服務提供商在他們的應用程序中引入 [後門](https://zh.wikipedia.org/wiki/Backdoor_(computing)) ----試圖竊取您的私鑰----它稍後可以通過[逆向工程](https://zh.wikipedia.org/wiki/Reverse_engineering)檢測。 - - 另一方面，執行網頁 E2EE，例如 Proton Mail 的網頁郵件或Bitwarden 的* Web Vault * ，依靠伺服器動態地向瀏覽器提供JavaScript 代碼來處理加密。 惡意伺服器可以針對您發送惡意 JavaScript 代碼以竊取您的加密密鑰（這將非常難以察覺）。 因為伺服器可以選擇為不同的人提供不同的網頁用戶端，即使您注意到攻擊也很難證明提供商有罪。 - - 因此，您應該盡可能使用原生軟體程式多於網頁客戶端。 +實際上，不同 E2EE 操作的效力各不相同。 應用程式，例如 [Signal](../real-time-communication.md#signal) ，會在您的裝置上原生執行，且此應用程式在不同設備的安裝上都是如此。 如果服務提供商在他們的應用程序中引入 [後門](https://zh.wikipedia.org/wiki/Backdoor_(computing)) ----試圖竊取您的私鑰----它稍後可以通過[逆向工程](https://zh.wikipedia.org/wiki/Reverse_engineering)檢測。 + +另一方面，執行網頁 E2EE，例如 Proton Mail 的網頁郵件或Bitwarden 的* Web Vault * ，依靠伺服器動態地向瀏覽器提供JavaScript 代碼來處理加密。 惡意伺服器可以針對您發送惡意 JavaScript 代碼以竊取您的加密密鑰（這將非常難以察覺）。 因為伺服器可以選擇為不同的人提供不同的網頁用戶端，即使您注意到攻擊也很難證明提供商有罪。 + +因此，您應該盡可能使用原生軟體程式多於網頁客戶端。 + +
即便使用 E2EE ，服務商仍然可以對 **元數據**進行分析，這通常不受保護。 雖然服務提供商無法讀取您的訊息，但他們仍然可以觀察重要的事情，例如您正在與誰交談、傳送訊息的頻率以及使用活躍時段。 元數據的保護不多，如果它在您的 [威脅模型](threat-modeling.md)中，就應該密切注意使用軟體的技術文檔，看看元數據是否最小化或任何保護。 @@ -77,17 +86,23 @@ description: 您的威脅模型雖說是個人的事，但它也是本站許多 大規模監控是對全體 (或其中某一群特定)人群進行錯綜複雜的監視活動。[^1] 它通常是指政府項目，例如由[Edward Snowden 在 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present))所揭露的內幕。 然而，它也可以由公司代表政府機構或由他們自己主動進行。 -!!! abstract "監控地圖集" +
+

Atlas of Surveillance

- 如果您想進一步了解監控方法及其在您所在城市的實施方式，您也可以查看[電子前鋒基金會 Eff](https://www.eff.org/)的[監控地圖集](https://atlasofsurveillance.org/)。 - - 在法國，您可以看看非營利組織 La Quadrature du Net 維護的 [Technolopolice 網站](https://technopolice.fr/villes/)。 +如果您想進一步了解監控方法及其在您所在城市的實施方式，您也可以查看[電子前鋒基金會 Eff](https://www.eff.org/)的[監控地圖集](https://atlasofsurveillance.org/)。 + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
政府常認為大規模監控計劃是打擊恐怖主義和預防犯罪的必要手段。 然而，少數羣體和政治異見人士最常遭受不成比例地人權侵害。 -!!! 美國自由民權聯盟 ACLU： [*9/11 的隱私教訓：大規模監控不是前進的道路*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward) +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- 面對[愛德華·斯諾登（Edward Snowden）披露的 [PRISM]（ https://en.wikipedia.org/wiki/PRISM ）和 [Upstream]（ https://en.wikipedia.org/wiki/Upstream_collection ）]等政府計劃，情報官員承認，國家安全局多年來一直祕密地收集每個美國人電話的記錄—誰在打電話，何時打電話，以及通話時間多久。 當 NSA 日復一日地收集這類資訊時，就可以揭示人們生活相關聯的敏感細節，例如他們是否打電話給牧師、墮胎提供者、成癮顧問或自殺熱線。 +面對[愛德華·斯諾登（Edward Snowden）披露的 [PRISM]（ https://en.wikipedia.org/wiki/PRISM ）和 [Upstream]（ https://en.wikipedia.org/wiki/Upstream_collection ）]等政府計劃，情報官員承認，國家安全局多年來一直祕密地收集每個美國人電話的記錄—誰在打電話，何時打電話，以及通話時間多久。 當 NSA 日復一日地收集這類資訊時，就可以揭示人們生活相關聯的敏感細節，例如他們是否打電話給牧師、墮胎提供者、成癮顧問或自殺熱線。 + +
儘管在美國有越來越多的大規模監控，政府卻發現像依 215 條採取的監控計畫在阻卻犯案與恐怖陰謀上沒有實用價值，它們幾乎只是重複著 FBI 所做的特定監控計畫而已。[^2] @@ -133,11 +148,14 @@ description: 您的威脅模型雖說是個人的事，但它也是本站許多 關注審查威脅的人可以使用像 [Tor](../advanced/tor-overview.md) 這樣的技術來規避它，並支持像 [Matrix](../real-time-communication.md#element)這樣的抗審查通信平臺，該平臺沒有可以任意關閉帳戶的集中帳戶權限。 -!!! tip "提示" +
+

Tip

- 雖然很容易避掉審查，但隱藏您正在做的事可就沒那麼簡單了。 - - 您應該考慮可讓對手觀察哪些網路行為，以及能否對這些行為有合理的否認說辭。 例如，[使用[加密 DNS](../advanced/dns-overview.md#what-is-encrypted-dns)可以幫助您繞過對 DNS 基本審查系統，但它無法對 ISP 隱藏您正在訪問的內容。 VPN 或 Tor 有助於向網路管理員隱藏您正在訪問的內容，但無法隱藏您正在使用 VPN 或 Tor 。 可插拔傳輸（例如 Obfs4proxy、Meek 或 Shadowsocks）可以幫助您避開阻擋常見VPN 協議或 Tor 的防火牆，但仍然可以通過探測或[深度封包檢查](https://en.wikipedia.org/wiki/Deep_packet_inspection) 等方法檢測您嘗圖作的規避。 +雖然很容易避掉審查，但隱藏您正在做的事可就沒那麼簡單了。 + +您應該考慮可讓對手觀察哪些網路行為，以及能否對這些行為有合理的否認說辭。 例如，[使用[加密 DNS](../advanced/dns-overview.md#what-is-encrypted-dns)可以幫助您繞過對 DNS 基本審查系統，但它無法對 ISP 隱藏您正在訪問的內容。 VPN 或 Tor 有助於向網路管理員隱藏您正在訪問的內容，但無法隱藏您正在使用 VPN 或 Tor 。 可插拔傳輸（例如 Obfs4proxy、Meek 或 Shadowsocks）可以幫助您避開阻擋常見VPN 協議或 Tor 的防火牆，但仍然可以通過探測或[深度封包檢查](https://en.wikipedia.org/wiki/Deep_packet_inspection) 等方法檢測您嘗圖作的規避。 + +
您必須考慮試圖繞過網路審查的風險、潛在的後果以及您的對手可能很經驗老道。 您應該謹慎選擇軟件，並制定備份計劃以防被抓住。 diff --git a/i18n/zh-Hant/basics/multi-factor-authentication.md b/i18n/zh-Hant/basics/multi-factor-authentication.md index f794cd14..1a35be77 100644 --- a/i18n/zh-Hant/basics/multi-factor-authentication.md +++ b/i18n/zh-Hant/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLog ### Linux -!!! warning "警告" +
+

