Privacy & Security Changes You MUST Make (or get left behind)

[@schnds]

Ever since an account of mine was hacked back in mid-2022, I've been making it my best effort to be almost completely unhackable and untraceable online. I'm glad I found your channel among other channels who cover online security/privacy. You guys have helped me a ton!

[@AllThingsSecured]

So glad to hear it, Michael! I hope you don’t have to experience a hack again.

[@AndrewMcDreamy]

What channels do you recommend for someone starting out?

[@ethimself5064]

I googled my name and address and only came up with a 411 look up @@AllThingsSecured

[@LegitRockSt4r]

@@AndrewMcDreamy Payette Forward

[@RMahPersonal]

@@AndrewMcDreamyI also like and recommend the podcast security now to help

[@SECYBERSAFE]

I hope people will understand that nothing is full proof. Good thing a channel like yours exists. We always need to be updated.

[@AllThingsSecured]

Thanks so much.

[@maxguod]

Fool proof -

[@MaraudersWorld]

I have been in IT for over 35 years and my mantra has always been nothing is safe and everything is hackable. I have always "actively encouraged" family and friends to be IT security aware for their own benefit. This presentation is very concise, easy for the layman to understand and covers the more important points everyone needs to be aware of. Well done ... I can now refer to this without sounding like a broken record. 😜

[@BrooklynNYinsideConstruction]

I took a degree in Stockton to secure myself and it’s a bachelor. I also know how to encrypt and decrypt anything. So. I’m so dangerous right now and nobody fights me online anymore even if I curse them

[@Mom2MrBabyHaikin]

Want to help me? 2FA emergency Social media situation.

[@Mom2MrBabyHaikin]

Can a physical key still be a solution?

[@myothurazaw]

These days we are encouraged to replace physical keys in their own home with passwords or access cards. Now we are told that we should replace passwords for online accounts with physical keys

[@notyet2345]

One of the things I do is put alerts on all my accounts....If someone logs in, i get an alert, if someone changes my personal info, i get an alert......If you don't have alerts setup, do it. Especially login alerts....those will happen even if someone does hack you. If someone logs in to your account, you will be notified immediately. If they change password, you will get alert........it's annoying but it is so worth it. I usually setup email and text alerts.

[@krisbright3227]

While that is very important, it too also has flaws. Session hijackings, like what happened to Linus Media Group and many other KZbinrs actually circumvent the Login alerts as the session is considered as "already logged in". Great thing to have, but certainly shouldn't be used on its own.

[@ediewall6360]

Just found you this very day!!! Lucky me. Thank you for teaching us how to watch our own backs better and making it clear that we need to step up our game to be less vulnerable. I just watched 4 of your videos back -to - back and found MUCH in each one that I need to implement. That is all of this info I think I want to take in at this moment, but I DID share with friends, whom I believe will be grateful too.

[@AllThingsSecured]

Is there anything else you would add to this? I know I'm not covering everything here, so I'd love to hear your comments. And if you'd like to support me while removing your data online, use the code "ATS" when you sign up for DeleteMe: www.allthingssecured.com/try/deleteme-yt

[@rjain1993]

yes make a video on security question like you made a video on how to set & remember a good passphrase set custom security questions if possible eg. your 1st iphone ? ans. Samsung S3 make it cryptic ($@m5ung S3) that way big tech. , hackers , govt. will keep guessing iphone you can make it harder by setting answer like cake but harder for you too if not letting you set custom then don’t set obvious answers eg. your birth month ? ans. 0ctumbur@ry where did you study ? ans. B3rmud@ Tr!@ngl3 (just examples not my answers)

[@rorylisbon4723]

Isolate tasks to different browsers.

[@darrellm9915]

I'm still paranoid about my facebook data getting leaked, even after deleting my account, since they still keep backup copies on their servers forever.

[@AllThingsSecured]

@@rorylisbon4723 Exactly. That's another form of sandboxing that can work.

[@theangrychair5150]

How much does DeleteMe cost because Im sure its not free?

