Tag Info

Hot answers tagged

65

Rent VPS (even better: home server) & Domain (May take up to 2 days, who cares..) How many ISPs do not provide law enforcement access to their sites and to the systems they provide for their customers? And with a home server: lots of sites explicitly deny access to their mail server from a "home" IP address (these are known address blocks), in ...


42

As someone who has actually done this for a couple of years, I can tell you that it's not nearly as simple as you're describing and it doesn't offer the security properties you want. In summary: Why do so many security experts (i.e. cryptologists & co.) not host their own email? Because it takes enormous amounts of time and specialized knowledge ...


22

The hostname is transmitted in the clear. This is because HTTPS is a tunnel established after a connection to the server. The hostname is available for an eavesdropper to snoop in a number of ways: You will perform a DNS lookup and that is always in the clear; There is a TCP connection to the IP address returned by the DNS for google.com; In the case of ...


16

When you send emails in your scenario, you announce the IP of your custom, private email server. Every recipient, and any interested party, now knows you use your own email server and where it is. This results in a one-to-one mapping of this server and your connection to it. If a government agency wants to track you down, all they need to do is to look for ...


10

There speaks someone who has never run their own email. You don't mention an inbound antispam solution. DKIM and related techniques are for authenticating your own mail as not spam and making it deliverable. (Deliverability is the main barrier against home hosting: most providers block port 25 and many mail recipients block all ranges known to be ADSL). But ...


10

Short answer, it's not the easiest solution. " it's very easy to set up a self-hosted email server" You are wrong, the rest is wrong because it's based on this. I assume you imply it's easy to set up a safe server (otherwise, what's the purpose of it all?). Your laundry list of what you need is long, and not even so it is complete. It's much easier ...


9

You can find a possible explanation on the Google Support pages regarding the "Recent Activity" option: "If you're using Mail Fetcher with another Gmail account, a Google IP will appear; this is simply because the messages are being fetched through our servers." Edit: To answer your comment: I would not call Gmail insecure. For the average user, they are ...


5

I live outside the US so I'm not sure exactly how SSNs are normally used, but it sounds like they're using these details as a key to look you up in an external identity verification service. This isn't too uncommon in relation to property rentals seeing as most physical rental agencies want scans of your ID, etc. any way. 1) Why do some companies want ...


3

If you ask some company to create some domain for you and several e-mail account with that domain and forward that information to your gmail account...I do not really understand, ANY web developer can check all mails from any client, or Am I missing someting? In a way your question is funny: you fear that the domain provider might intercept and read ...


3

So if she is hijacking your accounts, she must be maintaining some sort of access. Security questions are easy to guess especially if she's your ex. If you haven't changed your password, now's the time to do that too! Use something that she wouldn't know about. The easiest way to solve things is to create 100% new accounts. Google also have "two-factor" ...


3

From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the government one? You can check the certification path to find out which intermediary and root CAs signed the certificate that you are ...


3

Using a strong password and 2FA should be sufficient to prevent those who knew your password from succeeding again. Yes, it is very possible that an attacker would have access to servers around the world to try and log into your account, so that's not surprising at all. It is also possible that your account credentials were sold, posted on a public forum. ...


3

This would be difficult to conceal, for a number of reasons: Most image formats used these days have well-documented formats, and are interchanged between different companies' software, so extra fields would be difficult to conceal Lossless formats (e.g. PNG, GIF) would by definition not allow such modification; in practice it could be done, but it's ...


3

I'm not a expert, but since nobody said the magic word " encryption " here yet, i will write this answer. It seems to me that what you want is to prevent NSA to get the hands on your communications data, but you are looking the wrong way, you must trust only the encryption algorithm that make the data secure and private and nothing more, you should aim to ...


2

In a PGP setup, encryption occurs with the recipient's public key. In SSH authentication, this is (internally) a signature with the client's private key. If Alice sends a message to Bob and also connects to Carol's server, then Alice will use Bob's public key to encrypt, and here own private key (from a distinct key pair) to sign. No problem here. A ...


