Protect your accounts using strong passwords, pw managers, 2fa

2022-11-20T22:46:49Z

Kristin:

<h1>Passwords</h1>

<p><strong>Passwords are your first line of defense</strong> against anyone who would like to hack into these accounts. They are what keep your information safe; they enable you to keep control of your data.</p>

<p>But preventing your accounts from being hacked requires passwords that are long, strong, complex, unique and practical; and you need to have a DIFFERENT long, strong, unique and practical password for each account.</p>

<h2>Why do we need strong passwords?</h2>

<p>The internet stores a lot of data about you. Your credit card information might be tied to your Apple ID or Android Device ID, as well as to your online shopping accounts. Personal photos, including of your family, children, and friends, might be stored on Facebook, on your phone and and on the servers of your cloud storage. Your email and messaging app accounts have all your conversations with partners, friends and family, as well as work-related discussions and other information.</p>

Your passwords need to be strong enough so you can keep control of your accounts. Once an account is hacked, an attacker can:
<ul>
<li>Access all the information in that account</li>
<li>Lock you out of that account</li>
<li>Impersonate you and communicate with, or send phishing emails to, your network</li>
<li>Try to use this account to gain access to other accounts or use it to try to gain access to your financial information</li>
</ul>

A good password is the only thing keeping this information from being accessed. In short, it gives you control over your data.

<p><strong>No need to change your strong passwords once they are in place.</strong> Changing passwords regularly was a common recommendation until a couple of years ago. This is outdated now because if you follow this list of best practices, there is absolutely no need to change your passwords regularly. The reason why changing passwords is no longer recommended is the following: Researchers have found that changing passwords regularly does more harm than good as it encourages people to choose weaker passwords. Better choose a strong and unique password once, instead of regularly changing a weak one to another weak one.</p>

<h2>Resources on creating strong passwords</h2>

<p><strong>[Online course] Totem's course about secure passwords</strong> (free) - Passwords are your first line of defence online, so it’s really important that these are long and unique. But how can you manage this for all your accounts? The course will guide you through setting up KeePassXC, a password manager that makes creating and storing passwords easier and safer. You’ll also look at Two-Factor Authentication (2FA), for added security. You should end the course with a solid password-management strategy that protects your accounts, without taking up too much of your time (or brain-power!).  This course is available in: [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_001+course/course/ English], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_ES+001/about Spanish], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_FR_001+cours/about French], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_AR+001/about Arabic], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_RU+001/about Russian], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_FA+001/about Farsi]</p>

<p><strong>[Guide] Creating strong passwords</strong>  [by Electronic Frontier Foundation] - This guide is designed for human rights defenders and is available in [https://ssd.eff.org/en/module/creating-strong-passwords English], [https://ssd.eff.org/es/module/creando-contrase%C3%B1as-seguras Spanish], [https://ssd.eff.org/fr/module/cr%C3%A9er-des-mots-de-passe-robustes French], [https://ssd.eff.org/ar/module/%D9%88%D8%B6%D8%B9-%D9%83%D9%84%D9%85%D8%A7%D8%AA-%D8%B3%D8%B1-%D9%82%D9%88%D9%8A%D8%A9 Arabic], [https://ssd.eff.org/ru/module/%D1%81%D0%BE%D0%B7%D0%B4%D0%B0%D0%BD%D0%B8%D0%B5-%D0%BD%D0%B0%D0%B4%D1%91%D0%B6%D0%BD%D1%8B%D1%85-%D0%BF%D0%B0%D1%80%D0%BE%D0%BB%D0%B5%D0%B9 Russian], and other languages. </p>

<h1>Password managers</h1>

<p> A password manager is a tool that creates and stores passwords for you, so you can use many different passwords on different sites and services without having to memorize them. You only need to remember one master password that allows you to access the encrypted password manager database of all your passwords.</p>

<p><strong>[Video] Animated Overview</strong>: [https://ssd.eff.org/en/module/animated-overview-using-password-managers-stay-safe-online Using Password Managers to Stay Safe Online] (by EFF) - available in many languages</p>