[@user-qr4jf4tv2x]

the best security is to not have personal information. never stay in a messaging group channel,disable messaging and notification if you can, never make information permanent, 3 months interval of deleting old password, separate email for every social media. never save cookies, have 2fa,sms, don't use password manager learn to type.. sandbox the entire computer or run it over VM.. while VPN/TOR good its better to run your own via cloud provider, take note of sites you registered so you can delete your account

[@y-y-z]

Awesome video. It's scary in a way to think of the future of personal information theft. My problem is I have numerous email accounts dating back to the inception of America Online. I'm now in the tedious process of deleting them all. Thank you.

[@AllThingsSecured]

Wow…that sounds mind numbing 😆

[@specialk9999]

That’s what I have been doing or at least trying to do the last couple years. It’s so irritating how so many companies make it such a pain to delete accounts.

[@barrywilliams991]

Set yout email reader to not automatically show pictures embedded in email. If there are senders you trust, set them individually. All of those pictures contain trackers in their URLs and it lets the sender know you have looked at the email. You know those emails that are blank until you dhow the picture attached? Those are sent to fish for active accents and it opens uou up for many different exploits

[@genericdude6551]

Sheesh. The amount of time, money and effort to protect our privacy has us throwing our hands up in frustration.

[@MeticulousTechTV]

I FINALLY got my spouse to use a password manager… and then 2022 happened. Can you guess which one she used? 😢

[@Bushchannel]

Lastpass?

[@T1Oracle]

Mines thinks they're too complicated...

[@Mackylaw36]

Better Nordpass or Bitwarden

[@nauxsi]

The worry about 2fa is getting locked out of accounts because you don't have physical device nearby.

[@hamadico]

I am still convincing my significant other that passwords in notes app is not safe. No luck at password manager yet.

[@SayeedBaksh-y1c]

i bought my yubi key over 3 years ago and parked them. After learning about sim swapping, i am bringing them out Do you know how we can use yubi keys to protect wordpress? Thx

[@travelman158]

Great Advice! Thank you very much for sharing.

[@AllThingsSecured]

Glad it was helpful!

[@michaelrobsimonbyrne4068]

thanks josh i use my physical key for my accounts

[@AllThingsSecured]

Great job 👏

[@smitv5]

Make an video no how to secure a physical thing Eg :- like a key 🔑 wallet 🪪 and a piece of paper with password info ! Waiting for this video 😊

[@AllThingsSecured]

So, you mean do a video about having an actual safe in your house?

[@garys585]

Good info for protecting user access to their accounts. Now if we could get the organizations that house these accounts to protect their databases better against hacks.

[@AllThingsSecured]

Agreed, although I try to give them a slight bit of grace because it’s a constant game of cat and mouse, not to mention trying to keep track of your weakest employee link.

[@raywhuj217]

I have multiple e-mail address, burners phone, multiple fake social media accounts, mutiple banks acoount under different names, different passports and and driver's license under different names, multiple home addresses, multiple social number. What else can I do to protect my privacy?

[@rexluminus9867]

Flipphone.🎉😂😅😊

[@ScarfaceLittlebee-mj2ch]

You can hide your identity if you’re on a manhunt 😂

[@houghi3826]

I have my own domain. So what I do is make a new alias for each company I have to leave an email addres. It saved me at least once when I received a really good looking fake from my bank, but send to a generic account I use for unimportant things. As the bank does not kn ow that email, it could not have been them. It also is obvious if there is a hack. If I get an email to e.g. my bank email, then I know they are either sold my email (unlikely, as I live in Europe) or they have been compromised. I have 250+ email adresses. Sure sounds like a lot, but I add them one by one and this is something I build over many years. Sure, it is an extra step I need to do when I get to buy from a new company, but it is worth it. It even makes me think "Is it worth the trouble?" and sometimes it is not.

[@jobicek]

When it comes to things like banking, never ever click on links provided. Unless e.g. you've been expecting an e-mail to verify your e-mail address. In any case, if you do intend to click on a link, check the certificate and domain. If they notify you of something, always go through their main website. This is why banks, at least where I live, don't send links. They don't want people clicking on links in e-mails. They still rely on snail mail for important things. I also have my own domain and have been using vendor-specific addresses for almost 20 years, primarily so that I can track who leaks/ sells my data and to prevent accounts across companies being matched (although since I have a personal domain, it's still possible, but that's unusual). I don't actually set up mail boxes for them, they go into a generic bin that collects all mail that couldn't be delivered to a box. If I wanted to, I would probably create an action that would allow me to make a box for a given recipient and transfer all existing messages there. Creating it retrospectively, when I'm reading mail. Instead of having to set it up during registration. Without having to fill out anything - just a couple of clicks and done. I've always liked to sandbox my interests. That's why I dislike modern social media as opposed to old-school forums. If I'm into model trains and fishing, I don't necessarily want those two groups to know about each other. Usually, only very few people in such groups know who I am. The rest has no reason to and so they don't. Certainly not newcomers. You could set up multiple accounts, but given how nosy social media companies are, they would probably be able to link them anyway. They just have too much leverage.

