> How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
I moved part of my wealth to a private bank, on an account requiring several signatures (from different persons) plus a vetting from the banker for every single outgoing transfer. Not only are several manual signatures required, in addition to that the banker must call me before authorizing any transfer, even if it's only, say, 1 000 EUR (now it's not a retail bank and that's kinda the whole point: transfers are rare and when one is done, no matter the amount, a shitload of verification do happen).
In addition to that, I told my banker that should anything out of the ordinary happen (say an order to suddenly wire 100 K to Dubai or Erithrea or something), then he should go out of his way to make me come in person to the bank to confirm the transfer.
You must train your banker: you must demo him voice impersonation on the phone. You have to make him become totally paranoid too.
I'm not going to say he's my buddy, but he knows I know my shit and we regularly talk for 20 minutes on the phone.
Any transfer to a new bank account: long discussion explaining what that account is and why I'm moving money there.
I've also got digital files (say administrative stuff, stuff from notaries, etc.), encrypted, that I myself cannot easily access. For to access them I must physically go to my safe at a bank first. And trying to impersonate me physically at the bank to steal my stuff means: "on your way out, you risk being locked in the secure airlock and then spend years behind bars".
> Makes me want to have like 5 separate computers:
I have a setup not totally unlike that. For example one phone with one additional app: the country's official "electronic ID" thinggy. And I don't browse from that phone.
I've got several computers and there's definitely my "trash computer", complete with bogus email accounts and crappy apps, etc.
> How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
The first thing is recognizing there's an issue if someone hacking your unique email then can steal everything you have. Many people stop there: they think, as in the XKCD, "it's game over anyway if someone gets my email, so I may as well not worry about it".
That is the mentality of losers.
You're already well ahead of the crowd by recognizing there's a problem and by thinking about solutions.
Many things can be done to lower the risk of a full compromise. I've got two physical LANs and the absolute most sensitive stuff (e.g. my banking apps) are done from a computer that does nothing but email + bank.
So it's not just a separate computer: separate computer on a separate physical LAN (not a VLAN). And there a tiny Pi doing the bridging between the two LANs. And of course it's got a serious firewall (a lost art, but it could make a comeback with the help of LLMs).
Something else that can help is stuff like Google Workspace and keeping the credentials for the admin account very secure and hardly ever logging into it. That way if "[email protected]" gets compromised, there's still "[email protected]" that can help get back control of [email protected].
> - one for development only
I've got a user account for dev only.
> - one for gaming only
A dedicated computer for gaming yes.
> - one for socials only
Besides HN, I don't need those.
It's a wild world out there.
The hacks won't stop coming and you're not anywhere near paranoid enough.
I moved part of my wealth to a private bank, on an account requiring several signatures (from different persons) plus a vetting from the banker for every single outgoing transfer. Not only are several manual signatures required, in addition to that the banker must call me before authorizing any transfer, even if it's only, say, 1 000 EUR (now it's not a retail bank and that's kinda the whole point: transfers are rare and when one is done, no matter the amount, a shitload of verification do happen).
In addition to that, I told my banker that should anything out of the ordinary happen (say an order to suddenly wire 100 K to Dubai or Erithrea or something), then he should go out of his way to make me come in person to the bank to confirm the transfer.
You must train your banker: you must demo him voice impersonation on the phone. You have to make him become totally paranoid too.
I'm not going to say he's my buddy, but he knows I know my shit and we regularly talk for 20 minutes on the phone.
Any transfer to a new bank account: long discussion explaining what that account is and why I'm moving money there.
I've also got digital files (say administrative stuff, stuff from notaries, etc.), encrypted, that I myself cannot easily access. For to access them I must physically go to my safe at a bank first. And trying to impersonate me physically at the bank to steal my stuff means: "on your way out, you risk being locked in the secure airlock and then spend years behind bars".
> Makes me want to have like 5 separate computers:
I have a setup not totally unlike that. For example one phone with one additional app: the country's official "electronic ID" thinggy. And I don't browse from that phone.
I've got several computers and there's definitely my "trash computer", complete with bogus email accounts and crappy apps, etc.
> How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
The first thing is recognizing there's an issue if someone hacking your unique email then can steal everything you have. Many people stop there: they think, as in the XKCD, "it's game over anyway if someone gets my email, so I may as well not worry about it".
That is the mentality of losers.
You're already well ahead of the crowd by recognizing there's a problem and by thinking about solutions.
Many things can be done to lower the risk of a full compromise. I've got two physical LANs and the absolute most sensitive stuff (e.g. my banking apps) are done from a computer that does nothing but email + bank.
So it's not just a separate computer: separate computer on a separate physical LAN (not a VLAN). And there a tiny Pi doing the bridging between the two LANs. And of course it's got a serious firewall (a lost art, but it could make a comeback with the help of LLMs).
Something else that can help is stuff like Google Workspace and keeping the credentials for the admin account very secure and hardly ever logging into it. That way if "[email protected]" gets compromised, there's still "[email protected]" that can help get back control of [email protected].
> - one for development only
I've got a user account for dev only.
> - one for gaming only
A dedicated computer for gaming yes.
> - one for socials only
Besides HN, I don't need those.
It's a wild world out there.
The hacks won't stop coming and you're not anywhere near paranoid enough.