2

This may not survive as it's a bit off topic for the site, but yeah there's some non-Google Android based options. The best known is likely Cyanogen Mod. This can be retro-fitted to a wide variety of Android devices and removes a lot of the direct ties to Google. Another option to look at is Sailfish OS which whilst it's not Android, has a focus on ...


2

The last 4 of your SSN is considered "public" data. The questions you were asked were part of LexusNexus (http://www.lexisnexis.com/). It's a clearinghouse that businesses and government agencies use to assert your identity. It is a bit disconcerting the things that are in the database, but it is normal. As for the photo ID question, that'll have to be a ...


2

From how I understand what you are asking, the short answer is: Sorry, you can`t do that. If you are at any point handling any data from a client (i.e. an email), then there is simply no way you can prove conclusively to that client that you are not at any point keeping a copy of that data. If you did want to keep the customers data, there would simply be ...


1

Microsoft is able to remotely push code to your machine that will be installed and executed with the system's privileges the next time Windows Update runs (a practical example of this is the new "Get Windows 10" tray icon bullshit that continuously stays running in memory). So, while they definitely won't be doing this on a large scale (eventually someone ...


1

Tor browser prevents somebody watching your Internet connection from learning what sites you visit. It prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked. This statement is valid for Microsoft Windows OS. So to answer bluntly: No. EDIT: Following your comment: As by your machine ...


1

With the few details you have provided, the very general answer is to publish an architecture document that describes at what point you do and do not have access to their information. In this document, you would outline the data flow and the boundaries of your control and where each client's data intermixes (or not). This document is important. Your ...


1

You didn't state the age of the book, but this may refer to a no-longer-produced product called Freedom, produced by a Canadian company that was (at the time) called Zero Knowledge Systems. I was both an early adopter of this product, as well as someone who had engaged in partnership conversations with ZKS, so it was instantly familiar to me. Here's a link ...


1

Pros of OpenVPN: Strong encryption OpenVPN is known for having a strong encryption, which is considerably better against the NSA (National Security Agency). The OpenSSL encryption library supports a number of cryptographic algorithms including the AES which is known for almost no weakness at all. Highly reliable Besides being ...


1

I'm not sure your focus should be so much on hardware rather than software. Of course, a handset made out of completely free hardware will tend to be more secure since the design and therefore it's firmware would be "crowd sourced." Like someone else already mentioned, Cyanogen Mod and other ROM's, preferably ones with the source code readily available are ...


1

Tapping a cell phone is doable, but very difficult, especially for someone who has little tech knowledge, and providers generally do not give the capability to listen in on specific calls either. The bill may show the duration of the call and who the call was made to/from, but generally they wouldn't be able to listen in. Consider each cell phone on the plan ...


1

Your basic premise is flawed, I'm afraid. The same rules apply (in most jurisdictions) to government as companies. They can all typically review their staff emails, browsing habits etc., as the infrastructure is owned by them. If you conduct any company work on your personal device, many companies will have contract terms to allow them to look at the device ...


1

The field of research in privacy is large and wide. Some people care about privacy against Evil Governments. Some care about privacy against Evil Corporations. Some care about privacy against Evil Neighbours. In fact most, if not all, researchers that mind privacy and publish articles about privacy in online communications tend to think in terms of their ...


1

Yes and no. There are examples where such companies analyzed content stored by particular user, where it was a part of eg. criminal investigation. So, yes. However such companies host amount of user data, that manual analysis of everything would by physically impossible, or at least unscalable and horribly expensive. So, if any company would try to ...


1

If this is a criminal issue like child pornography it might well be that the FBI will track down the server and get access to the log files to track down all who watched that video. And these log files usually log IP address, browser, time etc and maybe they will also find information about logged in users and can associated actual user data with the video ...


1

If the action attribute of the form has https://, the data will be encrypted before it is sent to the Hush Secure Forms server. So the issue here is not the encryption. There is however an issue with the fact that the hosting medical site does not use SSL. When an end user views the form, he has no way of knowing whether he is looking at the correct form ...



Only top voted, non community-wiki answers of a minimum length are eligible