<h2>Password manager: Bitwarden</h2>

<p>[https://bitwarden.com/ Bitwarden] is a free and open-source password management service that stores sensitive information such as website credentials in an encrypted vault. The Bitwarden platform offers a variety of client applications including a web interface, desktop applications, browser extensions, mobile apps, and a command-line interface. It is a popular password manager option among human rights defenders.</p>

Bitwarden resources:
<ul>
<li>[Videos] [https://vimeo.com/showcase/8692945 Getting Started with Bitwarden](English) </li>
<li>[Guide] How to use Bitwarden to manage passwords on all devices, including phones. Free, open source software.</li>
<li>[Guide] [https://bitwarden.com/help/get-started-individual-user/ Get Started with Bitwarden] (English)</li>
<li>[Slide deck] [https://docs.google.com/presentation/d/e/2PACX-1vRj4oFJeS4hW6RnS3SPctCDAPeEe2XpAq4Iolr9LME3PDG2wKx-hpCNsqhjqz01UmFpTX8IVKObdvNM/embed?start=false&loop=false&delayms=3000&slide=id.gd279e4f08d_1_1062 Bitwarden for Beginners] (English)</li>
<li>[Guide] [https://www.pantallasamigas.net/guia-configuracion-programa-gestor-contrasenas-bitwarden-ciberseguridad/ Install and Configure Bitwarden]</li>
<li>[Video] [https://vimeo.com/539797097 How to send sensitive info (files or text) securely to anyone, using Bitwarden] (English)</li>
<li>[Video] [https://vimeo.com/579574710 How to set up Bitwarden for your internet browser] (English)</li>
<li>[Guide] [https://bitwarden.com/help/getting-started-mobile/ Getting started with Bitwarden mobile] (English)</li>
</ul>

<h2>Password manager: KeepassXC</h2>

<p>[https://keepassxc.org/ KeePassXC] is a free and open-source password manager. It started as a community fork of KeePassX. It is built using Qt5 libraries, making it a multi-platform application which can be run on Linux, Windows, and macOS.</p>

KeepassXC resources:
<ul>
<li>[Video] [https://www.youtube-nocookie.com/embed/Dm3Xeo0hIQk Manage your passwords using KeePassXC] (by Justice and Peace Netherlands, English)
</li>[Guide] How to use KeepassXC (by EFF) - available in [https://ssd.eff.org/en/module/how-use-keepassxc English], [https://ssd.eff.org/es/module/c%C3%B3mo-usar-keepassxc Spanish], [https://ssd.eff.org/fr/module/guide-pratique-utiliser-keepassxc French], [https://ssd.eff.org/ar/module/%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85-%D9%83%D9%8A-%D8%A8%D8%A7%D8%B3-%D8%A7%D9%83%D8%B3 Arabic], [https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-keepassxc Russian] and other languages.
</ul>

<h1>Two factor (or multi factor) authentication (2fa or mfa)</h1>

Resources on 2fa
<ul>
<li>[Video] [https://www.youtube-nocookie.com/embed/0mvCeNsTa1g What is two factor authentication?]</li>
<li>[Guide] How to enable 2fa (by EFF) - available in [https://ssd.eff.org/en/module/how-enable-two-factor-authentication English], [https://ssd.eff.org/es/module/c%C3%B3mo-habilitar-la-autenticaci%C3%B3n-de-dos-factores Spanish], [https://ssd.eff.org/fr/module/guide-pratique-activer-l%E2%80%99authentification-%C3%A0-deux-facteurs French], [https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D9%81%D8%B9%D9%8A%D9%84-%D8%A7%D9%84%D8%AA%D9%88%D8%AB%D9%8A%D9%82-%D8%A7%D9%84%D8%AB%D9%86%D8%A7%D8%A6%D9%8A-two-factor-authentication Arabic], [https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D9%81%D8%B9%D9%8A%D9%84-%D8%A7%D9%84%D8%AA%D9%88%D8%AB%D9%8A%D9%82-%D8%A7%D9%84%D8%AB%D9%86%D8%A7%D8%A6%D9%8A-two-factor-authentication Russian] and other languages. </li>
</ul>