Warning "警告"

- 如果系統主機名稱發生變更（例如由於 DHCP ） ，您將無法登入。 在遵循本指南之前，為您的電腦設置正確的主機名至關重要。 +如果系統主機名稱發生變更（例如由於 DHCP ） ，您將無法登入。 在遵循本指南之前，為您的電腦設置正確的主機名至關重要。 + +
Linux 上的 `pam_u2f` 模組可以提供雙因素驗證，以便在最流行的 Linux 發行版上登錄。 如果您有支援 U2F 的硬體安全金鑰，可以為您的登入設定 MFA 驗證。 Yubico有一個 [Ubuntu Linux 登錄指南- U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) ，應該適用於任何發行版。 軟體包管理器指令（例如 `apt-get`）和軟體包名稱可能不同。 本指南 **不適用於** Qubes OS. diff --git a/i18n/zh-Hant/basics/passwords-overview.md b/i18n/zh-Hant/basics/passwords-overview.md index c9f9e2c0..290f3ad1 100644 --- a/i18n/zh-Hant/basics/passwords-overview.md +++ b/i18n/zh-Hant/basics/passwords-overview.md @@ -1,7 +1,7 @@ --- -title: "密碼介紹" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' -description: 以下是關於如何建立最強密碼並確保帳戶安全的一些提示和技巧。 +description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- 密碼是我們日常數位生活的重要組成部分。 我們使用它們來保護自己帳戶、設備和祕密。 儘管密碼常常是我們與挖取我們私人資訊的對手之間僅有的唯一阻隔，但人們並未對密碼有充分的考量，導致人們使用的密碼很容易被猜到或強力破解。 @@ -26,9 +26,12 @@ description: 以下是關於如何建立最強密碼並確保帳戶安全的一 對於無需記住的密碼（例如存儲在密碼管理器中的密碼）時，如果您的 [威脅模型](threat-modeling.md) 需要它，建議每隔幾個月查看一次重要帳戶（特別是沒使用多因素身份驗證的帳戶）並更改其密碼，以防它們在尚未公開的資料洩露中遭到破壞。 大多數密碼管理器可為密碼設定到期日期，以便更容易管理。 -!!! tip "檢查數據洩露" +
+

Checking for data breaches

- 如果您的密碼管理器可以檢查密碼是否已被破壞，請務必檢查並立即更改可能已暴露在資料外洩的密碼。 或者，您可以在 [news aggregator](../news-aggregators.md)的幫助下關注 [Have I Been Pwned 最新資料外洩情報](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches)。 +如果您的密碼管理器可以檢查密碼是否已被破壞，請務必檢查並立即更改可能已暴露在資料外洩的密碼。 或者，您可以在 [news aggregator](../news-aggregators.md)的幫助下關注 [Have I Been Pwned 最新資料外洩情報](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches)。 + +
## 建立強密碼 @@ -48,9 +51,12 @@ Diceware 是一種創建密碼短語的方法，這些密短口令易於記憶 使用骰子來產生一組 diceware 口令密語，請按照以下步驟： -!!! note "備註" +
+

Note

- 這裏的說明假設您正使用 [EFF的大型單詞清單](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) 來生成密語，每個單詞需要骰子滾動五次。 其他單詞列表的單詞其骰子滾動次數不一，且可能需要不同單詞數量來達成相同的熵。 +這裏的說明假設您正使用 [EFF的大型單詞清單](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) 來生成密語，每個單詞需要骰子滾動五次。 其他單詞列表的單詞其骰子滾動次數不一，且可能需要不同單詞數量來達成相同的熵。 + +
1. 將1~6 骰子滾動五次，記下每次出現的數字。 @@ -60,31 +66,37 @@ Diceware 是一種創建密碼短語的方法，這些密短口令易於記憶 4. 重複相同手續，直到您的口令密語達到足夠的單詞，請用空格分隔單詞。 -!!! warning "重要" +
+