[@pedroleitao1937]

Hey Josh! Once again, really nice and useful video. However, as far as I know phone and home addresses alia-se, are in most of the cases, only available in the US! How about other countries, such as EU ones? Are we supposed to stay behind on online security, as both, people and governments don’t give a damn about it? Or should we just trust EU laws about personal data are different from the US ones?

[@salimbinyussup9351]

I salute you so useful & helpful content looking forward your next video thanks Josh 🤩

[@AllThingsSecured]

My pleasure!

[@mastergreener]

Thanks for all of the vids, tips and work. I was wondering if any chance of doing a video comparing the new privacy, decentralised and privacy focused messaging apps like Secretum, Damus etc?

[@AllThingsSecured]

I’ll look into it. Thanks for the suggestion.

[@Josh-mo2ib]

What options exist in Canada to 'mask your data' - services you mention for virtual addresses and credit cards don't seem to exist or service Canadians.

[@michaeleichner7522]

With the advent of Face ID is there still a need for a Yubikey?

[@AllThingsSecured]

No, it’s different forms of 2FA.

[@Pfsensepluss]

Consider kevin mitnicks book on being invisible online, good read

[@Giusie79]

Would you save generate and backup codes or just use 2 or more physical keys?

[@AllThingsSecured]

If you save the backup codes securely, it’s pretty much the same.

[@patcostello3882]

Hey Josh Have you ever investigated security of third party Keyboard apps? Love your videos too

[@AllThingsSecured]

I generally discourage anybody from using 3rd party keyboards. What’s your purpose for using them?

[@Here4TheHeckOfIt]

Ugh. Sometimes, I long for the days when tech wasn't so prevalent. It's tedious having to do all of this. Because nothing is 100% safe, certain things shouldn't be handled online.

[@likebot.]

I didn't know a phone number is associated with a Twitter account. It's probably required as an added layer of security, but I see it as an added layer of insecurity - giving up personal data.

[@AllThingsSecured]

Exactly.

[@likebot.]

@@AllThingsSecured FYI, I don't have a phone number! :) My wife has a landline tho.

[@rayn1ful]

for 2fa why not have a live person call you to give you the security code but have them ask you a security question that only you would know then give you the code once that security question has been answered for even more security? or for 2fa why not do this? when companies want to implement 2fa why dont they use the hardware yubikey that the companies pay for to send to each and every customer?

[@sothere1]

Same reason companies only offer SMS 2FA. Because every man, woman, other and dog will understand it. They are playing to the dumbest common denominator. Send everyone Yubikeys and 75% of the customers are going to be calling them for help with it every other week.

[@specialk9999]

I’ve been thinking about going back to using a burner phone.

[@AllThingsSecured]

Not hard to do.

[@voiceofreason5893]

Great information. Subscribed.

[@patrikwilliams9639]

How do you handle shipments of products to the home?

[@AllThingsSecured]

I’m not a good example. I live overseas, so I send all packages to my virtual address.

[@sbconsult]

Most the Big companies have drop locations you can use rather than your home, i.e. UPS Stores for one. Walgreens will receive FedEx packages, etc. And most have locker locations including Amazon. 😊

[@label4435]

If I have Delete Me, do I need an id theft protection company as well?

[@AllThingsSecured]

two very different services

[@nerkymusselman8843]

sorry little off topic here. is the yubikey 5ci the best choice for use for someone on an ipad 80% ($249 standard model) & imac 20% of the time?

[@ananamusly]

Yes but buy multiple keys for backups

[@AllThingsSecured]

In this case, the Security key USB-C would work just as good, and it’s significantly cheaper.

