Schneier on Security

Carol Bainbridge • May 23, 2016 9:37 PM

@Ivanna Humpalot

Nice list, thanks. Why do you recommend OpenVPN however? Isn’t it establishment propriety closed source evilware? It comes with a purchased computer so surely its owned? and, we known NSA has broken VPN’s to a certain degree.

And question: what do you mean by ‘Don’t alternate Tor with open wi fi’ and what is the security risk you are suggesting?
risk of breaching IP anonymity ?

I love idea of Firefox having a Tor button thus opening it up to everyone. Currently it’s the other way around – Tor riding on Firefox

@ Clive Robinson
Audio fingerprinting, while ineffective it’s another data point. Keeping microphone disabled in settings should already be usual for readers of this blog?

@ in general everyone
Firefox. There’s a google pref cookie which checks everything against google databases. There are ad-ons like Decentraleyes which seek to subvert redirects to or through google in general.
As for fingerprinting Random Agent Spoofer ad-on which gives random browser configs to subvert profiling.
Firefox appears to receive a great deal of advertisers money and lots of google funding. It is by far the most configurable however.

Firefox phones home and leaks data officially and unofficially in a myriad of ways. This can be corrected in about:config
Below is a user pref file one can install or manually adapt which
alters hundreds of settings in about:config to make firefox light years ahead of default settings as far as privacy and security goes.
The official update is Jan 16 but there are more recent unofficial ones. A lot of work by the below crew has gone into refining and assessing how to constantly improve about:config toward a more private ‘hands off’ experience. There are also some hidden settings not visible in about:config. Mozilla won’t make them known to any but their most intimate cabal. Some have been worked out,and with the right key words they can be altered in about:config. Some appear in the list below. Needless to say they seem to relate to privacy concerns

http://blog.ffextensionguru.com/2016/01/04/the-ghacks-user-js-firefox-privacy-and-security-list/

Carol Bainbridge • May 24, 2016 2:08 AM

@ Ergo Sum

nice response
My serious question is ‘where does the telemtry come from?’
my non serious addition was going to be ‘is it from the microchips in my brain direct to satellite link?’
so, yes where does the telemetry come from and how does one beat it?
If it’s hardware like a 3G connection hidden in intel chips, which aside from using a faraday cage or an underground carpark there isn’t much one can do about (no one has mentioned checking this with a RF meter however – you would need a fairly expensive sensitive one. Anyone tried, to prove or disprove this?)
In response to a recent comment, am amused by the idea that microsoft created a free ‘no windows 10’ malware upgrade designed as free ware, to force people to adopt the windows 10 malware that is being forced upon them.
otherwise, I know people are using older windows like 7, and removing all the updates by code number that relate to telemetry – lists are available of the dodgy ones.
@ Ergo, I am genuinely interested by the source of ‘your’ telemetry. Incidentally, I noted in the firefox about:config list I referred to, there are explicit ‘telemetry’ settings that need to be turned off manually

Here’s the thing. Unlike everyone else on this blog, I am a non-smart non security profesional that only understands a portion of what I read here. When I read the sophisticated design models for
attempting to improve upon security I start getting a contracted feeling and a sore brain – not from things I don’t understand – but from the suspicious minded approach, trying to cover every single possible hole, trying trying trying. When it really isn’t relevant for my circumstances – like that of most people. No corporate secrets or whistling documents.

The wonderful very smart people here are discussing how to amp up security from a, say 93% level, and are wondering ‘how do I add an extra 1.2%?’ and it makes my head hurt. What I find, in these kinds of discussions, is there no little regard for the level of threat model. People think in an absolute worst case scenario operating at super super high end level of security, when if it was drummed down by about 30% it might actually be practical, realistic, accessible, easy to use and able to be implemented mainstream. So, I write here as an outsider because I get that people here may have a need for the ultra high end security
If we put aside a targetted attack against a person or company of interest (Whether it be state level or private actors perpetrating the attack) for most people most of the time the issue is dragnet surveillance. Finding ways to reduce the attack surface for most people most of the time is what doesn’t make my brain hurt – so long as I don’t start trying to cover every single tiny little hole in the bucket – because I know I don’t have the time, the inclination, the patience, the et cetera, to study the intricate methods that Ivanna Humpalot detailed. Hell, Bruce doesn’t even use Linux.

What exactly are you trying to protect – well if you are not the next Edward Snowden, and don’t have military grade(sic) secrets, then getting yourself up to for example 60% ( instead of the %95 suggested above) is still going to be pretty good against dragnet surveillance and have a basic foundation of privacy we are all entitled to online, but don’t currently have.

while we can feel sorry for princeton, being an elitist precious white male establishment and all that (joke from a non-US person is that okay) what is relevant in these studies (aside from what appears to be slightly non realistic methodology) is how they apply to the bulk of the population. everyones being spied upon. That is important. Snowden said the NSA ride upon the back of corporate third party trackers , so if you use a blocker that will give you an extra step ahea
i don’t have anything to protect so secret I need to refer to the famous cartoon that compares heavy encryption with a $5 wrench for an outcome
if I’m an everywoman, and I want to stop being low hanging fruit, i know that 100% is impossible unless your name is Clive Robinson, and going from %95 to %97.5 makes your brain burst a vessel..
We need to consider what the global human population deserves. Whats the %65 solution? We accept email is broken. I am thrilled that Proton Mail has become available, and sorry that there’s been no mention of it on this blog for years. Why not? Are people here using Proton Mail?
It’s finally ticked every box (Again, provided ones hardware is not targetted personally) and made zero knowledge encryption easy and available. they have proven their street cred. if you read through their web site you have to agree they’ve done a really good job. Impressive non? Last year they were hit by some of the largest DDos attackss ever, only a state level actor could really be capable of that. And they raised the money to protect against it happening again. And they explained the mechanisms they are now using as a result. they are being really public about virtually everything.
one of the admins admitted to me they have been received DDos fairly regularly ever since their recent public launch but won’t give the attackers the satisfaction of giving them publicity on social media.
if you think about all the general problems, and theres a long list, with end to end zero knowledge public encryption ‘for the masses’ being the operative word, proton mail have covered every one of them. we need to think about what we can do for humanity at large, short of unplugging completely. sorry for the long post