Important

- 你 **不應** 重新滾動單詞，以取得自己喜好的單詞組合。 這個過程應該是完全隨機的。 +你 **不應** 重新滾動單詞，以取得自己喜好的單詞組合。 這個過程應該是完全隨機的。 + +
如果您手邊沒有或不想使用真正的骰子，可利用密碼管理器內建密碼生成器，因為大多數密碼生成器除了普通密碼之外還可以選擇生成 diceware 口令密語。 我們建議使用 [EFF 的大型單詞清單](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) 來生成您的diceware 口令密語，因為它提供與原始列表完全相同的安全性，同時更容易記憶的單詞。 如果不想要使用英文密語，也有 [其他語言的單詞清單](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline)。 -??? note "diceware 口令密語的熵和強度的說明" +
+Explanation of entropy and strength of diceware passphrases - 為了證明 diceware 密語的強度，我們將使用前面提到的七個單詞密語（`viewable fastness reluctant squishy seventeen shown pencil` ）和 [EFF 的大型單詞列表] (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)作例子。 - - 判斷 diceware 口令密語強度的衡量標準是確定它有多少熵。 Diceware 口令密語中的個別單詞的熵為 $\text{log}_2(\text{WordsInList})$ 而整組密語的熵總量為 $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase}). - - 因此，上述列表中的每個單詞都會產生~ 12.9 位熵（($\text{log}_2 (7776) $) ，而其中取得七個單詞組成的口令密語就具有~ 90.47位熵 ($\text{log}_2 (7776 ^ 7) $ )。 - - [EFF 的大型單詞清單](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)包含 7776 個獨特單詞。 要計算可能的口令密語數量，所要做的就是 $\text{WordsInList}^\text{WordsInPhrase}$ ，或者依我們的情況， $ 7776 ^ 7 $。 - - 讓我們從這個角度來看：使用 [EFF 的大型單詞列表](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) 的七個單詞的口令密短約有1,719,070,799,748,422,500,000,000 種組合。 - - 平均而言，至少要嘗試所有可能組合的一半來猜測您的密語。 考慮到這一點，即使對手每秒能夠猜測~ 1,000,000,000,000 次，他們仍然需要~ 27,255,689 年來猜出您的密語。 即使以下情況屬實，也是如此： +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - 對手知道您使用 diceware 方法。 - - 對手知道您所使用的具體單詞清單。 - - 對手知道您的密語包含多少個單詞。 +判斷 diceware 口令密語強度的衡量標準是確定它有多少熵。 Diceware 口令密語中的個別單詞的熵為 $\text{log}_2(\text{WordsInList})$ 而整組密語的熵總量為 $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase}). + +因此，上述列表中的每個單詞都會產生~ 12.9 位熵（($\text{log}_2 (7776) $) ，而其中取得七個單詞組成的口令密語就具有~ 90.47位熵 ($\text{log}_2 (7776 ^ 7) $ )。 + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. 要計算可能的口令密語數量，所要做的就是 $\text{WordsInList}^\text{WordsInPhrase}$ ，或者依我們的情況， $ 7776 ^ 7 $。 + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +平均而言，至少要嘗試所有可能組合的一半來猜測您的密語。 考慮到這一點，即使對手每秒能夠猜測~ 1,000,000,000,000 次，他們仍然需要~ 27,255,689 年來猜出您的密語。 即使以下情況屬實，也是如此： + +- 對手知道您使用 diceware 方法。 +- 對手知道您所使用的具體單詞清單。 +- 對手知道您的密語包含多少個單詞。 + +
總而言之， diceware 口令密語是最佳選擇，當您需要既容易記住 *又* 非常強大的東西。 @@ -98,13 +110,16 @@ Diceware 是一種創建密碼短語的方法，這些密短口令易於記憶 [推薦的密碼管理員列表](../passwords.md ""){.md-button} -!!! warning "不要將密碼和 TOTP 令牌放在同一個密碼管理器中" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- 當使用 TOTP 代碼作為 [多因素驗證](../multi-factor-authentication.md) 時，最好的安全措施是將 TOTP 代碼保存在 [分開的應用程序](../multi-factor-authentication.md#authenticator-apps) 中。 - - 將您的 TOTP 令牌存儲在與密碼相同的位置，雖然方便，但假若對手可以存取密碼管理器，則帳戶安全驗證則減少為單一因素。 - - 此外，我們不建議把一次性修復代碼存在密碼管理器。 它們應分開儲存，例如放在離線儲存設備的加密容器中。 +當使用 TOTP 代碼作為 [多因素驗證](../multi-factor-authentication.md) 時，最好的安全措施是將 TOTP 代碼保存在 [分開的應用程序](../multi-factor-authentication.md#authenticator-apps) 中。 + +將您的 TOTP 令牌存儲在與密碼相同的位置，雖然方便，但假若對手可以存取密碼管理器，則帳戶安全驗證則減少為單一因素。 + +此外，我們不建議把一次性修復代碼存在密碼管理器。 它們應分開儲存，例如放在離線儲存設備的加密容器中。 + +
### 備份 diff --git a/i18n/zh-Hant/basics/vpn-overview.md b/i18n/zh-Hant/basics/vpn-overview.md index 3dedfd61..c86b750d 100644 --- a/i18n/zh-Hant/basics/vpn-overview.md +++ b/i18n/zh-Hant/basics/vpn-overview.md @@ -1,8 +1,8 @@ --- -meta_title: "VPN如何保護您的隱私？ VPN概述 - Privacy Guides" -title: VPN 簡介 +meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" +title: VPN Overview icon: material/vpn -description: 虛擬私用網路將風險從您的ISP 轉移到您信任的第三方。 你應該記住這些事情。 +description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- 虛擬專用網路是將您的網路末端延伸到世界其它地方的一種方式。 @@ -11,9 +11,12 @@ ISP 可以看到網路終端設備（例如數據機）的網際網路進出流 使用 VPN 將您對網路的信任轉移到世界上某處的伺服器，甚至可以向 ISP 隱藏這些資訊。 因此， ISP只會看到您已連接到VPN ，而不會看到您正在傳遞的活動。 -!!! note "備註" +
+

Note

- 我們在本站提到「虛擬私人網路」時，通常指的是**商業** [VPN 服務商](../vpn.md)，每月向其支付費用以換取路由網路流量安全地通過他們的公共伺服器。 還有許多其他形式的VPN，例如自行託管的 VPN 或由工作場所運營的VPN，它們允許安全地連接到內部/員工網絡資源，但是，這類VPN 通常旨在安全地訪問遠端網絡，而不是保護隱私的網路連線。 +我們在本站提到「虛擬私人網路」時，通常指的是**商業** [VPN 服務商](../vpn.md)，每月向其支付費用以換取路由網路流量安全地通過他們的公共伺服器。 還有許多其他形式的VPN，例如自行託管的 VPN 或由工作場所運營的VPN，它們允許安全地連接到內部/員工網絡資源，但是，這類VPN 通常旨在安全地訪問遠端網絡，而不是保護隱私的網路連線。 + +
## VPN工作原理 diff --git a/i18n/zh-Hant/os/android-overview.md b/i18n/zh-Hant/os/android-overview.md index 925c617e..2ee63876 100644 --- a/i18n/zh-Hant/os/android-overview.md +++ b/i18n/zh-Hant/os/android-overview.md @@ -1,7 +1,7 @@ --- -title: Android 概述 +title: Android Overview icon: simple/android -description: Android是一個開源作業系統，具有強大的安全保護，使其成為手機的首選。 +description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- ![Android 圖標](../assets/img/android/android.svg){ align=right } @@ -102,17 +102,19 @@ Android 13: [Exodus](https://exodus-privacy.eu.org/) 在比較具相似目的的應用程式時可能很有用。 如果某應用程式需要大量權限，並且有很多的廣告和分析，這可能是個壞跡象。 建議查看個別跟蹤器與閱讀其描述而不是只有**計算總數**把所列的項目一視同仁。 -!!! warning "警告" +
+

Warning "警告"

- 如果應用程式主要是基於網頁的服務，則跟蹤可能發生在伺服器端。 [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/)顯示「無追蹤器」，但確實會追蹤使用者在網站上的興趣和行為。 應用程式也許無需廣告業的標準代碼庫來逃避檢測，儘管這不太可能。 - +如果應用程式主要是基於網頁的服務，則跟蹤可能發生在伺服器端。 [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/)顯示「無追蹤器」，但確實會追蹤使用者在網站上的興趣和行為。 應用程式也許無需廣告業的標準代碼庫來逃避檢測，儘管這不太可能。 -!!! note "備註" +
- [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/)等隱私友好型應用程式可能會顯示 [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/)等追蹤程式。 此程式庫包括 [Firebase Cloud Messaging](https://zh.wikipedia.org/wiki/Firebase_Cloud_Messaging) ，可以在應用程式中提供 [推送通知](https://zh.wikipedia.org/wiki/Push_technology)。 這是Bitwarden的 [情況](https://fosstodon.org/ @ bitwarden/109636825700482007)。 這並不意味 Bitwarden 使用 Google Firebase Analytics 提供的所有分析功能。 - +
+

Note

+[Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/)等隱私友好型應用程式可能會顯示 [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/)等追蹤程式。 此程式庫包括 [Firebase Cloud Messaging](https://zh.wikipedia.org/wiki/Firebase_Cloud_Messaging) ，可以在應用程式中提供 [推送通知](https://zh.wikipedia.org/wiki/Push_technology)。 這是Bitwarden的 [情況](https://fosstodon.org/ @ bitwarden/109636825700482007)。 這並不意味 Bitwarden 使用 Google Firebase Analytics 提供的所有分析功能。 +
## 隱私功能 diff --git a/i18n/zh-Hant/os/ios-overview.md b/i18n/zh-Hant/os/ios-overview.md index 04cc8181..0f6acbd1 100644 --- a/i18n/zh-Hant/os/ios-overview.md +++ b/i18n/zh-Hant/os/ios-overview.md @@ -1,7 +1,7 @@ --- -title: iOS 介紹 +title: iOS Overview icon: simple/apple -description: 蘋果公司使用 Unix 作業系統來開發macOS 支援自家的 Mac 電腦。 +description: iOS is a mobile operating system developed by Apple for the iPhone. --- **iOS** 和 **iPadOS** 是 Apple 分別為其 iPhone 和 iPad 產品開發的專有移動作業系統。 如果您擁有 Apple 移動設備，可通過禁用某些內置遙測功能以及強化系統內置的隱私和安全設置來增強隱私。 @@ -146,9 +146,12 @@ Apple 產品的大多數隱私和安全問題與其雲服務有關，而不是 iPhone 可以抵禦暴力攻擊，在多次嘗試失敗後，需要等待很長時間； 然而，過去已經有一些漏洞可以繞開這個問題。 為了更加安全，可將手機設置為在 10 次密碼嘗試錯誤後自行擦除。 -!!! warning "警告" +
+

