Protecting against online threats

Recent news from the US revealed that hackers have infiltrated telecommunications companies there.  Additionally, malicious actors are using vanity SMS numbers from Philippine telecommunications companies to send phishing messages.  This highlights the need for us to be extra careful about our online connections. 

Here are some tips to enhance your online security:

1. Get a separate broadband router: Opt for a router from a neutral company like Asus (my personal preference). Enable its firewall, but avoid enabling the DMZ unless you’re absolutely sure. I recommend using Tailscale or setting up a VPN server instead. The router provided by your telco usually has WiFi, so don’t use it.

2. Consider a dedicated firewall device: If you can afford it, a firewall device like Firewalla is a better option. I recommend it for home networks of people with a high -threat model, like military personnel, government officials, or journalists.

3. Choose a neutral vendor: While practically all devices are manufactured or assembled in China, companies that are neutral or friendly to us conduct security audits of their products before shipping. It’s not a guarantee, but it’s better than the alternative.

4. Stay safe on mobile data: When using mobile data, use a VPN to protect yourself from telcos. Investing in a VPN subscription is highly recommended. Free VPNs are risky and often slow. Don’t be tempted to use browser add-ons or extensions, as they only protect your browsing, while other applications that connect to the internet are not protected.

5. Trustworthy comms apps: As the US government recommends, use trustworthy communications apps or services like Signal, Session, Threema, iMessage, and FaceTime. Avoid those that don’t provide full end-to-end encryption (E2EE) by default. Even if E2EE is provided, make sure the encryption protocol is vetted (unlike Telegram). Finally, check their business model, if they collect your data for advertising and other revenue generation (like WhatsApp or Viber), ditch it.

Remember, your threat model might be low now, but you never know when things might change. It’s always better to be vigilant, know your risks, and how to manage them.