Editing Visitors (section)

=====Attempt at a Semi Decent Guide=====

The most secure option you have is to set up [https://inside.mines.edu/~gmurray/HowTo/sshNotes.html an SSH tunnel] to a remote server, and then use a proxy server like [http://www.pps.jussieu.fr/~jch/software/polipo/ Polipo] to forward all your HTTP through that server.  Done properly, this will encrypt all your traffic without any further worries.  If you do not have SSH access to a remote server, then you can use Tor or similar to encrypt your traffic without exposing it to the Noisebridge network.


The fallback position is to ensure that as many services as possible use HTTPS by default (especially webmail) and at least have browser based solution to protect against [http://en.wikipedia.org/wiki/Cross-site_request_forgery CRSF]/[http://en.wikipedia.org/wiki/Cross-site_scripting XSS] attacks for everything else.  This may happen even if the website itself is solid -- if you're on a compromised internal network, the attacker can inject content into any HTML page that you're reading.

Recommended Firefox Addons:

* Certificate Patrol: https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/
* Perspectives: https://www.networknotary.org/firefox.html
* HTTPS Everywhere: https://www.eff.org/https-everywhere
* Noscript (even with "all access" it still catches many CSRF/XSS attacks): https://addons.mozilla.org/en-US/firefox/addon/noscript/
* UBlock Origin (this one does block adds if that is a concern): https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
* DuckDuckGo Privacy Essentials: https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-for-firefox/
* Privacy Possum: https://addons.mozilla.org/en-US/firefox/addon/privacy-possum/

Recommended Chrome Extensions:

* KB SSL Enforcer: https://chrome.google.com/extensions/detail/flcpelgcagfhfoegekianiofphddckof
* NotScripts: https://chrome.google.com/extensions/detail/odjhifogjcknibkahlpidmdajjpkkcfn
* UBlock Origin (this one does block adds if that is a concern): https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
* DuckDuckGo Privacy Essentials:
* Privacy Possum: https://chrome.google.com/webstore/detail/privacy-possum/ommfjecdpepadiafbnidoiggfpbnkfbj

Recommended General Security:

* If you use Google, [http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html two factor authentication] is vastly more secure than just a password.
* Although coming up with a good password is nice, you're far more secure if you use a password manager like LastPass, KeyPass or 1Password.  The best password is one you don't remember.
* Using more secure search engines that don't track you (DuckDuckGo is a great option) you won't have google tracking you everywhere you go.
* If someone gets their hands on the physical machine, all bets are off.  Try to avoid strange USB sticks and CDs, even if they look shiny. Also, encrypting your drive protects you from these attacks pretty well(as long as you don't leave your machine laying around unencrypted, see links below)

Further Reading:
https://www.freecodecamp.org/news/tor-signal-and-beyond-a-law-abiding-citizens-guide-to-privacy-1a593f2104c3/
https://www.makeuseof.com/tag/avoiding-internet-surveillance-complete-guide/

{{ManualPage}}