Warning "警告"

- 啟用此設置後，別人可以通過多次輸入錯誤密碼來故意擦除您的手機。 確保有適當備份，並且僅在有把握的情況下才啟用此設置。 +啟用此設置後，別人可以通過多次輸入錯誤密碼來故意擦除您的手機。 確保有適當備份，並且僅在有把握的情況下才啟用此設置。 + +
- [x] 打開 **清除資料** diff --git a/i18n/zh-Hant/os/macos-overview.md b/i18n/zh-Hant/os/macos-overview.md index 50f72f52..51496540 100644 --- a/i18n/zh-Hant/os/macos-overview.md +++ b/i18n/zh-Hant/os/macos-overview.md @@ -1,7 +1,7 @@ --- -title: macOS 簡介 +title: macOS Overview icon: material/apple-finder -description: macOS 是蘋果電腦的桌面作業系統，搭配其自家硬體提供了堅固的安全。 +description: macOS is Apple's desktop operating system that works with their hardware to provide strong security. --- 蘋果公司使用 Unix 作業系統來開發**macOS** 支援自家的 Mac 電腦。 為提高 macOS 隱私，用戶可關閉遙測功能以強化現有的隱私與安全設置。 @@ -156,9 +156,12 @@ macOS 通過不同屬性的多層軟體和硬體保護來進行深度防禦。 ### 軟體安全 -!!! warning "警告" +
+

Warning "警告"

- macOS 可以安裝測試版更新。 但它們是不穩定的，可能帶有額外遙測，因為其用於測試目的。 因此，我們建議避免使用測試版軟件。 +macOS 可以安裝測試版更新。 但它們是不穩定的，可能帶有額外遙測，因為其用於測試目的。 因此，我們建議避免使用測試版軟件。 + +
#### 簽署系統卷宗 @@ -178,9 +181,12 @@ macOS 設置了某些無法覆蓋的安全限制。 這些稱為強制取用控 從 App Store 下載的 macOS 應用需要使用[應用沙箱](https://developer.apple.com/documentation/security/app_sandbox)進行沙箱處理。 -!!! warning "警告" +
+

Warning "警告"

- 從官方 App Store 之外下載的軟體不需要沙盒。 應盡可能避免使用非 App Store 軟體。 +從官方 App Store 之外下載的軟體不需要沙盒。 應盡可能避免使用非 App Store 軟體。 + +
##### 防毒軟體 diff --git a/i18n/zh-Hant/os/qubes-overview.md b/i18n/zh-Hant/os/qubes-overview.md index c5a406c7..10d101be 100644 --- a/i18n/zh-Hant/os/qubes-overview.md +++ b/i18n/zh-Hant/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes 作業系統利用*qubes* (過去稱"虛擬機器") 來隔離 Qubes 使用 [分區化](https://www.qubes-os.org/intro/) 來確保系統安全。 Qubes 從模板創建，預設為 Fedora、Debian 和 [Whonix](../desktop.md#whonix)。 Qubes OS還允許您創建一次性 [一次性](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*。 -??? 更新改用“*qubes*一辭，避免將它們稱為“虛擬器”。 +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - 由於“appVM”一辭更改為“qube”，此處和 Qubes OS 文檔中的一些資訊可能在語言上產生衝突。 Qube 不是完整的虛擬器，但有與 VM 類似的功能。 +由於“appVM”一辭更改為“qube”，此處和 Qubes OS 文檔中的一些資訊可能在語言上產生衝突。 Qube 不是完整的虛擬器，但有與 VM 類似的功能。 + +
![Qubes架構](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes Architecture, Credit: What is Qubes OS Intro
@@ -41,9 +44,12 @@ Qubes OS在主機作業系統上 利用 [dom0](https://wiki.xenproject.org/wiki/ 若要將檔案和目錄(資料夾) 從一個*qube* 複製貼到另一個 ，您可以使用選項 **Copy to Other AppVM...** 或 **Move to Other AppVM...**。 不同之處在於 **Move** 選項會刪除原始檔案。 這兩個選項都可以保護您的剪貼簿不會洩漏到任何其他*qube* 。 這比氣隙檔案傳輸更安全。 氣隙電腦仍會被迫解析分區或檔案系統。 這在inter-qube複製系統中是不需要的。 -??? *Qube* 沒有自己的檔案系統。 +
+Qubes do not have their own filesystems. - 您可以在 qubes之間[複製和移動檔案](https://www.qubes-os.org/doc/how-to-copy-and-move-files/)。 當這樣做時，不會立即進行更改，並且在發生事故時可以輕鬆撤消。 當您運行 *qube* 時，它沒有持久檔案系統。 您可以創建和刪除檔案，但這些更改是暫時的。 +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. 當這樣做時，不會立即進行更改，並且在發生事故時可以輕鬆撤消。 When you run a *qube*, it does not have a persistent filesystem. 您可以創建和刪除檔案，但這些更改是暫時的。 + +
### 虛擬機之間交互 diff --git a/i18n/zh/advanced/payments.md b/i18n/zh/advanced/payments.md index 13de5c4d..df356a03 100644 --- a/i18n/zh/advanced/payments.md +++ b/i18n/zh/advanced/payments.md @@ -45,11 +45,14 @@ These tend to be good options for recurring/subscription payments online, while Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose. -!!! 危险 +
+

Danger

- The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. - - Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. +The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity. + +Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust. + +
### Privacy Coins diff --git a/i18n/zh/advanced/tor-overview.md b/i18n/zh/advanced/tor-overview.md index 409c5f1f..9a1d71f7 100644 --- a/i18n/zh/advanced/tor-overview.md +++ b/i18n/zh/advanced/tor-overview.md @@ -45,13 +45,16 @@ Setting up bad configurations like these is difficult to do accidentally, becaus --- -!!! info "VPN/SSH Fingerprinting" +
+