[@grahamsmith2753]

The current ransomware attacks due to an old and well-known VPN flaw proves that many companies don't invest enough time in security, and yet they expect us to put our trust in them. Your twitter mention is a case in point. China probably has hackers working 24-7 trying to break into systems worldwide. It's the cases we don't know about that are probably the greatest threat. State-sponsored malware has been around for quite some time, and has always been difficult to detect and defend against.

[@AllThingsSecured]

I agree, but you also need to remember that even when companies invest in security, it’s often no match for the constant state-sponsored attacks.

[@grahamsmith2753]

@@AllThingsSecured I remember when they discovered Stuxnet in 2010. Who knows how long it been operating. There quickly followed the unmasking of around half a dozen more...all state-sponsored.

[@Carolinanine_]

I have to use a public wifi when I get to work, the building blocks the cell signal. What are my options??

[@AllThingsSecured]

Yikes. Sounds like you don’t have many options.

[@JM.TheComposer]

This is one of the few cases where a VPN can actually help you.

[@mahyelashram5703]

My Facebook is locked because 2FA CANT BE ACCESSED PLEASE HELP

[@fugitive88888]

A puece of paper seems to be the way

[@NKC004]

Which is the best free authenticator app?

[@AllThingsSecured]

Google Authenticator is good and I e used Authy in the past.

[@rooooooocketeffex]

You should review Skiff

[@AllThingsSecured]

I will eventually.

[@rooooooocketeffex]

@@AllThingsSecured aren't you doing paid promotions for Proton?

[@LeighIveta]

So its turns out Delete me is only available to USA and NOT the UK

[@AllThingsSecured]

Try international.joindeleteme.com

[@Mom2MrBabyHaikin]

I need your help!!!

[@SergeiWhobichakokov]

I'm still using 1Password 6. I didn't want my passwords going to the cloud.

[@ediewall6360]

I do not want anything ever going to the cloud, ever. I did not ever sign up to cloud associated with my iPad .

[@thentil]

Can add LTT to the list of hacked yt accounts as of this morning 😮

[@richardharker2775]

Instead of massively shielding ourselves to be hiding in a cocoon why is there no measures to seek out the perpetrators? I can follow most of what you say but some is over my head. Hiding your address for instance is impossible if you want home deliveries. Recently my health insurance company had data stolen and now I'm being bombarded with spam. It is impossible to give them fake details and expect a service. It seems to be really and ultimately safe you shouldn't use the internet.

[@AllThingsSecured]

It’s frustrating, I know. Unfortunately, because a lot of the problems come from international attackers beyond your country’s jurisdiction, shielding yourself is one of the only options.

[@PinkyBooLandBR]

Do you think it would be a good idea of using a VPN like ExpressVPN but also using Cloudflare DNS server at the same time, instead of the ExpressVPN one?

[@AllThingsSecured]

Absolutely. No harm in doing that at all.

[@c1ue1]

Fairly sure the "secure" USB is not going to be secure against any form of a moderately skilled attacker. Even discounting a straight hardware clone of the storage - which is incidently really easy on a USB device - I really doubt the software acting as a firewall between USB mounting and a system it is connected to, is attackproof. And if it isn't, an enormous array of options comes into play ranging from cloning the data to enable infinite physical password attempts to a full virtual machine pretending to be the keys of the device. At that point, you would need 50 digit passwords to hold out even for an hour.

[@sothere1]

What secure USB are you talking about? If you mean the Yubikey shown in the vid, that is not a storage device. It's a dedicated security chip with a USB interface. You're not cloning a Yubikey.

[@c1ue1]

@@sothere1 The Secure USB in the video is one which has a little keypad controlling the USB controller. It can be attacked easily. Nor is your idea that Yubikey is not "cloning" the least bit realistic. You can't clone a yubikey to another yubikey - but there is no physical way to prevent a straight content rip even though this involves physical access to the underlying memory.