<h1>Be aware of spear phishing attacks</h1>

<p>Phishing happens to everyone, but most people only become aware of it once they have become a victim of an attack. Protecting yourself from phishing attacks</strong> starts with identifying an email or message as an attack before you click on the link or download the file. But even if you are careful, a phishing attack can still sometimes be successful. Don’t panic. If you have clicked on a phishing link and given an attacker access to your data, you can still reduce the damage - to yourself as well as to your colleagues, friends, and family.</p>

Resources to learn about and avoid phishing and spear phishing attacks:
<ul>
<li>[Online course] Totem online course on Phishing Attacks - In this course you will learn about phishing attacks: what they are, what they are used for, how you can identify them, and what you can do if you have been phished. Available in [https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_001+course/about English], [https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_ES+001/about Spanish], [https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_FR001+cours/about French], [https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_RU+001/about Russian], [https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_AR+001/about Arabic], and [https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_FA+001/about Farsi].</li>
<li></li>

</ul>

<p><iframe src="https://player.vimeo.com/video/444354623?h=501ce0881b&title=0&byline=0&portrait=0" width="640" height="360" allowfullscreen="allowfullscreen" allow="autoplay; fullscreen; picture-in-picture"></iframe></p>
<p><a href="https://vimeo.com/444354623">Phishing Overview</a> from <a href="https://vimeo.com/user71914801">Renee McLaughlin</a> on <a href="https://vimeo.com">Vimeo</a>.</p>
<h3>Resources for avoiding a phishing attack</h3>
<p><strong>[Guide] <a class="inline_disabled" href="https://safecomputing.umich.edu/be-aware/phishing-and-suspicious-email/shortened-url-security#:~:text=There%20are%20a%20number%20of,tinyurl.com." target="_blank" rel="noopener">How to reveal full URLs</a><br /></strong></p>

<p><strong>[Guide] How to avoid a phishing attack</strong> (by Electronic Frontier Foundation) - This guide will help you to identify phishing attacks when you see them and outline some practical ways to help defend against them.</p>
<ul>
<li>English: <a href="https://ssd.eff.org/en/module/how-avoid-phishing-attacks" target="_blank" rel="noopener">https://ssd.eff.org/en/module/how-avoid-phishing-attacks</a></li>
<li>Spanish: <a href="https://ssd.eff.org/es/module/c%C3%B3mo-evitar-los-ataques-de-phishing-o-suplantaci%C3%B3n-de-identidad" target="_blank" rel="noopener">https://ssd.eff.org/es/module/c%C3%B3mo-evitar-los-ataques-de-phishing-o-suplantaci%C3%B3n-de-identidad</a></li>
<li>French: <a href="https://ssd.eff.org/fr/module/guide-pratique-%C3%A9viter-les-attaques-par-hame%C3%A7onnage" target="_blank" rel="noopener">https://ssd.eff.org/fr/module/guide-pratique-%C3%A9viter-les-attaques-par-hame%C3%A7onnage</a></li>
<li>Arabic: <a href="https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D8%AC%D9%86%D8%A8-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%AA%D8%B5%D9%8A%D8%AF-phishing" target="_blank" rel="noopener">https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D8%AC%D9%86%D8%A8-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%AA%D8%B5%D9%8A%D8%AF-phishing</a></li>
<li>Russian: <a href="https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B5-%D0%BE%D1%82-%D1%84%D0%B8%D1%88%D0%B8%D0%BD%D0%B3%D0%BE%D0%B2%D1%8B%D1%85-%D0%B0%D1%82%D0%B0%D0%BA" target="_blank" rel="noopener">https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B5-%D0%BE%D1%82-%D1%84%D0%B8%D1%88%D0%B8%D0%BD%D0%B3%D0%BE%D0%B2%D1%8B%D1%85-%D0%B0%D1%82%D0%B0%D0%BA</a></li>
<li>(and other languages...)</li>
</ul>
<p><strong>GCA Cyber Toolkit</strong> <a href="https://gcatoolkit.org/mission-based-orgs/prevent-phishing-and-malware/" target="_blank" rel="noopener">https://gcatoolkit.org/mission-based-orgs/prevent-phishing-and-malware/</a>  The tools included in this toolbox aim to help prevent these types of attacks. Included are: DNS security (DNS, or Domain Name System, is the method by which you are able to navigate the internet) to help prevent you from going to infected websites; anti-virus software to help prevent viruses and other malicious software from getting into your systems; and ad blockers, together with correct filter lists, help prevent malicious activity and access to malicious websites while browsing the Internet.</p>
<p><strong>Google Phishing Quiz</strong> <a href="https://phishingquiz.withgoogle.com/" target="_blank" rel="noopener">https://phishingquiz.withgoogle.com/</a> Can you spot when you’re being phished? Identifying phishing can be harder than you think. Phishing is an attempt to trick you into giving up your personal information by pretending to be someone you know. Can you tell what's fake?</p>
<p> </p>