VPN/SSH Fingerprinting

- The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. - - Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. - - If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. + +Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. + +If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction. + +
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. diff --git a/i18n/zh/basics/account-creation.md b/i18n/zh/basics/account-creation.md index 94717e43..b27a9c07 100644 --- a/i18n/zh/basics/account-creation.md +++ b/i18n/zh/basics/account-creation.md @@ -1,8 +1,8 @@ --- -meta_title: "如何私密地创建互联网账户 - 隐私指南" -title: "账户创建" +meta_title: "How to Create Internet Accounts Privately - Privacy Guides" +title: "Account Creation" icon: 'material/account-plus' -description: 在网上创建账户几乎是网络生活的必需，采取这些步骤确保你的隐私安全。 +description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private. --- 人们经常不假思索地注册服务。 也许它是一个流媒体服务，这样你就可以看到每个人都在谈论的新节目，或者一个为你最喜欢的快餐店提供折扣的账户。 无论情况如何，你应该考虑现在和以后对你的数据的影响。 @@ -29,9 +29,12 @@ description: 在网上创建账户几乎是网络生活的必需，采取这些 创建新账户最常见的方式是通过电子邮件地址和密码。 当使用这种方法时，你应该使用一个密码管理器，并遵循 [有关密码的最佳实践](passwords-overview.md)。 -!!! 提示 +
+

Tip

- 你还可以使用密码管理器来组织其他验证方法！ 只需添加新条目并填写相应字段，你可以为诸如安全问题或备用密钥之类的事物添加注释。 +你还可以使用密码管理器来组织其他验证方法！ 只需添加新条目并填写相应字段，你可以为诸如安全问题或备用密钥之类的事物添加注释。 + +
你将负责管理你的登录凭证。 为了增加安全性，你可以在你的账户上设置 [MFA](multi-factor-authentication.md)。 diff --git a/i18n/zh/basics/common-misconceptions.md b/i18n/zh/basics/common-misconceptions.md index b225d0aa..979c24d2 100644 --- a/i18n/zh/basics/common-misconceptions.md +++ b/i18n/zh/basics/common-misconceptions.md @@ -75,20 +75,23 @@ schema: 最清晰的威胁模型之一是，部分人*，知道你是谁* ，而另一部分人不知道。 总有一些情况下你必须申报你的合法姓名，也有一些情况下你不需要这样做。 -1. **已知身份** - 已知身份是用于必须申报姓名的事情。 有许多法律文件和合同都需要合法身份。 这可能包括开设银行账户、签署房产租赁合同、获得护照、进口物品时的海关申报，或以其他方式与你的政府打交道。 这些东西通常会导致信用卡、信用等级检查、账户号码，以及可能的实际地址等凭证。 +1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses. - 我们不建议使用VPN或Tor来做这些事情，因为你的身份已经通过其他方式被了解。 +We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means. - !!! tip - - 网购时，使用[快递柜](https://en.wikipedia.org/wiki/Parcel_locker)可以帮助你保持实际住址的隐私。 +
+

Tip

+ +网购时，使用[快递柜](https://en.wikipedia.org/wiki/Parcel_locker)可以帮助你保持实际住址的隐私。 + +
2. **未知身份** -未知身份可能是您经常使用的稳定化名。 它不是匿名的，因为它没有变化。 如果你是一个网络社区的一部分，你可能希望保留一个别人知道的角色。 这个化名不是匿名的，因为如果监测的时间足够长，关于主人的细节可以揭示进一步的信息，如他们的写作方式，他们对感兴趣的话题的一般知识，等等。 - 你可能希望为此使用VPN，以掩盖你的IP地址。 金融交易更难掩盖。你可以考虑使用匿名的加密货币，如 [Monero](https://www.getmonero.org/)。 采用altcoin转移也可能有助于掩盖你的货币来源。 通常情况下，交易所需要完成KYC（了解你的客户），然后才允许你将法币兑换成任何种类的加密货币。 当地见面会选项也可能是一种解决方案;然而，这些往往更昂贵，有时也需要KYC。 +你可能希望为此使用VPN，以掩盖你的IP地址。 金融交易更难掩盖。你可以考虑使用匿名的加密货币，如 [Monero](https://www.getmonero.org/)。 采用altcoin转移也可能有助于掩盖你的货币来源。 通常情况下，交易所需要完成KYC（了解你的客户），然后才允许你将法币兑换成任何种类的加密货币。 当地见面会选项也可能是一种解决方案;然而，这些往往更昂贵，有时也需要KYC。 3. **匿名身份** - 即使有经验，匿名身份也很难长期维持。 它们应该是短期和短命的身份，定期轮换。 - 使用Tor可以帮助解决这个问题。 还值得注意的是，通过异步通信可以实现更大的匿名性。实时通信容易受到打字模式的分析（即超过一段文字，在论坛上分发，通过电子邮件等）。 +使用Tor可以帮助解决这个问题。 还值得注意的是，通过异步通信可以实现更大的匿名性。实时通信容易受到打字模式的分析（即超过一段文字，在论坛上分发，通过电子邮件等）。 [^1]: 其中一个明显的例子是 [2021年明尼苏达大学的研究人员将三个漏洞引入了Linux内核开发项目的事件](https://cse.umn.edu/cs/linux-incident)。 diff --git a/i18n/zh/basics/common-threats.md b/i18n/zh/basics/common-threats.md index 93a0b16d..97a26f9a 100644 --- a/i18n/zh/basics/common-threats.md +++ b/i18n/zh/basics/common-threats.md @@ -35,19 +35,25 @@ description: 您的威胁模式是您自己量身定制的，但这些是本网 为了最大限度地减少恶意软件可能造成的损害，您应该采用隔离方式进行安全防护。 这可以是使用不同的计算机进行不同的工作，使用虚拟机来分离不同的相关应用程序组，或者使用一个安全的操作系统，重点是要有应用程序沙盒和强制性的访问控制。 -!!! tip +
+

Tip

- 在应用程序沙盒方面，移动操作系统通常比桌面操作系统更安全。 - - 应用程序无法获得根访问权限，只能访问您授予它们访问权限的系统资源。 桌面操作系统在成熟的沙箱方面通常比较落后。 ChromeOS具有与安卓类似的沙盒属性，而macOS具有完整的系统权限控制和（针对开发者）可选的应用程序沙盒，然而这些操作系统的确会将识别信息传输给各自的OEM。 Linux倾向于不向系统供应商提交信息，但它对漏洞和恶意应用程序的保护很差。 This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). +在应用程序沙盒方面，移动操作系统通常比桌面操作系统更安全。 + +应用程序无法获得根访问权限，只能访问您授予它们访问权限的系统资源。 桌面操作系统在成熟的沙箱方面通常比较落后。 ChromeOS具有与安卓类似的沙盒属性，而macOS具有完整的系统权限控制和（针对开发者）可选的应用程序沙盒，然而这些操作系统的确会将识别信息传输给各自的OEM。 Linux倾向于不向系统供应商提交信息，但它对漏洞和恶意应用程序的保护很差。 This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os). + +
:material-target-account: 定向攻击 针对特定用户的有针对性的攻击更加难以处理。 常见的攻击途径包括通过电子邮件发送恶意文件，利用浏览器和操作系统的漏洞，以及物理攻击。 如果您担心这一点，则可能需要采用更高级的威胁缓解策略。 -!!! tip +
+

