Most of us have family members, like our grandparents and parents, who are not very tech-savvy and often fall victim to online threats. Often times they barely know how to use a computer and do not follow best practices, such as using password manager, updating software, or verifying sources, due to their lack of familiarity with technology. As a real-life example, one of my family members has sent their bank account number to a stranger over email, and the same person often follows directions from clearly suspicious emails, possibly clicking on suspicious links that download malware or steal their login information. I along with everyone wants our families to stay safe online and avoid these risks.
The threat model in this situation is clearly security > privacy, in other words, the goal is to maximise security, which will inevitably come at odds with most of Privacy Guidesâ recommendations.
For people who arenât tech-savvy, a word editor along with a web browser, should suffice for most, if not all of their needs.
Here are my thoughts, along with my summarisation of the kind peopleâs advice, who provided their solutions in this thread (let me know if I missed anything):
- We need to first find a secure operating system (OS) for their device(s); whether they be mobile phones or personal computers, and we need to configure it accordingly. Since mobile phones, e.g., iOS devices are much more secure (or is it more accurate to say they have a smaller attack surface?) compared to personal computers, we will focus on securing personal computers.
Solution: Install ChromeOS on their machine, as it is secure, easy to use and lightweight OR let them use Windows (optional: harden it using the security baselines) with a non-admin account. Is it viable to install ChromeOS on a PC that comes with Windows natively? On such a device, wouldnât Windows take better advantage of the hardware?
The power usage of the device is not only environmentally important, but often times older family members use netbooks and cheap computers, that have limited resources and performance. Hence, âlightweightâ software is preferred. Telemetry, tracking and other non-essential features that companies inject into their software products, for their own personal gain not only come at odds with privacy, but the environment and power usage, so keeping these to a minimum is preferred.
- We need to install non-OS software that may enhance the security of their machines: such software could potentially have built-in guides, tips and warning prompts, warning them not to do misinformed things. The software would need to be low-maintenance. Content and DNS blockers are listed below, these are very important:
Solution: use uBlock Origin, easy mode + enhanced security/privacy, by configuring it to block 3rd-party <iframe> by default, since:
iframetags are very often used by malware code on compromised websites â using 3rd-party-sourced<iframe>to inject exploit on a userâs computer is quite a common technique
Additionally, specific filter lists have been recommended by Privacy Guides and the community, these are the: AdGuard URL Tracking Protection, Actually Legitimate URL Shortener Tool, AdGuard Tracking Protection, Block Outsider Intrusion into LAN, EasyPrivacy, Online Malicious URL Blocklist and Phishing URL Blocklist filter lists. All of these can be found by: clicking the uBO icon > dashboard (cogs icon) > filter lists > under the Privacy and Malware domains drop lists.
DNS filtering at the network-level with AdGuard or AdGuard Home (harder to setup) would enhance the blocking of malware, ads and tracking domains, as well as provide you with the ability to selectively block sites that you donât want them to access. AdGuardâs applications are supposedly more powerful then their DNS servers alone, so I have bought a lifetime AdGuard subscription for 9 devices from stacksocial, which is for some reason much cheaper then what AdGuard offers themselves, but is legitimate.
What web browser should our non-tech savvy family members to use, e.g., Brave, Chrome or Edge? I am guessing this will depend on the operating system, Chrome for ChromeOS, Edge for Windows and so on.
-
We could also secure their important accounts, like bank accounts with 2FA and improve their passwords, check their accounts for suspicious activity (e.g., by using bank statements), change their email provider to Proton or Gmail (which I have been told is the most secure).
-
Other measures like encryption are not necessary due to the security > privacy threat model.
lm just works. I dont want to waste my time and brain power on recommended osâs.