couch
[Music]
hi everybody I'm Yael I'm super excited
to be here this is a really great crowd
I know there's a lot of talks right now
so thanks for coming to this one this is
meet security planner or how to help
your non-technical friends and family
stay safer online
and before we get started a little bit
about myself my name is Yael grower I
work at Consumer Reports on the security
planner but my background is actually in
investigative Tech reporting and that's
where a lot of the work I do kind of
comes from so I've done a lot of
investigative reporting on companies
that say they are very private and
secure that maybe aren't
maybe their marketing is a little bit
hyperbolic maybe they say they haven't
ended encryption when they actually
don't that kind of thing and I learned a
lot about surveillance
and one of the things I think about a
lot is how in an ideal world I wouldn't
have to be here or be doing this work
because products would be secure by
Design and everything would be every any
kind of data collection would be opt in
and ux would be really really great and
you would understand what you were doing
instead of it being confusing and opaque
but because that is not the case we have
tools like security planner
I consider myself a responsible adult
you know I get my annual checkups
um I just got my windshield wipers
replaced because they were fraying we
even had our air ducts clean uh yeah I'm
one of those people who like you know I
give my dog her heartworm medicine every
month etc etc and like most responsible
adults I misplaced my wallet
and a night on the town I'm sure some of
you have done this and the really
annoying thing about it was that we were
at like seven different places that
night which is something you're not
supposed to admit on stage but it could
have been at the bar or the other bar or
the Uber we took to get to the pancake
place and then it was closed so we took
another Uber like it could have been in
like seven different places I didn't pay
for all these cars I don't know if my
friends who I was with are the type of
people to contact all these Uber drivers
for me did you find a wallet
um and so yeah that really sucked but I
got it back
um and there was also Paparazzi that
caught a picture of it for me but they
didn't tell me I had dropped it but I
got it back the next day and as soon as
I got it back I took out all my credit
cards opened up my password manager and
I wrote all the numbers that I should
call if I had to show them and I started
taking all these other precautions too
foreign
because I make sure my bags have zippers
so that I don't accidentally drop or
misplace things and of course none of
these things would have helped me had I
actually lost my wallet because I didn't
do them until after the fact and so
somebody would have told me like don't
you know you're supposed to write down
all these numbers in case you lose this
I would have been really mad and
probably muted them on Signal
but we see this happening all the time
in physical security people don't get
their locks fixed until after the house
gets broken into and we see it also in
digital security where people don't
realize they need a password manager
until after you know their password is
compromised and they realize they have
the same password for all of their
accounts and no MFA set up
um and so that's kind of where what
we're working with is that people have
something kind of similar to technical
debt even though they probably don't
know what that is
um
and so we have a tool called security
planner so if you go to
securityplanner.org there's like a three
questions that you will answer and it
will spit out a security plan for you so
it's sort of like a Choose Your Own
Adventure book but with more homework
um and
um we'll be talking a little bit about
how we decide what kind of advice to
give people but it's customized and
prioritized for those individuals
so I don't know about you but I've been
having really bad luck with Google
lately and all search engines they just
don't get me what I want anymore like I
feel like they've gotten worse over over
a year does anybody agree
um so I'll type something in even when I
know the exact name of it and like what
comes out is not what I was looking for
it's very annoying and so it's really
hard to tell people like oh you don't
know how to do something just Google it
because they might not get what they
need which is um really annoying
um so yeah we have this three-part
customized Choose Your Own Adventure
um so when you go to securityplanner.org
the first thing that it'll ask you is
what are you on what tools are you using
this is another thing that annoys me
about Google I'll look something up for
Android and I will get advice for iPhone
it's so annoying
um and if you are I don't know it's just
like if you I wanted to know how to not
get my bike stolen and I found tips for
securing your car look that would be
really annoying
um and then if you have a baby monitor
and you want to make sure it's safe then
you really want to make sure it's safe
but if you don't have one you don't need
to scroll through all of that advice
so we asked people what devices they use
the next thing we ask people is what is
it that you actually want to do
and I think this is really important
because when people think about cyber
security people think about completely
different things like a lot of people
will be like oh this is about keeping
all my information private from
different companies I don't want them to
sell me ads and other people will be
like oh no cyber security is all about
ransomware and viruses and Etc and then
one thing that doesn't get talked about
as much when you talk about cyber
security is um like dealing with
harassment and stalking and that's what
I think about like that's one of the
first things that I think about when I
think about cyber security is how do you
um help people who are dealing with
harassment and stalking and so we ask
people what it is that they're trying to
do so that the advice again is tailored
to them and their situation
um and then we ask them if any of these
statements are true do you
are you a victim of identity theft
um do you have additional risk because
of who you are or what you do are you
dealing with an urgent digital security
threat right now and a few other things