Tip

- **网络浏览器**、**电子邮件客户端**和**办公应用程序**在设计上通常都运行源自第三方的不可信代码。 运行多个虚拟机来将此类应用程序从主机系统中分离出来，以及彼此分离，是您可以使用的一种技术，以避免这些应用程序中的漏洞被利用，危及系统的其余部分。 例如，Qubes OS或Windows上的Microsoft Defender Application Guard等技术提供了无缝执行此操作的便捷方法。 +**网络浏览器**、**电子邮件客户端**和**办公应用程序**在设计上通常都运行源自第三方的不可信代码。 运行多个虚拟机来将此类应用程序从主机系统中分离出来，以及彼此分离，是您可以使用的一种技术，以避免这些应用程序中的漏洞被利用，危及系统的其余部分。 例如，Qubes OS或Windows上的Microsoft Defender Application Guard等技术提供了无缝执行此操作的便捷方法。 + +
如果你担心 **物理攻击** ，你应该使用具有安全验证启动实现的操作系统，如Android、iOS、macOS、 [Windows（带TPM）](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process)。 你还应该确保你的驱动器是加密的，并且操作系统使用TPM或安全 [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) 或 [Element](https://developers.google.com/android/security/android-ready-se) ，以限制输入加密口令的重试速率。 你应该避免与你不信任的人分享你的电脑，因为大多数桌面操作系统没有按用户单独加密数据。 @@ -61,13 +67,16 @@ description: 您的威胁模式是您自己量身定制的，但这些是本网 值得庆幸的是，可以通过在发送到服务器之前就对您与收件人之间的通信进行端到端加密来缓解此问题。 只要服务提供者不能获得任何一方的私钥，就能保证你的信息的保密性。 -!!! 注释“关于基于web的加密的说明” +
+

Note on Web-based Encryption

- 在实践中，不同的端到端加密实现的有效性各不相同。 [Signal](../real-time-communication.md＃signal)这类应用程序在您的设备本地运行，并且应用程序副本在不同的安装下保持相同。 如果服务提供商在他们的应用程序中设置后门，试图窃取你的私钥，这可以在未来通过逆向工程检测出来。 - - 另一方面，基于Web的端到端加密实现（如Proton Mail的webmail或Bitwarden的web vault）依赖于服务器动态地向浏览器提供JavaScript代码来处理加密操作。 一个恶意的服务器可以针对一个特定的用户，向他们发送恶意的JavaScript代码来窃取他们的加密密钥，而用户是很难注意到这样的事情的。 即使用户注意到有人试图窃取他们的密钥，也很难证明是提供商试图这样做，因为服务器可以选择向不同的用户提供不同的网络客户端。 - - 因此，当依赖端到端加密时，你应该尽可能选择使用本地应用程序而不是网络客户端。 +在实践中，不同的端到端加密实现的有效性各不相同。 [Signal](../real-time-communication.md＃signal)这类应用程序在您的设备本地运行，并且应用程序副本在不同的安装下保持相同。 如果服务提供商在他们的应用程序中设置后门，试图窃取你的私钥，这可以在未来通过逆向工程检测出来。 + +另一方面，基于Web的端到端加密实现（如Proton Mail的webmail或Bitwarden的web vault）依赖于服务器动态地向浏览器提供JavaScript代码来处理加密操作。 一个恶意的服务器可以针对一个特定的用户，向他们发送恶意的JavaScript代码来窃取他们的加密密钥，而用户是很难注意到这样的事情的。 即使用户注意到有人试图窃取他们的密钥，也很难证明是提供商试图这样做，因为服务器可以选择向不同的用户提供不同的网络客户端。 + +因此，当依赖端到端加密时，你应该尽可能选择使用本地应用程序而不是网络客户端。 + +
即使有端对端加密，服务提供商仍然可以根据 **元数据**，对你进行剖析，而这些元数据通常不受保护。 虽然服务提供商无法阅读您的消息以查看您所说的内容，但他们仍然可以观察到您正在与谁通话、您给他们发送消息的频率以及您通常活跃的时间等情况。 对元数据的保护是相当不常见的，如果你关心这一点，应该密切关注你所使用的软件的技术文档，看看是否有任何元数据最小化或保护。 @@ -77,17 +86,23 @@ description: 您的威胁模式是您自己量身定制的，但这些是本网 大规模监控是指对许多或所有特定人群进行监控的工作。 它通常是指像[Edward Snowden在2013披露](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present))的那一类政府项目。 -!!! 摘要“监测地图” +
+

Atlas of Surveillance

- 如果你想了解更多关于监视方法以及它们在你的城市是如何实施的，你也可以看看[电子前沿基金会](https://atlasofsurveillance.org/)的[监视地图]。 - - 在法国，你可以看看由非营利协会 La Quadrature du Net 维护的[Technolopolice 网站](https://technopolice.fr/villes/)。 +如果你想了解更多关于监视方法以及它们在你的城市是如何实施的，你也可以看看[电子前沿基金会](https://atlasofsurveillance.org/)的[监视地图]。 + +In France you can take a look at the [Technopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net. + +
政府经常为大规模监控项目辩护，认为这是打击恐怖主义和防止犯罪的必要手段。 然而，它侵犯人权，最常被用来不成比例地针对少数群体和持不同政见者等。 -!!! 引用 "美国公民自由联盟。 [*9/11的隐私教训。大规模监控不是前进的方向*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)" +
+

ACLU: The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward

- 面对[爱德华-斯诺登披露的政府项目，如 [PRISM]（https://en.wikipedia.org/wiki/PRISM）和 [Upstream]（https://en.wikipedia.org/wiki/Upstream_collection）]，情报官员也承认，国家安全局多年来一直在秘密收集几乎每个美国人的电话记录--谁在给谁打电话，这些电话是什么时候打的，以及它们持续多长时间。 你应该考虑你的对手能观察到网络的哪些方面，以及你的行动是否有合理的可否认性。 +面对[爱德华-斯诺登披露的政府项目，如 [PRISM]（https://en.wikipedia.org/wiki/PRISM）和 [Upstream]（https://en.wikipedia.org/wiki/Upstream_collection）]，情报官员也承认，国家安全局多年来一直在秘密收集几乎每个美国人的电话记录--谁在给谁打电话，这些电话是什么时候打的，以及它们持续多长时间。 你应该考虑你的对手能观察到网络的哪些方面，以及你的行动是否有合理的可否认性。 + +
尽管美国的大规模监控越来越多，但政府发现，像第215条这样的大规模监控计划在阻止实际犯罪或恐怖主义阴谋方面 "没有什么独特的价值"，其努力主要是重复联邦调查局自己的目标监控计划。[^2] @@ -133,11 +148,14 @@ description: 您的威胁模式是您自己量身定制的，但这些是本网 关注审查制度威胁的人可以使用像 [Tor](../advanced/tor-overview.md) 这样的技术来规避审查制度，并支持像 [Matrix](../real-time-communication.md#element)这样的抗审查通信平台，该平台没有一个可以任意关闭账户的集中式账户管理机构。 -!!! tip +
+