Protect your accounts using strong passwords, pw managers, 2fa

2022-11-20T22:31:37Z

Kristin:

<h1>Passwords</h1>

<p><strong>Passwords are your first line of defense</strong> against anyone who would like to hack into these accounts. They are what keep your information safe; they enable you to keep control of your data.</p>

<p>But preventing your accounts from being hacked requires passwords that are long, strong, complex, unique and practical; and you need to have a DIFFERENT long, strong, unique and practical password for each account.</p>

<h2>Why do we need strong passwords?</h2>

<p>The internet stores a lot of data about you. Your credit card information might be tied to your Apple ID or Android Device ID, as well as to your online shopping accounts. Personal photos, including of your family, children, and friends, might be stored on Facebook, on your phone and and on the servers of your cloud storage. Your email and messaging app accounts have all your conversations with partners, friends and family, as well as work-related discussions and other information.</p>

Your passwords need to be strong enough so you can keep control of your accounts. Once an account is hacked, an attacker can:
<ul>
<li>Access all the information in that account</li>
<li>Lock you out of that account</li>
<li>Impersonate you and communicate with, or send phishing emails to, your network</li>
<li>Try to use this account to gain access to other accounts or use it to try to gain access to your financial information</li>
</ul>

A good password is the only thing keeping this information from being accessed. In short, it gives you control over your data.

<p><strong>No need to change your strong passwords once they are in place.</strong> Changing passwords regularly was a common recommendation until a couple of years ago. This is outdated now because if you follow this list of best practices, there is absolutely no need to change your passwords regularly. The reason why changing passwords is no longer recommended is the following: Researchers have found that changing passwords regularly does more harm than good as it encourages people to choose weaker passwords. Better choose a strong and unique password once, instead of regularly changing a weak one to another weak one.</p>

<h2>Resources on creating strong passwords</h2>

<p><strong>[Online course] Totem's course about secure passwords</strong> (free) - Passwords are your first line of defence online, so it’s really important that these are long and unique. But how can you manage this for all your accounts? The course will guide you through setting up KeePassXC, a password manager that makes creating and storing passwords easier and safer. You’ll also look at Two-Factor Authentication (2FA), for added security. You should end the course with a solid password-management strategy that protects your accounts, without taking up too much of your time (or brain-power!).  This course is available in: [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_001+course/course/ English], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_ES+001/about Spanish], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_FR_001+cours/about French], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_AR+001/about Arabic], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_RU+001/about Russian], [https://learn.totem-project.org/courses/course-v1:Totem+TP_SP_FA+001/about Farsi]</p>

<p><strong>[Guide] Creating strong passwords</strong>  [by Electronic Frontier Foundation] - This guide is designed for human rights defenders and is available in [https://ssd.eff.org/en/module/creating-strong-passwords English], [https://ssd.eff.org/es/module/creando-contrase%C3%B1as-seguras Spanish], [https://ssd.eff.org/fr/module/cr%C3%A9er-des-mots-de-passe-robustes French], [https://ssd.eff.org/ar/module/%D9%88%D8%B6%D8%B9-%D9%83%D9%84%D9%85%D8%A7%D8%AA-%D8%B3%D8%B1-%D9%82%D9%88%D9%8A%D8%A9 Arabic], [https://ssd.eff.org/ru/module/%D1%81%D0%BE%D0%B7%D0%B4%D0%B0%D0%BD%D0%B8%D0%B5-%D0%BD%D0%B0%D0%B4%D1%91%D0%B6%D0%BD%D1%8B%D1%85-%D0%BF%D0%B0%D1%80%D0%BE%D0%BB%D0%B5%D0%B9 Russian], and other languages. </p>