and some of that is because we might not
be the best solution for everybody like
if you are trying to if you're a digital
filmmaker looking to secure your
information and your sources during that
project then you probably need a
personal personalized guide and there
are some out there just for digital um
Just For documentary filmmakers
uh and so that's one of the things that
we do we also have an emergency
um emergency resources page because if
you're actually having an emergency you
don't need to be filling out a quiz you
need to be on a phone or in a chat with
somebody that can actually help you
individually based on what it is that
you are trying to do and so we try to
kind of Outsource to other places that
are more equipped to help those
individuals depending on what their
threat is
and I'm going to pause again and point
out that this shouldn't exist like we
shouldn't have to have so many people
that are dealing with these issues that
are largely presentable not by them
necessarily
um we shouldn't have to have a emergency
resource for digital threats hotline but
that's kind of where we're at so and I
always try to keep the big picture in
mind like how can we reduce this
systemically what can we be doing as a
community what can we be repressuring
companies to do in order to prevent
these issues how should tools be built
differently
um
so yes you've filled out your Choose
Your Own Adventure you've gotten an
action plan this is kind of what it
looks like this person has 29 tips
luckily you can you don't have to do
them all at once you can go back and do
them one at a time
um and check them off and we'll try to
prioritize it based on risk so we're
always kind of tweaking the algorithm
for that
um I love a lot of digital security
guides I send people to eff surveillance
self-defense a lot there's one called
zebra Crossing that I really like but
unfortunately those are great they're
kept up to date unfortunately the
internet is sort of a graveyard for
abandoned and outdated security guides
and if somebody gets a security guide
and the first step is giving them
information that doesn't actually work
for them because they have an up-to-date
OS they're probably going to stop
working on it completely so we try to
keep security planner up to date we have
time stamps now which is really cool
um
and as far as the actual steps
themselves in some cases we just have a
few steps there's one there's one action
that only has one step but sometimes we
have a ton of steps our longest one is
11 steps and that one is about stalker
wear because people think that there are
security issues that they have stalker
wear on their phone but a lot of times
they're sharing information with
somebody who's telling it to their
abuser so we have to go over that with
them sometimes they're sharing accounts
with that person and they haven't logged
out of those accounts or changed those
passwords
sometimes they do have stalkerware and
they have to use a antivirus software
actually um you have a girlfriend at eff
almost single-handedly got antivirus
companies to start scanning for this
dockerware so that's actually really
cool
um and sometimes it's uh like there's
actually an air tag or another device
that they have to physically search for
because it might be it's somewhere that
travels with you so it's either going to
be
on your on your person in your vehicle
in your bag so we tell people how to
look for those and how to scan for them
with their phones because that the
scanning for it works better or less
depending on what kind of phone you have
and what kind of tracker it is
unfortunately so there are a lot of
steps there we also tell people like
maybe you want to talk to somebody
because
I think in cyber security people always
think oh there's something bad on your
device you need to remove it but in a
like taking a trauma-informed approach
sometimes that's not the best situation
because it could escalate things and the
best person to understand that is the
person who is being targeted but
sometimes it can be really helpful to go
over different ideas and and bounce them
off so we give resources for that so
yeah that's our our long one
um we normally when I write articles the
it's kind of like um a persuasive
argument where you're like here's why
this is important and here are the steps
to take but with security planner it's
the opposite we tell people what to do
and then if they're still not convinced
and they scroll down to the bottom we
explain like this is why you should care
and why it's important
um
and sometimes we have additional
resources for people like maybe some of
you who want to nerd out on this and
figure out what what else do I need to
know what are the details how did you
maybe come to these decisions
and so we have internal resources
sometimes we have external resources
we're actually doing a Content audit and
removing all the outdated ones right now
so that's one of the other things you
can get on that site
so how do you actually use this to help
your friends and family
um I imagine that
you would rather help people in a way
that's really specific to their
situation so our goal is that if people
go through a security planner when they
come to you with questions afterwards
those are really specific questions that
are more interesting for you to answer
um and
um are more specific and the other cool
thing is that we are a non-profit we're
really open to suggestions so something
doesn't apply to that person or you
think it could be written differently
we're always looking for that kind of
feedback and we even have a sort of
informal Advisory Group which is like a
very low traffic listserve on groups.io
that I'm going to Tweet out and toot out
the link if anybody wants to join that
and you kind of want to volunteer to do
that to not just help your friend but
everybody else who uses this tool and
it's pretty easy to get on you just have
to fill out a few questions and agreed
our code of condo
um
there's a couple other things we do
Under the security planner umbrella and
one of them is testing so I take
advantage of the fact that Consumer
Reports has a fantastic lab and testing
team and so when I first started I was
like we should look at vpns because I
had done some work on vpns
um and I think they were everybody was
kind of tired of big fans by the end of