Tip

- 虽然逃避审查本身很容易，但隐藏你正在做的事实可能非常有问题。 - - 你应该考虑你的对手可以观察到网络的哪些方面，以及你的行动是否有合理的可否认性。 例如，使用[加密DNS](.../advanced/dns-overview.md#what-is-encrypted-dns)可以帮助你绕过初级的、基于DNS的审查系统，但它不能真正向ISP隐藏你正在访问的内容。 VPN或Tor可以帮助向网络管理员隐藏你正在访问的内容，但不能隐藏你首先在使用这些网络。 可插拔的传输工具（如Obfs4proxy、Meek或Shadowsocks）可以帮助你逃避阻挡普通VPN协议或Tor的防火墙，但你的规避尝试仍然可以被探测或[深度包检查](https://en.wikipedia.org/wiki/Deep_packet_inspection)等方法发现。 +虽然逃避审查本身很容易，但隐藏你正在做的事实可能非常有问题。 + +你应该考虑你的对手可以观察到网络的哪些方面，以及你的行动是否有合理的可否认性。 例如，使用[加密DNS](.../advanced/dns-overview.md#what-is-encrypted-dns)可以帮助你绕过初级的、基于DNS的审查系统，但它不能真正向ISP隐藏你正在访问的内容。 VPN或Tor可以帮助向网络管理员隐藏你正在访问的内容，但不能隐藏你首先在使用这些网络。 可插拔的传输工具（如Obfs4proxy、Meek或Shadowsocks）可以帮助你逃避阻挡普通VPN协议或Tor的防火墙，但你的规避尝试仍然可以被探测或[深度包检查](https://en.wikipedia.org/wiki/Deep_packet_inspection)等方法发现。 + +
你必须始终考虑试图绕过审查制度的风险，潜在的后果，以及你的对手可能有多复杂。 你应该谨慎地选择软件，并有一个备份计划，以防被发现。 diff --git a/i18n/zh/basics/multi-factor-authentication.md b/i18n/zh/basics/multi-factor-authentication.md index 43d666c7..cab35cb9 100644 --- a/i18n/zh/basics/multi-factor-authentication.md +++ b/i18n/zh/basics/multi-factor-authentication.md @@ -140,9 +140,12 @@ sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLog ### Linux系统 -!!! 推荐 +
+

警告

- 如果你的系统的主机名改变了（如由于DHCP的原因），你将无法登录。 在遵循本指南之前，为您的计算机设置正确的主机名至关重要。 +如果你的系统的主机名改变了（如由于DHCP的原因），你将无法登录。 在遵循本指南之前，为您的计算机设置正确的主机名至关重要。 + +
Linux上的 `pam_u2f` 模块可以在大多数流行的Linux发行版上为登录提供双因素认证。 如果你有一个支持U2F的硬件安全密钥，你可以为你的登录设置MFA认证。 Yubico有一个指南 [Ubuntu Linux登录指南 - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) ，它应该适用于任何发行版。 然而，软件包管理器的命令--如 `apt-get`--和软件包名称可能不同。 本指南 **不** 适用于Qubes OS。 diff --git a/i18n/zh/basics/passwords-overview.md b/i18n/zh/basics/passwords-overview.md index 32dbf5fd..8dac9d16 100644 --- a/i18n/zh/basics/passwords-overview.md +++ b/i18n/zh/basics/passwords-overview.md @@ -1,5 +1,5 @@ --- -title: "密码简介" +title: "Introduction to Passwords" icon: 'material/form-textbox-password' description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure. --- @@ -26,9 +26,12 @@ description: These are some tips and tricks on how to create the strongest passw 而那些你不需要记住的密码（如存储在密码管理器内的密码），如果你的 [威胁模型](threat-modeling.md) 有需求，我们建议每隔几个月对重要账户（尤其是不使用多因认证的账户）进行检查并更改其密码，以防它们在尚未公开的数据泄露事件中被泄露。 大多数密码管理器允许你为你的密码设置一个到期日，使之更容易管理。 -!!! 提示 "检查数据泄露情况" +
+

Checking for data breaches

- 如果你的密码管理器允许你检查被泄露的密码，请确保这样做，并及时更改任何可能在数据泄露中被泄露的密码。 你还可以在[新闻聚合器](.../news-aggregators.md)的帮助下关注[Have I Been Pwned's Latest Breaches feed]（https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches）。 +如果你的密码管理器允许你检查被泄露的密码，请确保这样做，并及时更改任何可能在数据泄露中被泄露的密码。 你还可以在[新闻聚合器](.../news-aggregators.md)的帮助下关注[Have I Been Pwned's Latest Breaches feed]（https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches）。 + +
## 创建强密码 @@ -48,9 +51,12 @@ Diceware是一种创建密码的方法，这种密码容易记忆，但很难猜 要使用真正的骰子生成一个diceware口令，请遵循以下步骤。 -!!! note +
+

Note

- 这里的说明步骤假定你使用[EFF的大型词汇表](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)来生成口令，每个词需要掷五个骰子。 其他词表可能需要更多或更少的回合，也可能需要不同数量的词来实现相同的熵值。 +这里的说明步骤假定你使用[EFF的大型词汇表](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)来生成口令，每个词需要掷五个骰子。 其他词表可能需要更多或更少的回合，也可能需要不同数量的词来实现相同的熵值。 + +
1. 掷一个六面体的骰子五次，每次掷完都记下数字。 @@ -60,31 +66,37 @@ Diceware是一种创建密码的方法，这种密码容易记忆，但很难猜 4. 重复这个过程，直到你的口令有你所需要的字数，你应该用空格来分隔每个词。 -!!! 警告 “重要” +
+

Important

- 你**不**应该重新生成单词，来得到一个吸引你的单词组合。 这个过程应该是完全随机的。 +你**不**应该重新生成单词，来得到一个吸引你的单词组合。 这个过程应该是完全随机的。 + +
如果你没有或者不愿意使用真正的骰子，你可以使用你的密码管理器的内置密码生成器，因为除了常规密码之外，大多数密码管理器都有生成骰子密码的选项。 我们建议使用 [EFF的大型词表](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) ，以生成你的二维码密码，因为它提供了与原始列表完全相同的安全性，同时包含更容易记忆的单词。 There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English. -??? 注："解释熵和二维码密码的强度" +
+Explanation of entropy and strength of diceware passphrases - 为了演示diceware密码短语有多强，我们将使用前面提到的七个单词密码短语`'viewable fastness，squishy seventeen showed pencil'`和[EFF的大单词列表]（https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)为例。 - - 确定双关口令强度的一个指标是它的熵值有多少。 双关口令中每个字的熵计算为$\text{log}_2(\text{WordsInList})$，口令的整体熵计算为$\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$。 - - 因此，上述列表中的每个词都会产生~12.9比特的熵($\text{log}_2(7776)$)，而由它衍生出的七个词的口令有~90.47比特的熵($\text{log}_2(7776^7)$)。 - - [EFF的大词表](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)包含7776个独特的词。 要计算可能的口令数量，我们所要做的就是$\text{WordsInList}^\text{WordsInPhrase}$，或者在我们的例子中，$7776^7$。 - - 让我们换一个角度来看：使用[EFF 's large wordlist] （ https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt ）的七个单词密码是~ 1,719,070,799,748,422,500,000,000,000个可能的密码之一。 - - 平均而言，需要尝试所有可能的组合中的50%来猜测你的短语。 考虑到这一点，即使你的对手每秒能够猜出1,000,000,000,000次，他们仍然需要27,255,689年才能猜出你的口令。 即使以下情况属实，情况也是如此: +To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example. - - 你的对手知道你使用了diceware方法。 - - 你的对手知道你使用的具体词表。 - - 你的对手知道你的口令包含多少个字。 +确定双关口令强度的一个指标是它的熵值有多少。 双关口令中每个字的熵计算为$\text{log}_2(\text{WordsInList})$，口令的整体熵计算为$\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$。 + +因此，上述列表中的每个词都会产生~12.9比特的熵($\text{log}_2(7776)$)，而由它衍生出的七个词的口令有~90.47比特的熵($\text{log}_2(7776^7)$)。 + +The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. 要计算可能的口令数量，我们所要做的就是$\text{WordsInList}^\text{WordsInPhrase}$，或者在我们的例子中，$7776^7$。 + +Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases. + +平均而言，需要尝试所有可能的组合中的50%来猜测你的短语。 考虑到这一点，即使你的对手每秒能够猜出1,000,000,000,000次，他们仍然需要27,255,689年才能猜出你的口令。 即使以下情况属实，情况也是如此: + +- 你的对手知道你使用了diceware方法。 +- 你的对手知道你使用的具体词表。 +- 你的对手知道你的口令包含多少个字。 + +
总而言之，当你需要一些既容易记住 *，又特别强大的* ，Diceware密码是你最好的选择。 @@ -98,13 +110,16 @@ Diceware是一种创建密码的方法，这种密码容易记忆，但很难猜 [推荐的密码管理器列表](../passwords.md ""){.md-button} -!!! 警告 "不要把你的密码和TOTP令牌放在同一个密码管理器中" +
+

