A Fedora checklist of tips to protect your digital security and privacy

Hello everybody, I am posting this topic today. Because I haven’t found an article which discusses Fedoras digital security and privacy like a checklist of tips to help guide the reader.Furthermore, I do apologize if there is such a article , maybe I just haven’t found it. I do hope this article will inspire members to contribute to the idea.
A few examples and useful guides :

https://labs.fedoraproject.org/en/security/

1 Like

Never trust a usb-stick somebody gave you as a present.

4 Likes

Never download & install something just because it looks glitzy.
Never trust any software from a source you are not 100% certain is safe.

3 Likes

Overview - rpms/usbguard - src.fedoraproject.org

https://www.privacytools.io

Consider protonmail, vpn and drive. (free versions exist) https://protonmail.com/

1 Like

even if it is brand new with tamper proof sealed packaging?

I know of an industrial spy, he always presents brand new usb-sticks to people with hidden spyware in it. He told me why and how. Nobody can resist a found or received usb-stick.

1 Like

with all due respect, you are evading my question so i ask again :

kindly enlighten me.

that is in your specific experience.

first you say present & now you try to defend yourself by adding found & received.

a statement like this :

is basically fear mongering & creating paranoia by promoting general mistrust.

Always read the Terms of Services and Privacy Policy for all services, even when those are focused on privacy. From Proton Mail’s Privacy Policy:

We will only disclose the limited user data we possess if we are instructed to do so by a fully binding request coming from the competent Swiss authorities (legal obligation). While we may comply with electronically delivered notices (see exceptions below), the disclosed data can only be used in court after we have received an original copy of the court order by registered post or in person, and provide a formal response.

1 Like

Yes, this internet safety person and industrial spy offered usb-sticks in closed packages. He is from a big organization and there it is easy to repack a usb-stick.

1 Like

And because the email and content of calendars etc is encrypted Protonmail cannot deliver that to court. They can only, if under lawfull orders, a limited user data.

bollocks.

are you saying that there is a big organization that is doling out malicious flash drives?

by posting the above you made a general statement.

what you are implying is that everyone who gifts a flash drive is crooked?

what is even more surprising to me is that your highly irresponsible post got 4 likes from some respected members of this community / forum.

makes me wonder does fedora endorse this?

should people stop accepting flash drives as gifts / presents?

This is diverging and bordering on a personal attack. Both of you please simmer down and get back to discussing fedora instead of personal matters.

Just so you know, @32and64 , I personally have been given a flash drive that, had I connected it to a windows machine, could have been very bad news. Caution when receiving a flash drive is definitely warranted.

The risk when purchasing it from a reputed source is very low. Risk when receiving from other sources warrants caution.

5 Likes

Some interesting links on threat modeling and OSINT so everybody can get familiar with the idea and create their own personal threat model.

https://grugq.github.io/resources/

I think this is verging pretty far off topic. Ask Fedora really works best when we have a specific question to answer or problem to solve. Broad “List” topics risk ending up just being a bunch of random suggestions — and, as we can see, sometimes bring out strong opinions in different directions.

I think this might make a viable conversion over on Fedora Discussion, but it’d be good to first be clear on what the goal is — perhaps forming such a document would be a good Fedora Security Team project, for example.

Or maybe it’s a Fedora Magazine article.

I don’t think we’re providing a lot of value by having a big discussion of privacy and security issues that affect computers in general, though. Like reading terms and services of websites — that’s probably better for some general non-Fedora-specific website.

4 Likes

It’s also worth saying that “open source intelligence” or “OSINT” in the jargon has nothing to do with open source software or security. I fact, it’s a much older term used in the “intelligence” (you know, spy stuff) world to just mean gathering information from public (“open”) sources like the media (and now the internet) or public government data, rather than covert sources.

When there was an effort in the late 1990s to popularize the term “open source” as an alternative or addition to “free software” (as “free” is a rather ambigous word in English), surely many people were aware of this earlier use, but I suppose it seemed like enough of a narrow area of jargon that there wasn’t really a problem of confusion — which I think is true for the most part, but… occasionally not. :slight_smile:

It might be possible to create a quick doc with some of the basics things listed here that are common good security practices.