the project because we did a ton of
tests that culminated in a 48-page white
paper
breaking down the differences between
them and then we wrote three articles
one was about helping people decide
whether they even need to use a VPN at
all because a lot of people use it
because they don't actually know what it
does
and so they either think they're getting
a level of protection they're not
actually getting we're getting
protection that they already have things
like https and so we help people with
that we wrote One article that was about
all the issues we found which was you
know poor privacy and security practices
and hyperbolic Clan that kind of had the
potential of misleading
um readers or listeners actually because
people hear about them on on podcasts
from people who have affiliate
relationships with them so those aren't
always 100 accurate believe it or not
um and then we also told people like oh
if you just want recommendations these
are the ones that did well in our
privacy and security testing uh and I
really like that project because it had
a white paper for people to nerd out on
it had articles for people who just
wanted kind of the overview and then we
fed the recommendations back into
security planner
um one thing that happens though that
really annoys me is when we can't give
people recommendations because there are
no there's nothing they can do to
improve something because it's a
systemic industry-wide issue
um and that I started thinking about
memory safety a lot when I was freaking
out about whether or not I had Pegasus
on my phone uh because Pegasus happened
and I do a little bit of a kind of high
risk freelance reporting and luckily I'm
really well connected and I have friends
who before amnesty came out with a tool
and I verify came up with a scanning
tool we're able to tell me what to write
in command line to figure out if I had
it on my phone but I know not everybody
has that and not everybody would even
take advantage of it if they had that
available to them and so my manager and
I were kind of brainstorming and I'm
like what can we do like this is bad we
can't give people recommendations and we
can't even test tools because so like
almost everything is memory and safe
these days and so what we did was we got
all the smartest people working on
memory safety that we knew of that we
could convince to get into a virtual
room and we had a convening about memory
safety and then we summarized it in uh
in a report which was really fun
um trying to kind of because a lot of
people had different opinions and so
trying to capture all of that was pretty
interesting and now we're in the process
of figuring out what the next step is to
improve this landscape for everybody and
try to hold companies accountable
um and uh I feel like the best way we
learn for security planner is people who
have really strong opinions and
constructive criticism telling us what
to redo in fact we got that from pen
America because they rightly pointed out
that our pages on
um harassment and domestic abuse for
telling people to call the police
without giving them the Nuance about
when that may or may not be a good idea
for them and they gave us a resource we
could link to so we did that so I love
um
I love it when people tell me you're
doing this all wrong and here's how you
can do it better because we can it
doesn't happen instantaneously because
security planner is translated into
English and Spanish and I don't speak
fluent Spanish so I can't just go in and
fix things because I want to make sure
everybody has the same experience I
don't want there to be like an
up-to-date English version and an
out-of-date Spanish version so it's not
instantaneous but we try to move pretty
quickly
and I wanted to leave a lot of time for
questions because I'm always looking for
ideas on what can we do to improve it
what are people doing wrong what is the
media doing wrong how do we make this
more open and accessible and I'm also on
Mastodon and email so here's my contact
information and if you have any
questions
uh
let me know I see a question I see
okay
um we have a couple of things in
um okay so the question was for older
people who want uh information is
emergency resources what was it only
uh-huh
yeah um the emergency resources section
is it is we don't have like an 800 line
for security questions unfortunately uh
emergency resources does link to
hotlines like there's a crisis text line
um there's like a games and harassment
hotline which I think is over text
um and um we have we link to access
now's digital security helpline which I
think is over email actually
um yeah no that would be great if we did
that we did we had we did do team up
with um another organization
um the uh a cyber crime support network
I think they're called I hope I'm not
getting that wrong on video uh but it
was like you're towards older adults and
it was um we did it was like four pair
down pages of security planner and they
and people would go around and secure
their family members or friends or
whatever of any age actually because
there's a lot of people that don't
understand Tech who are younger and a
lot of tech savvy adults um but yeah we
uh and then we also have some webinars
which are geared for really 101 audience
and it's on just basic like how to use
multi-factor authentication
um password you know stuff like that but
yeah no we don't have I don't think
there's like a generic hotline for Tech
problems so that would be cool I wonder
if we could do office hours that's
actually a really good suggestion
so I've also thought about like I feel
like some of the webinars move too fast
for some of the people that we've had
um like who maybe would be confused if
you talked about MFA and mention you
know apps and you have a keys in one
webinar and so we've been kind of
brainstorming I'm like what if we did a
video
like an animated video that people could
re-watch on their own and like follow
along with so we're always looking for
other ideas for how to reach those
people
uh-huh okay so the question was about
um the phone companies and people who
use MFA when the phone companies are
inherently insecure I think I got that
it's kind of hard to hear but
um I we uh we we kind of shy away from
SMS based MFA like as a start and we've
done I wrote an article actually on why
