Digital security
Start here
A guide on digital safety for women and girls, from Afghan Witness · Centre for Information Resilience. Practical guidance for women and girls in Afghanistan on protecting their devices, accounts and privacy.
EFF’s Surveillance Self-Defense
Guides to protecting your accounts, choosing privacy tools and making a security plan.
Make yourself a smaller target
Your attack surface is all the ways someone could reach your devices, accounts or information. Unused apps, unnecessary permissions and forgotten sign-ins can leave extra ways in.
Keep the access you need and remove what you do not. The less you leave exposed, the smaller the target.
Big target
Unused accounts, unnecessary permissions, widely shared details.
Smaller target
Only the accounts, permissions and sharing you need.
Review your apps
Remove apps you no longer need, after checking whether they hold anything you want to keep.
Limit permissions
Give apps access only to the photos, location, contacts or microphone they need for the features you use.
Check linked devices
Review devices connected to your accounts. Remove access you no longer use, when it is safe to do so.
Further guidance: EFF’s app and permission guide and Signal’s linked devices.
Our security is connected
A learning community is a network of people, accounts, devices and shared spaces. Each point is a node. The connections between them allow us to communicate or share access to a class chat or folder.
Security is both individual and shared. Protecting your account also helps protect the conversations and information others share with you.
Broad access
Access to both classes and the team’s files.
A compromised account could expose information from all three.
Limited access
Access to the class this person needs.
Class A is still exposed. Class B and team files are outside this account’s access.
How a compromised account can affect others
Someone who takes over an account may read information it can access or send messages in its name. Other people’s information could be exposed even while their own accounts remain secure.
A convincing message from that account could lead someone else to share information or give access. Being in the same chat does not, by itself, infect another device or break the app’s encryption.
Limit how far the damage can reach
- Share access by need. Keep class spaces and staff records separate, and give administrator rights only where needed.
- Check unusual requests. Contact the person through another method you already know and trust before sharing information or granting access.
- Review access together. Check group members, linked devices and shared links, especially when someone’s role changes.
Further guidance: EFF’s security planning guide, recognising phishing and Signal’s group controls.
Protect your devices and accounts
Think about what you need to keep private, who could access it and which changes you can make safely.
Think about access to your device
Consider who can unlock your phone, read notifications or use a linked computer. Use a strong device passcode and review lock-screen previews. Choose changes that are safe for your circumstances.
Protect your accounts
Use a different, strong password for each account and enable two-step verification where available. Keep recovery details somewhere safe. Never share login codes, passwords or recovery keys.
Keep software up to date
Install device and app security updates. Get apps from official sources. Be cautious with unexpected files or messages asking you to install something.
Pause before opening a link
Urgent requests can be misleading, even when they appear to come from someone you know. Check unexpected messages through a contact method you already trust before signing in or sharing information.
Care for each other’s privacy
Avoid sharing another learner’s name, number, photo or messages without permission. Review group members and linked devices. Treat group invitations and class conversations as private.
Why we use Signal
Privacy depends on more than the words in a message. Information about an account or group can matter too. This surrounding information is often called metadata, and services collect and retain different amounts of it.
Signal
Signal encrypts messages and is designed to retain very little user information. It says it cannot access group information, contacts or message content. Its published government-request responses show how little it can provide.
Signal’s explanationWhatsApp also uses end-to-end encryption for personal messages and calls. It collects some account and service information and says it may share available information in response to valid legal requests. Encryption does not mean a service holds no data.
WhatsApp’s explanationNo messaging app makes you anonymous or protects a message from someone who can read an unlocked device. Recipients can copy or photograph messages, including disappearing ones. Review who has access to your device and conversations.
What disappearing messages can and cannot do