Based on EFF's Surveillance Self-Defense & Security Education Companion
Security isn't just about tools—it's a mindset and practice we build together.
Why Your Audience Should Care and Act this is a good one for both teaching and learning perspective!
Develop practical security habits using the 7 steps to digital security
Understanding your threats is the foundation of security.
Personal devices are often the most vulnerable point in our security.
Your Phone: Constantly connected to cloud services, location tracking, sensor access (mic/camera), insecure backups
Your Computer: Clipboard hijacking, browser fingerprinting, unsecured Wi-Fi connections, malware risks
websites, default search providers, ad providers, microsoft, apple, etc - are all tracking you, farming your data - especially and unless you tell them not to/change your default setttings
A unified security suite simplifies protection for everyday use. It might even work a lil bit!
Our private communication platform for secure collaboration.
distorted.work or if that fails, matrix.distorted.workOpen source software, for example, is often free, well supported and vetted by a large community who have full access to the source code, and often more secure than expensive proprietary solutions.
Free services often come with hidden privacy costs
Computer security advice can end up sounding like you should trust absolutely no one but yourself. In the real world, you almost certainly trust plenty of people with at least some of your information, from your close family or partner to your doctor or lawyer. What's tricky in the digital space is understanding who you are trusting, and with what. You might give a list of passwords to your lawyers, but you should think about what power that might give them or how easily a bad actor could then access your passwords. You might save documents in a cloud service like Dropbox or Google that are only for you, but you're also letting Dropbox and Google access them too.
Maps: OsmAnd or Organic Maps (OpenStreetMap-based)
Photos: Encrypted storage (Proton Drive) or encrypted physical drive, usb drive, or sd card.
Physical Media: Encrypted USB/SD cards should use LUKS (Linux) or BitLocker (Windows) with strong passwords
Communications: Our Matrix server
Settings: Turn off location history, ad tracking, photo geotagging
Security is an ongoing practice, not a destination.
Make a security plan that works for you, and for the risks you face. A perfect security plan on paper won't work if it's too difficult to follow day-to-day.
Trying to protect all your data from everything all the time is impractical and exhausting. But, have no fear! Security is a process, and through thoughtful planning, you can put together a plan that's best for you. Security isn't just about the tools you use or the software you download. It begins with understanding the unique threats you face and how you can counter those threats. In computer security, a threat is a potential event that could undermine your efforts to defend your data. You can counter the threats you face by determining what you need to protect and from whom you need to protect it. This is the process of security planning, often referred to as "threat modeling ."
It is important to continually re-evaluate your security practices. Just because they were secure last year or last week doesn't mean they're still secure. Keep an eye on big security news when you can (most people don't need to overdo this: think "huge data breach of an important piece of software like a password manager " type of news that's so important that it reaches big tech-focused media outlets like Wired or The Verge, or even The New York Times or The Washington Post, not "this specific exploit targets a specific CPU"), and check sites like SSD, because we update our advice to reflect changes in our understanding and the realities of digital security. Remember: effective security is a continual process.
Putting knowledge into practice.
Server: distorted.work or matrix.distorted.work
Web client: element.distorted.work
Download/Install Client: Element, Element X (desktop/mobile)
I must share the authorization token with you before you will be allowed to register!
In encrypted chats, members must verify each other before being able to view messages.
Key Verification: Always verify encryption keys in-person or via secondary channels for sensitive communications
When prompted to set up recovery codes, do it - you will need them. Save in proton pass as a note or something.
We'll use this platform to coordinate future meetings, share resources, and provide support.
For high-risk scenarios, specialized tools provide enhanced protection.
Strengths: What aspects of your security plan work well?
Weaknesses: Where are you most vulnerable?
Opportunities: What tools or practices could improve your security?
Threats: What specific risks does your threat model include?