[@ScarfaceLittlebee-mj2ch]

@@c1ue1isn’t it encrypted

[@c1ue1]

@@ScarfaceLittlebee-mj2ch What does encryption have to do with it? Among other things: if you have penetrated the endpoint that the "secure" device is connected to - either the password is resident in memory or the password is going to have to be reapplied every time the drive is in operation. In either case, the encryption doesn't matter. If the attack is on the device by itself - the boot sector is 512 bytes, typically. If someone has the cash and sufficient desire, it is a pure matter of money to clone the boot sector and then slap it onto thousands of parallel cloud machines to grind passwords. At that point, the question is just how good the password is. But if the "keypad" is not intrinsically tied into said boot sector, you can attack the channel connecting the keypad to said bootsector including snooping, replay, and many other forms of attack. Pretty much every single "secure" device I have ever looked at, at the consumer level, were not the least bit secure.

[@homer5328]

Watched the video, I don’t have computer skills so I went with, I just give up.

[@bobjones787]

3:05

[@TheShubLub]

I see the value in all of this, but at some point I think that we are becoming a person who spends more time securing themselves instead of actually using the internet. Just like if you have a home, yeah you can put up a 10ft wall, security cameras, a moat. Get more and more secure, but at what point are spending more time securing yourself instead of enjoying the home? Even so, I agree that a lot of this is basic, and should be done. Like minimizing your digital footprint. Scrub you public data, Do 2FA. But multiple email accounts, a front phone number, bothering your friends and family, ect. It becomes a lot. Yeah, if you're a high value target, sure do all you can. But it takes a lot of time and effort. Thoughts?

[@AllThingsSecured]

Yea, I get it. And of all the security/privacy channels I watch, I tend to be the least “fanatical”. This is hardly overboard, I’m simply challenging people to really think about what they need to secure before it’s too late. And I’m not saying that your family needs to do the exact same, but if they’re not using 2FA, just understand that they pose a small threat for you.

[@ediewall6360]

Oooh I want a moat !!!!

[@barrywilliams991]

To make sure you don't get scammed by the fake "I'm in trouble and need money abuse" ask yhe sender a question that they'll easily be anle to answer. Make it a question that is very unlikely to be public knowledge or something on their Facebook or other social media page. If they can't answer it, you are very likely dealing with a scammer.

[@tiagoreis5390]

The only issue I see with a lot of this videos and content is that some services are only available in the US. This leads most of the times to not be able to clean your public data and records anywhere... We all need to start over and gain our online privacy as much as possible... Thanks for this videos and its contents!!!! Some services should start being "worldwide" instead of only US.

[@AllThingsSecured]

Which services are you referring to? DeleteMe offers international service, aliasing is global and virtual addresses are everywhere.

[@notknownguy]

Shall take a look at DeleteMe. But here In the UK hard to get Virtual, Cards, Address and Phone without spending alot.

[@tiagoreis5390]

@@AllThingsSecured deleteme says on its pricing: "U.S. residents only."... So its not international because only US residents can apply. :)

[@tiagoreis5390]

@@notknownguy as mentioned: DeleteMe says on its pricing: U.S. residents only. And I am not a US resident... If its global this should be removed. Maybe the service is global but they only allow US residents...

[@marekmagdziak5916]

Thank for this video! My YT was hacked and destroyed :/

[@AllThingsSecured]

I’m sorry to hear that.

[@marekmagdziak5916]

@@AllThingsSecured Thanks , this and your tips made me smarter now! :)

[@marekmagdziak5916]

@@AllThingsSecured Have a fantastic day and please keep up a good wwork!

[@Bennyblanco-xx6ki]

Srry like KZbin or somone was blocking me frm making a comment WTH a vpn on!!

[@ringoisacandyapple]

but I love social sharing 😮‍💨

[@Bennyblanco-xx6ki]

Why can’t I leave a comment on youtube

[@PinkYellowGreen2023]

❤️❤️❤️

[@AllThingsSecured]

Thanks!

[@snipedeedillygaf4973]

I am hacked for surely

[@fhaupldsk]

私は、MoreLoginのようなアンチディテクションブラウザやVPNを使用して、自分の真のIPアドレスを隠すようにしています

[@rjain1993]

👍🏻

[@AllThingsSecured]

🙏

[@mitchellquartero]

Damn talk about something interesting in 2023

[@AllThingsSecured]

What do you mean?

[@mitchellquartero]

@@AllThingsSecured just my opinion so much going on regarding the recent security incident over the past few months but it very informative to say the least thanks lol

[@WitchLuw]

I use 1Password for my passwords Auty for 2FA Vpn surfshark