<h1>Password managers</h1>

<p> A password manager is a tool that creates and stores passwords for you, so you can use many different passwords on different sites and services without having to memorize them. You only need to remember one master password that allows you to access the encrypted password manager database of all your passwords.</p>

<p><strong>[Video] Animated Overview</strong>: [https://ssd.eff.org/en/module/animated-overview-using-password-managers-stay-safe-online Using Password Managers to Stay Safe Online] (by EFF) - available in many languages</p>

<h2>Password manager: Bitwarden</h2>

<p>[https://bitwarden.com/ Bitwarden] is a free and open-source password management service that stores sensitive information such as website credentials in an encrypted vault. The Bitwarden platform offers a variety of client applications including a web interface, desktop applications, browser extensions, mobile apps, and a command-line interface. It is a popular password manager option among human rights defenders.</p>

Bitwarden resources:
<ul>
<li>[Videos] [https://vimeo.com/showcase/8692945 Getting Started with Bitwarden](English) </li>
<li>[Guide] How to use Bitwarden to manage passwords on all devices, including phones. Free, open source software.</li>
</ul>

<ul>
<li>[Guide] [https://bitwarden.com/help/get-started-individual-user/ Get Started with Bitwarden] (English)</li>
<li>[Slide deck] [https://docs.google.com/presentation/d/e/2PACX-1vRj4oFJeS4hW6RnS3SPctCDAPeEe2XpAq4Iolr9LME3PDG2wKx-hpCNsqhjqz01UmFpTX8IVKObdvNM/embed?start=false&loop=false&delayms=3000&slide=id.gd279e4f08d_1_1062 Bitwarden for Beginners (English)</li>
<li>[Guide] [https://www.pantallasamigas.net/guia-configuracion-programa-gestor-contrasenas-bitwarden-ciberseguridad/ Install and Configure Bitwarden]</li>
<li>[Video] [https://vimeo.com/539797097 How to send sensitive info (files or text) securely to anyone, using Bitwarden] (English)</li>
<li>[Video] [https://vimeo.com/579574710 How to set up Bitwarden for your internet browser] (English)</li>
<li>[Guide] [https://bitwarden.com/help/getting-started-mobile/ Getting started with Bitwarden mobile] (English)</li>
</ul>

<h2>Password manager: KeepassXC</h2>

<p>[https://keepassxc.org/ KeePassXC] is a free and open-source password manager. It started as a community fork of KeePassX. It is built using Qt5 libraries, making it a multi-platform application which can be run on Linux, Windows, and macOS.</p>

KeepassXC resources:
<p><strong>[Video] Manage your passwords using KeePassXC</strong> (by Justice and Peace Netherlands)</p>
<ul>
<li>English: <a href="https://www.youtube-nocookie.com/embed/Dm3Xeo0hIQk" target="_blank" rel="noopener">https://www.youtube-nocookie.com/embed/Dm3Xeo0hIQk</a></li>
</ul>
<p><strong>[Guide] How to use KeepassXC</strong> (by Electronic Frontier Foundation) - KeePassXC is a cross-platform password manager that allows you to store all of your passwords in one location. KeepassXC is a free, open source software that you would download to your computer/laptop (not your phone).</p>
<ul>
<li>English: <a href="https://ssd.eff.org/en/module/how-use-keepassxc" target="_blank" rel="noopener">https://ssd.eff.org/en/module/how-use-keepassxc</a></li>
<li>Spanish: <a href="https://ssd.eff.org/es/module/c%C3%B3mo-usar-keepassxc" target="_blank" rel="noopener">https://ssd.eff.org/es/module/c%C3%B3mo-usar-keepassxc</a></li>
<li>French: <a href="https://ssd.eff.org/fr/module/guide-pratique-utiliser-keepassxc" target="_blank" rel="noopener">https://ssd.eff.org/fr/module/guide-pratique-utiliser-keepassxc</a></li>
<li>Arabic: <a href="https://ssd.eff.org/ar/module/%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85-%D9%83%D9%8A-%D8%A8%D8%A7%D8%B3-%D8%A7%D9%83%D8%B3" target="_blank" rel="noopener">https://ssd.eff.org/ar/module/%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85-%D9%83%D9%8A-%D8%A8%D8%A7%D8%B3-%D8%A7%D9%83%D8%B3</a></li>
<li>Russian: <a href="https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-keepassxc" target="_blank" rel="noopener">https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-keepassxc</a></li>
<li>(and other languages...)</li>
</ul>
<hr />

