Samizdata

[A slightly unusual topic for this blog, but I was assured by the powers that be that it was of interest.]

For my friends who don’t know much about computers:

I do computer security work professionally. People always ask in the wake of yet another internet attack “what should I do to protect myself.”

The advice is always the same. Do what computer professionals do. Don’t do what you imagine computer professionals do, because you’re probably wrong.

1. Always run the latest version of the OS and software.
2. When security updates appear for your operating system or software, apply them as soon as possible, meaning that day. Configure your system to automatically apply updates if possible.
3. Back up your computer frequently. Since normal humans cannot remember to do that, get software and/or a service to do it for you.
4. Don’t use the same password with two different services, period. Since you cannot remember hundreds of different passwords, use a password safe, and remember only the password for it.
5. If a web site offers two factor authentication (that is, you can set it up so it both requires a password and a code your phone generates), turn that on.

Every professional security person does those things.

If you ignore my advice, you’re going to get screwed one day, period. You might still get screwed even if you do follow my advice because the world is dangerous, but I can guarantee you’ll get screwed if you don’t.

Every organization that got infected recently by the ransomware worm was ignoring (1) and (2). Their suffering was avoidable. Do you want to suffer like them? Those that forgot (3) are really suffering because they have no way to recover. Why do you want to suffer? Every day, people get badly, badly screwed because the password that they use everywhere gets stolen and it is de facto impossible to remember every place you use it. Why set yourself up to suffer?

As to the question “who would attack me? No one is going to attack my computer, I’m unimportant”, the answer is that it isn’t individuals doing the attacks, it’s machines that are programmed to try to attack other machines by the hundreds of millions. You’re not being personally targeted, but that hardly matters when everyone on earth is being attacked. Your obscurity will not protect you. Even if you think there is nothing for the attacker to gain by taking over your machine, they’ll want it anyway, so they can set up a botnet to send spam from it, or use it to bring down other people’s web sites, or to take over yet more people’s machines.

And some corollaries:

1a. If your machine is too obsolete to run the latest OS, replace it. Quit being the jerk who won’t replace their eight or twelve year old computer and complains that the manufacturer “owes” you updates as you shake your fist at heaven. It isn’t even possible for them to support everything they ever made forever, let alone sane. Stop being that person.

1b. When Microsoft kept offering to give you Windows 10 for free, and you got angry at them for offering to give you a much more secure system FOR FREE, and when you got onto Facebook to post “stop bothering me, Microsoft, I don’t want to get a free, much more secure update to my buggy older OS”, you were the one who was being annoying and stupid, not Microsoft.

2a. When you get upset that the phone or computer that asked you to update is asking you to update, and you refuse to update because you find it “irritating”, what you’re basically saying is “I find it irritating that the manufacturer is trying to protect me from getting my machine taken over and all my work destroyed. I’ll show them, I’ll refuse so that some asshole in Kazakhstan can steal the contents of my bank account. That will teach Microsoft a thing or two!” Quit being an idiot. If someone pulled you out of the way of an oncoming car you wouldn’t get angry with them for it, so don’t get angry with the vendor for doing the equivalent for you.

3a. Backing up your computer can be done automatically. It isn’t even painful to get going. If you find this irritating to set up, imagine how irritating it will be to have none of your data after you have lost everything.

4a. No, your really clever password is not actually unguessable to a machine that can check tens of millions of passwords a second.

And finally, every once in a while, I hear from someone, generally an older person, that they’re just unable to keep up with new software and the like. “The new version looks different. I don’t want to update because the buttons might be in different places.” My advice, my sincere advice, is that if you can’t keep up with small changes like that, or if you can’t figure out how to use two factor authentication for your bank account and the like, get rid of your computer. It’s not safe for you to use one. Really. People still can live good lives without them. You can get the news by newspaper, you can talk to your grandchildren on the telephone. Not being able to keep up with this stuff is kind of like not being able to safely drive a car. If you’ve got a problem with your eyesight and can’t drive safely, the answer isn’t that you keep driving and kill people on the road, the answer is you stop driving.