Don't place your passwords and TOTP tokens inside the same password manager

- 如果您将TOTP用作任何帐户的 [多因素身份验证](../multi-factor-authentication.md) 方法，请勿在密码管理器中存储这些令牌、它们的任何备份代码或TOTP秘密本身，那样会抵消掉多因认证的益处。 - - 你应该使用专门的[TOTP应用程序]（.../multi-factor-authentication.md/#authenticator-apps）来代替。 - - 此外，我们不建议在您的密码管理器中存储用于一次性恢复的代码。 它们应当单独存储在，例如离线存储设备上的加密容器中。 +如果您将TOTP用作任何帐户的 [多因素身份验证](../multi-factor-authentication.md) 方法，请勿在密码管理器中存储这些令牌、它们的任何备份代码或TOTP秘密本身，那样会抵消掉多因认证的益处。 + +你应该使用专门的[TOTP应用程序]（.../multi-factor-authentication.md/#authenticator-apps）来代替。 + +此外，我们不建议在您的密码管理器中存储用于一次性恢复的代码。 它们应当单独存储在，例如离线存储设备上的加密容器中。 + +
### 备份 diff --git a/i18n/zh/basics/vpn-overview.md b/i18n/zh/basics/vpn-overview.md index 04c23c88..934c83e5 100644 --- a/i18n/zh/basics/vpn-overview.md +++ b/i18n/zh/basics/vpn-overview.md @@ -1,7 +1,7 @@ --- meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides" -title: VPN概述 -icon: 资料/vpn +title: VPN Overview +icon: material/vpn description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind. --- @@ -11,9 +11,12 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. -!!! note +
+

Note

- When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. + +
## How does a VPN work? diff --git a/i18n/zh/os/android-overview.md b/i18n/zh/os/android-overview.md index 8deeff44..a57bcd25 100644 --- a/i18n/zh/os/android-overview.md +++ b/i18n/zh/os/android-overview.md @@ -1,5 +1,5 @@ --- -title: Android概述 +title: Android Overview icon: simple/android description: Android is an open-source operating system with strong security protections, which makes it our top choice for phones. --- @@ -99,13 +99,19 @@ An app may request a permission for a specific feature it has. For example, any [Exodus](https://exodus-privacy.eu.org/) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal. -!!! 推荐 +
+

警告

- If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. +If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest/) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely. -!!! note +
- Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. +
+

Note

+ +Privacy-friendly apps such as [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest/) may show some trackers such as [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49/). This library includes [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) which can provide [push notifications](https://en.wikipedia.org/wiki/Push_technology) in apps. This [is the case](https://fosstodon.org/@bitwarden/109636825700482007) with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics. + +
## Privacy Features diff --git a/i18n/zh/os/ios-overview.md b/i18n/zh/os/ios-overview.md index f32a051e..16d96862 100644 --- a/i18n/zh/os/ios-overview.md +++ b/i18n/zh/os/ios-overview.md @@ -146,9 +146,12 @@ After enabling stolen data protection, [certain actions](https://support.apple.c iPhones are already resistant to brute-force attacks by making you wait long periods of time after multiple failed attempts; however, there have historically been exploits to get around this. To be extra safe, you can set your phone to wipe itself after 10 failed passcode attempts. -!!! 推荐 +
+

警告

- With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. +With this setting enabled, someone could intentionally wipe your phone by entering the wrong password many times. Make sure you have proper backups and only enable this setting if you feel comfortable with it. + +
- [x] Turn on **Erase Data** diff --git a/i18n/zh/os/macos-overview.md b/i18n/zh/os/macos-overview.md index eb66bf35..ad79023c 100644 --- a/i18n/zh/os/macos-overview.md +++ b/i18n/zh/os/macos-overview.md @@ -156,9 +156,12 @@ macOS employs defense in depth by relying on multiple layers of software and har ### Software Security -!!! 推荐 +
+

警告

- macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. +macOS allows you to install beta updates. These are unstable and may come with extra telemetry since they're for testing purposes. Because of this, we recommend you avoid beta software in general. + +
#### Signed System Volume @@ -178,9 +181,12 @@ System Integrity Protection makes critical file locations read-only to protect a macOS apps downloaded from the App Store are required to be sandboxed usng the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox). -!!! 推荐 +
+

警告

- Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. +Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible. + +
##### Antivirus diff --git a/i18n/zh/os/qubes-overview.md b/i18n/zh/os/qubes-overview.md index f4a50667..f1eb74e6 100644 --- a/i18n/zh/os/qubes-overview.md +++ b/i18n/zh/os/qubes-overview.md @@ -10,9 +10,12 @@ description: Qubes is an operating system built around isolating apps within *qu Qubes使用 [分区](https://www.qubes-os.org/intro/) ，以保持系统的安全性。 Qubes是由模板创建的，默认的是Fedora、Debian和 [Whonix](../desktop.md#whonix)。 Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*. -??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"." +
+The term qubes is gradually being updated to avoid referring to them as "virtual machines". - Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. +Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs. + +
![Qubes架构](../assets/img/qubes/qubes-trust-level-architecture.png)
Qubes架构，信用：什么是Qubes操作系统介绍
@@ -41,9 +44,12 @@ Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for contr To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. 不同的是， **Move** 选项将删除原始文件。 Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. 这一点在跨区拷贝系统中是不需要的。 -??? "Qubes do not have their own filesystems." +
+Qubes do not have their own filesystems. - You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. 当这样做的时候，改变并不是立即进行的，而且在发生事故的情况下可以很容易地撤消。 When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. +You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. 当这样做的时候，改变并不是立即进行的，而且在发生事故的情况下可以很容易地撤消。 When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral. + +
### 虚拟机之间的相互作用 diff --git a/i18n/zh/vpn.md b/i18n/zh/vpn.md index d99a81de..d10fffa0 100644 --- a/i18n/zh/vpn.md +++ b/i18n/zh/vpn.md @@ -1,7 +1,7 @@ --- meta_title: "Private VPN Service Recommendations and Comparison, No Sponsors or Ads - Privacy Guides" title: "VPN Services" -icon: 资料/vpn +icon: material/vpn description: These are the best VPN services for protecting your privacy and security online. Find a provider here that isn’t out to spy on you. cover: vpn.webp ---