Merge pull request #8 from brianlovin/copy-review

Copy review

README.md

@@ -1,2 +1,27 @@
-# security-checklist
-A checklist for staying safe on the internet
+# Security checklist
+A checklist for staying safe on the internet.
+
+### Motivation
+This project is the result of a conversation started during a [recent episode](https://spec.fm/podcasts/design-details/249464) of the [Design Details Podcast](https://spec.fm/podcasts/design-details/) and a subsequent tweet by [Michael Knepprath](https://twitter.com/mknepprath/status/1083966912420372481).
+
+### Contributing
+This project should be considered a living document of resources and applications that improve people's digital security and privacy. Contributions, edits, and extensions are welcome!
+
+If you have resources to add to existing sections, please open a pull request.
+
+- Aim for reputable sources for guides and new coverage.
+- If adding an app, please include links to as many platforms as possible. See `config/*.js` for examples of how data is formatted.
+- Try to use approachable human-readable language. Remember that even non-technical folks need to stay safe online.
+
+If you would like to create a new category of security and privacy resources, please open an issue first with your proposed category. Please explain why this additional category should stand alone from other existing sections.
+
+### Run this locally
+1. `$ git clone git@github.com:brianlovin/security-checklist.git`
+2. `$ cd security-checklist`
+3. `$ npm install`
+4. `$ npm run dev`
+5. View the running app in your browser at `http://localhost:3000`
+6. Optional: deploy this yourself with ZEIT + Now by configuring `now.json` and running `$ now`
+
+### Feedback
+Please open issues at any time for general feedback, or you can reach me directly at hi@brianlovin.com.

components/ChecklistItem/style.js

@@ -29,6 +29,7 @@ export const Description = styled(Markdown)`
   font-weight: 400;
   color: ${theme.text.secondary};
   margin-top: 8px;
+  padding-right: 16px;
 
   p:first-of-type {
     margin-top: 0;
@@ -246,7 +247,6 @@ export const AppSourcesLabel = styled.span`
 
 export const ResourceRowContainer = styled.a`
   display: flex;
-  align-items: center;
   margin-top: 4px;
   width: 100%;
   border-radius: 6px;

components/Page/style.js

@@ -48,10 +48,10 @@ export const SectionHeading = styled.div`
 `;
 
 export const Heading = styled.h3`
-  font-size: 32px;
+  font-size: 40px;
   font-weight: 700;
-  line-height: 1.2;
   color: ${theme.text.default};
+  line-height: 1.2;
 
   @media (max-width: 968px) {
     max-width: 100%;
@@ -62,7 +62,8 @@ export const Subheading = styled.h4`
   font-size: 22px;
   font-weight: 400;
   color: ${theme.text.tertiary};
-  margin-top: 16px;
+  margin-top: 12px;
+  line-height: 1.4;
 
   a {
     color: ${theme.text.default};

components/ShareButtons/index.js

@@ -22,7 +22,9 @@ export default function ShareButtons() {
         <TwitterButton>Tweet</TwitterButton>
       </a>
 
-      <CopyLinkButton text="https://securitycheckli.st">Copy</CopyLinkButton>
+      <CopyLinkButton text="https://securitycheckli.st">
+        Share Link
+      </CopyLinkButton>
     </Container>
   );
 }

components/ShareButtons/style.js

@@ -5,6 +5,9 @@ export const Container = styled.div`
   display: grid;
   grid-template-columns: repeat(3, 1fr);
   grid-gap: 16px;
+  margin-top: 40px;
+  margin-bottom: 16px;
+  width: 100%;
 
   button {
     width: 100%;

config/appPermissions.js

@@ -1,7 +1,7 @@
 export default {
   id: 'appPermissions',
   title: 'Review app permissions on your devices',
-  description: `You should review all applications that have access to your photos, camera, location, and microphone. Ensure that any app with permission is made by someone you trust.
+  description: `You should review all applications that have access to your photos, camera, location, and microphone. Ensure that you trust apps with sensitive permissions.
   `,
   resources: [
     {
@@ -29,5 +29,17 @@ export default {
       url:
         'https://www.intowindows.com/how-to-change-app-permissions-in-windows-10/',
     },
+    {
+      name: 'Apps and services with access to your Google account',
+      url: 'https://myaccount.google.com/permissions',
+    },
+    {
+      name: 'Apps and services with access to your Facebook account',
+      url: 'https://www.facebook.com/settings?tab=applications',
+    },
+    {
+      name: 'Apps and services with access to your Twitter account',
+      url: 'https://twitter.com/settings/applications',
+    },
   ],
 };