<h1>Two factor (or multi factor) authentication (2fa or mfa)</h1>

<p>What is two factor authentication?</p>

<p><iframe title="YouTube video player" src="https://www.youtube-nocookie.com/embed/0mvCeNsTa1g" width="560" height="315" allowfullscreen="allowfullscreen" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"></iframe></p>

<h3>Resources on 2fa</h3>
<p><strong>[Guide] How to enable 2fa</strong> (by Electronic Frontier Foundation) - This guide is available in [https://ssd.eff.org/en/module/how-enable-two-factor-authentication English], [https://ssd.eff.org/es/module/c%C3%B3mo-habilitar-la-autenticaci%C3%B3n-de-dos-factores Spanish], [https://ssd.eff.org/fr/module/guide-pratique-activer-l%E2%80%99authentification-%C3%A0-deux-facteurs French], [https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D9%81%D8%B9%D9%8A%D9%84-%D8%A7%D9%84%D8%AA%D9%88%D8%AB%D9%8A%D9%82-%D8%A7%D9%84%D8%AB%D9%86%D8%A7%D8%A6%D9%8A-two-factor-authentication Arabic], [https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D9%81%D8%B9%D9%8A%D9%84-%D8%A7%D9%84%D8%AA%D9%88%D8%AB%D9%8A%D9%82-%D8%A7%D9%84%D8%AB%D9%86%D8%A7%D8%A6%D9%8A-two-factor-authentication Russian] and other languages. </p>

<h1>Be aware of spear phishing attacks</h1>

<p>Phishing happens to everyone, but most people only become aware of it once they have become a victim of an attack. Protecting yourself from phishing attacks</strong> starts with identifying an email or message as an attack before you click on the link or download the file. But even if you are careful, a phishing attack can still sometimes be successful. Don’t panic. If you have clicked on a phishing link and given an attacker access to your data, you can still reduce the damage - to yourself as well as to your colleagues, friends, and family.</p>

Resources to learn about and avoid phishing and spear phishing attacks:

<p><iframe src="https://player.vimeo.com/video/444354623?h=501ce0881b&title=0&byline=0&portrait=0" width="640" height="360" allowfullscreen="allowfullscreen" allow="autoplay; fullscreen; picture-in-picture"></iframe></p>
<p><a href="https://vimeo.com/444354623">Phishing Overview</a> from <a href="https://vimeo.com/user71914801">Renee McLaughlin</a> on <a href="https://vimeo.com">Vimeo</a>.</p>
<h3>Resources for avoiding a phishing attack</h3>
<p><strong>[Guide] <a class="inline_disabled" href="https://safecomputing.umich.edu/be-aware/phishing-and-suspicious-email/shortened-url-security#:~:text=There%20are%20a%20number%20of,tinyurl.com." target="_blank" rel="noopener">How to reveal full URLs</a><br /></strong></p>
<p><strong>[Online course] Totem online course on Phishing Attacks</strong> (free).<strong> </strong>In this course you will learn about phishing attacks: what they are, what they are used for, how you can identify them, and what you can do if you have been phished. </p>
<ul>
<li>English: <a href="https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_001+course/about" target="_blank" rel="noopener">https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_001+course/about</a></li>
<li>Spanish: <a href="https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_ES+001/about" target="_blank" rel="noopener">https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_ES+001/about</a></li>
<li>French: <a href="https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_FR001+cours/about" target="_blank" rel="noopener">https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_FR001+cours/about</a></li>
<li>Russian: <a href="https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_RU+001/about" target="_blank" rel="noopener">https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_RU+001/about</a></li>
<li>Arabic: <a href="https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_AR+001/about" target="_blank" rel="noopener">https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_AR+001/about</a></li>
<li>Farsi: <a href="https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_FA+001/about" target="_blank" rel="noopener">https://learn.totem-project.org/courses/course-v1:Totem+TP_PM_FA+001/about</a></li>
</ul>
<p><strong>[Guide] How to avoid a phishing attack</strong> (by Electronic Frontier Foundation) - This guide will help you to identify phishing attacks when you see them and outline some practical ways to help defend against them.</p>
<ul>
<li>English: <a href="https://ssd.eff.org/en/module/how-avoid-phishing-attacks" target="_blank" rel="noopener">https://ssd.eff.org/en/module/how-avoid-phishing-attacks</a></li>
<li>Spanish: <a href="https://ssd.eff.org/es/module/c%C3%B3mo-evitar-los-ataques-de-phishing-o-suplantaci%C3%B3n-de-identidad" target="_blank" rel="noopener">https://ssd.eff.org/es/module/c%C3%B3mo-evitar-los-ataques-de-phishing-o-suplantaci%C3%B3n-de-identidad</a></li>
<li>French: <a href="https://ssd.eff.org/fr/module/guide-pratique-%C3%A9viter-les-attaques-par-hame%C3%A7onnage" target="_blank" rel="noopener">https://ssd.eff.org/fr/module/guide-pratique-%C3%A9viter-les-attaques-par-hame%C3%A7onnage</a></li>
<li>Arabic: <a href="https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D8%AC%D9%86%D8%A8-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%AA%D8%B5%D9%8A%D8%AF-phishing" target="_blank" rel="noopener">https://ssd.eff.org/ar/module/%D8%AF%D9%84%D9%8A%D9%84-%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%AA%D8%AC%D9%86%D8%A8-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%AA%D8%B5%D9%8A%D8%AF-phishing</a></li>
<li>Russian: <a href="https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B5-%D0%BE%D1%82-%D1%84%D0%B8%D1%88%D0%B8%D0%BD%D0%B3%D0%BE%D0%B2%D1%8B%D1%85-%D0%B0%D1%82%D0%B0%D0%BA" target="_blank" rel="noopener">https://ssd.eff.org/ru/module/%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%BF%D0%BE-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B5-%D0%BE%D1%82-%D1%84%D0%B8%D1%88%D0%B8%D0%BD%D0%B3%D0%BE%D0%B2%D1%8B%D1%85-%D0%B0%D1%82%D0%B0%D0%BA</a></li>
<li>(and other languages...)</li>
</ul>
<p><strong>GCA Cyber Toolkit</strong> <a href="https://gcatoolkit.org/mission-based-orgs/prevent-phishing-and-malware/" target="_blank" rel="noopener">https://gcatoolkit.org/mission-based-orgs/prevent-phishing-and-malware/</a>  The tools included in this toolbox aim to help prevent these types of attacks. Included are: DNS security (DNS, or Domain Name System, is the method by which you are able to navigate the internet) to help prevent you from going to infected websites; anti-virus software to help prevent viruses and other malicious software from getting into your systems; and ad blockers, together with correct filter lists, help prevent malicious activity and access to malicious websites while browsing the Internet.</p>
<p><strong>Google Phishing Quiz</strong> <a href="https://phishingquiz.withgoogle.com/" target="_blank" rel="noopener">https://phishingquiz.withgoogle.com/</a> Can you spot when you’re being phished? Identifying phishing can be harder than you think. Phishing is an attempt to trick you into giving up your personal information by pretending to be someone you know. Can you tell what's fake?</p>
<p> </p>

2022-11-16T14:46:13Z

Kristin: /* Full disk encryption */

= Secure your devices =

This is a collection of resources for human rights defenders to better understand when, why and how to secure devices.