you should use apps and a lot of people
on our list actually were like you
should only recommend you've accused but
a lot of places don't take Uber keys and
a lot of them don't even have apps some
of them only have like SMS and email
based MFA
um so I think like for first step we do
tell people like can you move this to an
app um but I don't think the issue is
always a lot of people the Sim swapping
is an issue but I think the bigger issue
that we've heard from kind of normal
everyday users is that their phone got
cut off or they lost their phone or they
broke up with their partner who they
were on their phone plan or or their
family's phone plan or or switch jobs or
whatever and they no longer have access
to their phone so they can't enter those
SMS codes because they don't have a
phone anymore which is a real that like
that I think that happens probably more
often than Sim swapping we do recommend
Yuba Keys also in security planner we
have it it not everybody gets the same
plan but like for people that are high
risk where like you should really get a
security key but
um you kind of need two security keys
and not everybody's gonna pay for it we
list a bunch of free options
um but as far as research I think it
would be great to do research on like
like where is Sim swapping or which of
these phone companies are more how do
they handle this differently because I
know that like probably Google fi my
guess is the best as far as like if
you're being personally targeted but
it's kind of a small minority that
people who use security planner who have
those issues but yeah that's an
interesting one
if anybody has questions and you have to
scream them because I can't hear of him
oh um are there how many so when you use
security planner it gives you a URL that
saves your plans so if you want to just
send them that
um URL then they'll be able to check
that that off on their own we also have
PDFs but they're not we're actually kind
of redoing How We Do PDFs because it's
not
it's it turns out that people I didn't
realize this until we went through user
testing and it was really interesting to
me but it turns out that people want
when they check off a PDF they want it
to be checked off on the non-pdf version
and I don't think most PDF readers let
you do that or if they do I haven't
figured it out like we haven't quite
worked that out so we kind of want to
redo how we do that so people can have
like a printed out plan and cross it off
which a lot of people like to do
um you can save your plan with a free
account but you don't have to to use it
but that's another way to do it and then
there's also a link that says all
recommendations if you just kind of want
to scroll through them so yeah so I
think that more or less answers your
question
yes
oh tips for telling if you need a VPN
um okay so I
are you already doing other things like
are you already using MFA a password
manager
um https only mode Etc like I think
that's the first thing that I ask people
and then the second is what do you want
a VPN for like what is it that you're
trying to do and I think about this a
lot because I went to Knoxville to hang
out with some friends and I met this
woman who was a professor she's really
really smart she had like three phds and
spoke all these languages and she was
using a VPN because she was worried that
her bank account would get hacked if she
wasn't on a VPN so in her model of the
world which I'm not saying is like I
think it's a logical model if you you
know watch people talk about vpns on
whatever twitch stream you watch and
listen to NPR and read all these
articles about the next big hack like in
her model of the world there was not
https and her bank information was
totally clear like plain text and I was
like no your bank's not gonna get hacked
so she wouldn't need a VPN
um I use a VPN when I do investigative
reporting because I get paranoid about
people tracking my IP address like if I
email them they'll know how much time I
spent on their site I don't know if they
actually would do that but they could do
that
um and then I use a VPN when I am at a
very tiny coffee shop where I know the
person individually who is running the
network because if I know them by name
they know me by name I don't necessarily
want them to um see what I'm doing so it
depends
um
it depends on what you're trying to do
but I think like for most people who
tell me they want to use it for a
general overall security and don't have
a specific threat like they probably
don't need one it's also really useful
for circumvention which I don't know a
lot about because Consumer Reports is
very like us and Canada focused but I
went to a VPN convening and everybody
there was doing circumvention work and I
actually was writing about vpns once and
I was in grad school and I couldn't log
into or I couldn't log into I couldn't
go to a website for a VPN so I went to
tour and I said tour is illegal in my
country
and I got in that way and I was able to
but you can also look tether to your
phone like if this is just like a short
um instance you can do that and then
there's like other reasons for using it
like um I got interviewed for a story
about whether you need a VPN when you
look at porn and one of the things that
didn't make it in the story but that I
thought was a really good use case that
somebody brought up to me afterwards is
I don't want my housemates to get
targeted ads for things that I am
looking at and so like that's a little
bit I don't know there's kind of some
weird use cases like that and then of
course a lot of people use it to try to
get Netflix or whatever in other
countries and in my experience that
hasn't worked consistently like when I
get it to work it stops working the next
day so I don't recommend it well of
course we wouldn't recommend anything
illegal in consumer reports but but also
as far as like whether it works or not I
don't think it consistently does but if
it does let me know I'm curious
hmm did that that more or less answer
your okay cool
I've always wanted to say I have time
for one more question because I heard a
comedian making fun of people who said
that once
it's just this random thing you can say
in conversation but I think we do
actually have time for one or two more
questions
or not thank you so much you guys this
is really fun
[Applause]
[Music]