config/browsers.js

@@ -2,6 +2,8 @@ export default {
   id: 'browsers',
   title: 'Use a privacy-first web browser',
   description: `You should use a web browser that protects you from tracking, fingerprinting, and unwanted advertisements.
+
+  Modern browsers have made it simple to transfer your bookmarks and preferences in order to reduce switching pains.
     `,
   apps: [
     {
@@ -60,5 +62,15 @@ export default {
       url:
         'https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/',
     },
+    {
+      name: 'How to protect yourself from browser fingerprinting',
+      url:
+        'https://www.comparitech.com/blog/vpn-privacy/what-is-browser-fingerprinting-how-to-protect-yourself/',
+    },
+    {
+      name: 'Browser fingerprinting, and why they are so hard to erase',
+      url:
+        'https://www.networkworld.com/article/2884026/security0/browser-fingerprints-and-why-they-are-so-hard-to-erase.html',
+    },
   ],
 };

config/carrierPin.js

@@ -1,11 +1,11 @@
 export default {
-  id: 'simPin',
-  title: 'Set up a carrier SIM PIN',
-  description: `SIM hijacking is a method where a hacker can socially engineer or bribe a mobile carrier to transfer your phone number to a SIM card the hacker owns.
+  id: 'carrierPin',
+  title: 'Set up a mobile carrier PIN',
+  description: `SIM hijacking is a process where a hacker socially engineer or bribe a mobile carrier to transfer your phone number to a SIM card they own.
   
-  \n\nIf you use text messages as a two-factor authentication method, this gives hackers the ability to bypass 2FA and in most cases reset your passwords completely.
+  \n\nIf you use text messages as a two-factor authentication method, this gives hackers the ability to bypass 2FA and in most cases the ability to reset your passwords completely.
   
-  \n\nYou should enable a carrier security PIN that is required before any SIM transfers can be processed.`,
+  \n\nYou should enable a carrier security PIN. This PIN will be used before a carrier can make changes to your SIM cards or mobile account settings.`,
   resources: [
     {
       name: 'SIM swap attacks and what you need to know',

config/creditFreeze.js

@@ -1,11 +1,11 @@
 export default {
   id: 'creditFreeze',
   title: 'Freeze Your Credit',
-  description: `If you live in the United States, you should safely assume that hackers have access to your credit report, social security number, address history, and personal contact information. It is important that hackers with this knowledge are not able to impersonate you in order to open new lines of credit or make large purchases.
+  description: `If you live in the United States, you should safely assume that hackers have access to your credit report, social security number, address history, and personal contact information. It is important that hackers with this knowledge are not able to open new lines of credit or make large purchases in your name.
   
-  \n\nYou should enable a freeze on all credit report checks at the three major credit bureaus. Any time you want to open your own line of credit or make a credit-backed purchase (for example, the iPhone Upgrade Program), you can add a time-blocked "credit thaw" that will allow legitimate credit checks to be processed.
+  \n\nYou should enable a freeze on all credit report checks at the three major credit bureaus. Whenever want to open a new line of credit or make a credit-backed purchase (for example, the iPhone Upgrade Program), you can create a "credit thaw" that will allow legitimate credit checks to be processed within a predetermined amount of time.
   
-  \n\n**Ensure that you enable a freeze at all three credit bureaus**`,
+  \n\n**Ensure that you enable a freeze at all three credit bureaus.**`,
   resources: [
     {
       name: 'FTC Credit Freeze FAQs',

config/data.js

@@ -1,7 +1,7 @@
 import passwordManager from './passwordManager';
 import strongDevicePasscode from './strongDevicePasscode';
 import twoFactor from './twoFactor';
-import simPin from './simPin';
+import carrierPin from './carrierPin';
 import creditFreeze from './creditFreeze';
 import encryptedHardware from './encryptedHardware';
 import dns from './dns';
@@ -12,12 +12,13 @@ import email from './email';
 import appPermissions from './appPermissions';
 import socialMedia from './socialMedia';
 import phishing from './phishing';
+import webcam from './webcam';
 
 export default {
   passwordManager,
   strongDevicePasscode,
   twoFactor,
-  simPin,
+  carrierPin,
   creditFreeze,
   encryptedHardware,
   dns,
@@ -26,6 +27,7 @@ export default {
   searchEngine,
   email,
   appPermissions,
+  webcam,
   socialMedia,
   phishing,
 };

config/dns.js

@@ -1,9 +1,9 @@
 export default {
   id: 'dns',
   title: 'Use 1.1.1.1 for DNS resolution',
-  description: `DNS (Domain Name Servers) are the internet's equivalent of a phone book. They translate a name like 'google.com' into an IP address. By default DNS is slow and insecure.
+  description: `DNS (Domain Name Servers) are the internet's equivalent of a phone book. They translate a name like 'google.com' into an IP address. By default DNS is slow and insecure. Many internet service providers track and log data that flows through DNS, in some cases reselling this data to advertisers.
 
-  \n\nCloudflare has released a privacy and performace-focused DNS tool that protects your internet traffif from prying eyes. It's faster than an average DNS service as well, making it faster to use the internet.
+  \n\nCloudflare has released a privacy and performace-focused DNS tool that protects your internet traffic from internet service providers and people snooping on public Wi-Fi networks. 1.1.1.1 is faster than the average DNS service as well, making it faster to use the internet.
     `,
   apps: [
     {

config/encryptedHardware.js

@@ -1,9 +1,9 @@
 export default {
   id: 'encryptedHardware',
-  title: 'Encrypt Your Phones and Computers',
-  description: `If your phone or computer is ever stolen, hackers can attempt to read the data directly off of the hard drive or storage mechanism. If your device is unencrypted, hackers will have access to all of your stored data.
+  title: 'Encrypt your devices',
+  description: `If your phone or computer is ever stolen, a thief may try to read or export your personal data. If your device is unencrypted, hackers will have access to anything stored on that device, including photos, emails, documents, and contacts..
   
-  \n\nYou should enable encryption on every phone and computer you use.`,
+  \n\nYou should enable encryption on every phone and computer you use. Encrypting your devices makes it nearly impossible for a thief to read your data without having your encryption password.`,
   resources: [
     {
       name: 'Why you should encrypt your computer',

config/passwordManager.js

@@ -1,10 +1,10 @@
 export default {
   id: 'passwordManager',
-  title: 'Password Manager',
-  description: `A password manager helps you set unique passwords for each service you use. Having a unique password ensures that if one service you use is hacked, the leaked password won’t allow access to all of your accounts.
+  title: 'Use a password manager',
+  description: `A password manager helps you create a unique password for each online service you use. Having a unique password ensures that if one service you use is hacked, the compromised password won’t allow access to all of your other accounts.
     
-    \n\nAt the very minimum you should have a unique password for high-value accounts like a Google account, email applications, an Apple ID, and financial accounts.
-    `,
+    \n\nAt the very minimum you should have a unique password for high-value accounts like Google, Apple, email, and banking accounts.
+  `,
   apps: [
     {
       name: '1Password',
@@ -43,5 +43,14 @@ export default {
       url:
         'https://motherboard.vice.com/en_us/article/59yv5x/how-password-managers-work-and-why-you-should-use-one',
     },
+    {
+      name: 'Password managers compared',
+      url:
+        'https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/',
+    },
+    {
+      name: 'Find out if your passwords have been hacked',
+      url: 'https://haveibeenpwned.com/',
+    },
   ],
 };

config/phishing.js

@@ -1,7 +1,13 @@
 export default {
   id: 'phishing',
   title: 'Educate yourself about phishing attacks',
-  description: `asdf`,
+  description: `Phishing is an attempt to obtain sensitive information (like an account password) by disguising as a trustworthy person or company. Phishing often occurs via email where a hacker will use social engineering to convince someone to click a link that goes to a fake login page. The fake login page then sends anything the victim types (including usernames and passwords) to the hacker.
+  
+  \n\nIn recent years phishing attacks have become increasingly sophisticated and hackers are learning to use data that people put on the web to create highly specific and targeted attacks. 
+  
+  \n\n**Smart people are not immune to phishing.**
+  
+  \n\nYou should learn the basics of phishing and how to identify a phishing attempt.`,
   resources: [
     {
       name: 'Podcast: What kind of idiot gets phished?',

config/searchEngine.js

@@ -1,7 +1,7 @@
 export default {
   id: 'searchEngine',
   title: 'Use a privacy-first search engine',
-  description: `You should use a search engine that protects you from tracking, fingerprinting, and unwanted advertisements.
+  description: `You should use a search engine that protects you from tracking, fingerprinting, and unwanted advertisements. DuckDuckGo is a privacy-first search engine that does not store your search history, has strict location and personalization permissions, and publishes regular content teaching people how to be more safe on the web.
     `,
   apps: [
     {
@@ -23,6 +23,15 @@ export default {
       name: 'DuckDuckGo Privacy',
       url: 'https://duckduckgo.com/privacy',
     },
+    {
+      name: 'About DuckDuckGo',
+      url: 'https://duckduckgo.com/about',
+    },
+    {
+      name: 'DuckDuckGo: No, we’re not using fingerprinting to track you',
+      url:
+        'https://techcrunch.com/2019/01/07/duckduckgo-browser-fingerprinting/',
+    },
     {
       name: 'Everything Google knows about you',
       url: 'https://myactivity.google.com/myactivity',

config/socialMedia.js

@@ -19,11 +19,11 @@ export default {
       url: 'https://www.facebook.com/settings?tab=location',
     },
     {
-      name: 'Facebook face recognition',
+      name: 'Facebook face recognition settings',
       url: 'https://www.facebook.com/settings?tab=facerec',
     },
     {
-      name: 'Your Facebook data',
+      name: 'Your Facebook information',
       url: 'https://www.facebook.com/settings?tab=your_facebook_information',
     },
     {

config/strongDevicePasscode.js

@@ -1,7 +1,7 @@
 export default {
   id: 'strongDevicePasscode',
   title: 'Create a strong device passcode',
-  description: `A four-digit passcode for your phone or other devices is no longer an acceptable security practice. You should be using a 6+ digit passcode at the very minimum, and for extra security use a 6+ character passcode containing both numbers and letters.`,
+  description: `A four-digit passcode for your phone or other devices is no longer considered secure. You should use a 6+ digit passcode at the very minimum, and for extra security use a 6+ character passcode containing both numbers and letters.`,
   resources: [
     {
       name: 'How long it takes to break a passcode',
@@ -12,7 +12,7 @@ export default {
       url: 'https://support.apple.com/en-us/HT204060',
     },
     {
-      name: 'Setting up an Android passcode',
+      name: 'Changing your Android passcode',
       url: 'https://phandroid.com/2014/03/20/android-101-lock-screen/',
     },
   ],

config/twoFactor.js

@@ -1,13 +1,13 @@
 export default {
   id: 'twoFactor',
-  title: 'Two-Factor Authentication (2FA)',
-  description: `Two-factor authentication is an extra layer of security on top of passwords. It ensures that someone logging into an account is who they say they are by requiring an extra piece of information besides the account password.
+  title: 'Use two-factor authentication',
+  description: `Two-factor authentication (2FA) adds an extra layer of security on top of passwords. It ensures that someone logging into an account is who they say they are by requiring an extra piece of information besides the account password.
     
     \n\nThis extra information is usually either something you know, something you have, or something you are - for example, a biometric signal like FaceID.
     
     \n\n**You should not use your phone number as a two-factor method.**
     
-    \n\n2FA should be installed on accounts that can lock you out of other accounts: e.g. a Google account, email applications, an Apple ID, and financial accounts.
+    \n\nAt minimum 2FA should be installed on accounts that can lock you out of other accounts: e.g. a Google account, email applications, an Apple ID, and financial accounts. For stronger security, ensure that 2FA is enabled on every service you use that supports it.
     `,
   apps: [
     {

config/vpn.js

@@ -1,11 +1,22 @@
 export default {
   id: 'vpn',
   title: 'Use a VPN',
-  description: `A VPN, or virtual private network, is a useful tool to secure an internet connection. It guarantees that that data you are sending and receiving is encrypted, preventing people from snooping on your traffic.
+  description: `A VPN, or virtual private network, is a useful tool to secure an internet connection. It guarantees that data you are sending and receiving is encrypted, preventing people from snooping on your traffic.
 
-  \n\nYou should use a VPN provider that you trust to not harvest and re-sell your data. The best VPNs often charge a monthly subscription - this is a good thing, because it means their business model is not reliant upon aggregating and reselling data.
+  \n\nYou should use a VPN provider that you trust to not harvest and re-sell your data. The best VPNs often charge a monthly subscription - this is a good thing, because it means their business model is not reliant upon reselling your data to advertisers.
     `,
   apps: [
+    {
+      name: 'IVPN',
+      image: '/static/img/ivpn.jpg',
+      url: 'https://www.ivpn.net/',
+      sources: {
+        windows: 'https://www.ivpn.net/apps-windows',
+        macos: 'https://www.ivpn.net/apps-macos',
+        ios: 'https://www.ivpn.net/apps-ios',
+        android: 'https://www.ivpn.net/apps-android',
+      },
+    },
     {
       name: 'Encrypt.me',
       image: '/static/img/encrypt-me.jpg',
@@ -18,17 +29,6 @@ export default {
           'https://play.google.com/store/apps/details?id=com.stackpath.cloak',
       },
     },
-    {
-      name: 'IVPN',
-      image: '/static/img/ivpn.jpg',
-      url: 'https://www.ivpn.net/',
-      sources: {
-        windows: 'https://www.ivpn.net/apps-windows',
-        macos: 'https://www.ivpn.net/apps-macos',
-        ios: 'https://www.ivpn.net/apps-ios',
-        android: 'https://www.ivpn.net/apps-android',
-      },
-    },
     {
       name: 'ExpressVPN',
       image: '/static/img/expressvpn.jpg',

config/webcam.js

@@ -0,0 +1,17 @@
+export default {
+  id: 'webcam',
+  title: 'Cover your webcam',
+  description: `You should add a webcam cover on your laptop and desktop computers. In the case that your webcam light indicator breaks, or a hacker is able to turn on your camera without triggering the indicator light, a cover will keep you hidden from view.
+  `,
+  resources: [
+    {
+      name: 'Webcam covers (3 pack) on Amazon · No affiliate link',
+      url:
+        'https://www.amazon.com/0-027in-MacBook-Smartphone-Protecting-Security/dp/B077ZT29P2/ref=sr_1_4?s=pc&ie=UTF8&qid=1547412984&sr=1-4&keywords=webcam+cover',
+    },
+    {
+      name: 'Related watching: Black Mirror "Shut Up and Dance"',
+      url: 'https://en.wikipedia.org/wiki/Shut_Up_and_Dance_(Black_Mirror)',
+    },
+  ],
+};

pages/index.js

@@ -3,6 +3,7 @@ import * as React from 'react';
 import Page, { SectionHeading, Heading, Subheading } from '../components/Page';
 import type { GetInitialProps } from '../types';
 import Checklist from '../components/Checklist';
+import ShareButtons from '../components/ShareButtons';
 
 class Index extends React.Component<{}> {
   static async getInitialProps({ res }: GetInitialProps) {
@@ -19,13 +20,15 @@ class Index extends React.Component<{}> {
     return (
       <Page>
         <SectionHeading>
-          <Heading>Improve your online privacy and security</Heading>
+          <Heading>Be safe on the internet.</Heading>
           <Subheading>
-            The follow resources are designed to improve everyday people’s
-            security and privacy while using the internet.
+            An open source collection of resources designed to improve your
+            online privacy and security.
           </Subheading>
         </SectionHeading>
 
+        <ShareButtons />
+
         <Checklist />
       </Page>
     );