Jamie and I had a great cryptoparty last week at the Fields Corner branch of BPL. The flower of our conversation might be instructive for this month's “Train the Trainer” session.

For context: We were joined by a librarian and three older women, who meet regularly as a reading group. They did not have any expertise in technology.

We started the conversation by loading the Norse real-time attack map. We did this to communicate that, if they didn't already know (!), the internet is not a safe space. There are concerted efforts to compromise networks and identities going on all the time. 

Because a few of the attendees had personal experience with phishing attacks, we talked about how to hover over a link with your cursor to check the path. Close reading and attention to URL length can save you from many attacks. Similarly, if you are downloading a file from e-mail, you can hover over the attachment and see the attachment's file extension. File extensions like .exe, .bat, .dll should be avoided! What are people phishing for, anyways? Bank accounts. Personal information. Usernames and passwords. &c &c.

We moved into a discussion of passwords – er, passPHRASES. The XKCD comic was great, if only to broach the fact that it's not individual humans trying to guess your password, but automated programs that query against dictionaries and tables of known passwords. We talked about salting, 2FA, and about not using the same password for multiple accounts.

That was the first 45 minutes of the cryptoparty. During the last 45 minutes we talked about threat modeling and a bit about encryption via HTTPS. I'd say the transition to talking about encryption needs work (Jamie, whadya think?). It's a crucial topic but very difficult to grasp intuitively at first. 

Scared straight, the group wondered about how they might audit their computers to know if they'd been compromised. We suggested running anti-malware programs on the reg (recommended AVG as a free alternative, but what else do you all recommend?). We also walked through opening up the task manager and reviewing what processes are running at any given time. Right clicking was a new feature for most of the group. And we might have accidentally found some malware on the library computer, spoofing as the csrss.exe program(!).

A good time. Looking forward to this month's party! 

Andrew

[:boston|https://www.cryptoparty.in/boston]