== Use antivirus or anti-malware ==

=== Advice ===

1. Know how to check if your antivirus or anti-malware app is working and updating itself.

2. Perform periodic manual scans.

3. Choose and run only one anti-malware app; if you run more than one on a device, they may interfere with each other.

[https://freedom.press/training/blog/what-about-antivirus/ What about antivirus?] Article by David Huerta (2020) of the Freedom of the Press Foundation Here's a good article
Excerpt: "Antivirus software is one of the oldest offerings available from the now billion-dollar cybersecurity industry. But what does antivirus software do to help protect our devices, what does it not do, and do we really need it?"

=== Antivirus software options ===

'''Windows'''
On Windows 10, Security in a Box recommends to turn on Windows's own anti-malware protection [https://securityplanner.consumerreports.org/tool/turn-on-windows-defender-antivirus Windows Defender]

'''Linux'''
On Linux you can manually scan your device for malware with [https://www.clamav.net/ ClamAV]. But be aware it is only a scanner, and will not monitor your system to protect you from infection. You can use it to determine whether or not a file or directory contains known malware — and it can be run from a USB memory stick in case you do not have permission to install software on the suspect computer. You may also consider using paid antivirus (e.g. ESET NOD32)

Software available on multiple operating systems that offer free versions:
* [https://www.bitdefender.com BitDefender] (Android, iOS, Mac, Windows) - Warning: This can be a heavy program for many computers.
* [https://www.malwarebytes.com/ Malwarebytes] (Android, iOS, Mac, Windows). Malwarebytes full version is free for 2 week, but you can manually scan your device without time limits.
* [https://www.avast.com/ Avast antivirus] (Android, iOS, Mac, Windows)

Not recommended:
* [https://www.avg.com/ AVG antivirus] (Android, iOS, Mac, Windows)
* [https://www.avira.com/en/free-antivirus Avira antivirus] (Android, iOS, Mac, Windows)

From the community: AVG, Avira were found to be running mining operations on consumers PC and they don't offer proper protection.

Note that all antivirus and anti-malware apps collect information on how the protected devices are being used. Some of this information may be shared with companies which own them. There have been cases where this information was sold to third parties.

----
''Last updated Nov 11, 2022

Source for this content: [https://securityinabox.org/en/phones-and-computers/malware/#use-antivirus-or-anti-malware Security in a Box]'' and discussions with human rights security practitioners.

== Full disk encryption ==

Coming soon

2022-10-12T18:35:07Z

Kristin:

Digisec resources

2022-10-12T18:08:20Z

Kristin:

= Digital Security Research and Resources for Human Rights Defenders =

== Resources by topic ==

Secure your devices

[[Protect your accounts using strong passwords, pw managers, 2fa]]

Safe internet browsing using VPN and Tor browser

Protect your information

Protect your communication

How the internet works

== Communities for support and advice ==

'''Access Now’s Digital Security Helpline''' works with individuals and organizations around the world to keep them safe online. If you’re at risk, they can help you improve your digital security practices to keep out of harm’s way. If you’re already under attack, they provide rapid-response emergency assistance. Their 24/7 services are available with support in nine languages: English, Spanish, French, German, Portuguese, Russian, Tagalog, Arabic, and Italian. They respond to all requests within two hours. https://www.accessnow.org/help/

== Resources by language ==

[[français (French)]]

[[عربى (Arabic)]]

[[ဗမာဘာသာစကား (Burmese)]]

[[Tiếng Việt (Vietnamese)]]

== Other ==

[[Research on transnational repression]]

----

This is a draft list, which will is being worked on:

'''Totem Project:'''

https://totem-project.org/

for free, self-paced sessions on the basics

https://wiki.orgsec.community/

for Organizational Security focused resources

'''Guides'''

https://freedom.press/training/

https://ssd.eff.org/

https://freedom.press/training/ -

'''Assessment tool and personalized digital safety plan for individuals:'''

https://securityplanner.consumerreports.org/

2022-10-12T15:21:14Z

Kristin: