Tag Info

New answers tagged

0

I'm not a expert, but since nobody said the magic word " encryption " here yet, i will write this answer. It seems to me that what you want is to prevent NSA to get the hands on your communications data, but you are looking the wrong way, you must trust only the encryption algorithm that make the data secure and private and nothing more, you should aim to ...


2

When you send emails in your scenario, you announce the IP of your custom, private email server. Every recipient, and any interested party, now knows you use your own email server and where it is. This results in a one-to-one mapping of this server and your connection to it. If a government agency wants to track you down, all they need to do is to look for ...


8

Rent VPS (even better: home server) & Domain (May take up to 2 days, who cares..) How many ISP do not provide law enforcement access to their sites and to the systems they provide for their customers? And with a home server: lots of sites explicitly deny access to their mail server from a "home" IP address (these are known address blocks), in ...


-2

Even though Apple products like Mac are considered as ‘apple of the eye’ of the computing world, cybercrime appears to give little tolerance to such products and services. The rising incidents of cybercrime, data theft, data breach, malware attacks and more have troubled computer users around the world, including Mac OS X users. That is the reason why the ...


2

You might try a syllable hash. Start with a basic hash algorithm to digest individual data identifiers; it doesn't really have to be crypto-strength, and I'd recommend against. Most implementations will produce a byte array which is perfect; a few will produce a single larger primitive or arrays of larger primitives in which case you'll want to split them ...


3

The same exact rules apply to webcams as in the thread you referenced. If you put your webcam on an obscure port (not just 8080 or a common variant) then Shodan will not find it while crawling. If you keep your webcam protected from anonymous access (set unique user/pass settings for all accounts on the cam) then outsiders will not be able to see it even ...


0

What are you trying to achieve? Do you want to anonymize a database with sensitive data in order to be able to give it away safely to an external QA test team without compromizing the content? In this case, anonymizing the person and firm names is not sufficient, because the rest of the data has a footprint as well which allows to draw conclusions to the ...


2

Short answer: NO, if you are sure you are using end to end encryption, and MOST LIKELY NO, if you aren't using end to end encryption. Whatsapp uses encryption two ways: first it has an "outer layer" built by TLS, which has ben analyzed thoroughly by the security company Praetorian in February 2014, with almost all issues pointed out being fixed within a ...


2

OPM has released statements offering credit protection and advice on how to respond. Phishing e-mails were listed as one of their concerns. Their recommendation was to use anti-phishing plugins to your web browser to help identify phishing e-mails and keep your systems patched. For the layman, that's probably the best you can do. I believe it's important to ...


0

One resource I like specifically for journalists is EFF Surveillance Self-Defence (https://ssd.eff.org/en/playlist/journalist-move) Their resources come in parts, simplified it looks like this: Threat modelling. - Who is likely to be interested in monitoring your or uncovering your identity. How to communicate with others. - Voice, e-mail, Text Messages, ...


1

(PS: This post is just a general discussion. I am in no ways enticing anyone to commit any crime!) In order to be anonymous you really have to consider other things too, other than just using some tools while browsing the internet. Tor or VPN might help you to anonymize your identity online but have you considered being anonymous in your real(Offline) life. ...


0

Anyone looking at your internet activity can tell if/when you are using Tor: ISP, employer, etc. You can block them from seeing that you are using Tor by turning on your VPN first then connecting to Tor.


0

I have also read that if a person has your IMEI number they can easily hack into your WhatsApp account, if they also have your phone number, since the IMEI is viewed as the password for WhatsApp. This is basic FUD. WhatsApp works over TCP and doesn't have anything to do with the phone network. You could run WhatsApp over Ethernet from your home network. ...


0

The certificate has since been fixed by live.com. Previously, the error was only shown after login. As the certificate was not expired, I suspect the transition from http to https didn't meet the standards of HSTS. In any case, I have determined the issue to be consistent across popular browsers and OS, even email accounts. Seems like it's a server side ...


2

I'm not a lawyer, nor do I play one on TV. (you might want to consult a real one who specializes in this type of thing) It seems to me that if you are just reviewing a product and giving your honest opinion then that is freedom of speech. HOWEVER, if they have the resources and the will to do so, they can easily make at least some part of your life ...


0

I would say; A generate a pseudo random token encrypt using the word as the key send result B decrypt generate next token using predefined method encrypt it send it back A decrypt check received token (now A has authentificated B) if not ok then stop here generate next token encrypt it send to B B decrypt check With this you don't have ...


0

Assuming the cert chain is actually valid, it looks like its for bing.com instead of the *.mail.live.com domains. I'd be surprised if anything malicious is going on, but more likely a bad DNS entry, poorly configured certs by Microsoft, or potentially just one part of the browser not realizing another part of the browser is redirecting to the configured ...


1

TCP fingerprinting doesn't really help you identify a client. When we talk about TCP fingerprinting, we're talking about the configuration details that, taken together, help identify the habitual configuration of an OS. Different OSes have different default TTL values, for example. You're asking about identifying non-habitual (unique) aspects of TCP ...


0

I just found a open-source extension for firefox RAS since it's open source you can dig into the code and port it to any platform should you want... I've tested this plugin for a time for Firefox and as long you don't spoof mobile browsers on pc, and pc browsers on phones you should be OK. No problems so far, except when the extension randomly choose to ...


2

Tor could be a solution for you, if you could compromise some of the browsing speed. Tor tries to implement many countermeasures for your anonymity theft. I would recommend that just using Tor is not enough please read the Tor FAQ for further details. Update: Apart from that I would say you have to change your browsing habits too in order to stay ...


0

@raz is right, but would add: The DNS requests could be resolved on the company network, so the network admins can see you want the address of www.example.com, even if the traffic later is not routed through their network. (you can set up your VPN to so that the 'resolver' is on the other side of the tunnel, then the company can no longer see the DNS ...


-1

Hashing is definitely the way. If brute-forcing is an issue then there is no secure way to do this, as any algorithm which compares two 5-letter strings and returns equivalence could be trivially brute-forced in a maximum of 26^5=11881376 comparisons. The only feasible way of defending against brute-forcing in such a low-entropy environment is to use a ...


2

The most likely case is that the VPN is setup to only send traffic to/from the private network's subnet. So normal web traffic would go through your normal network interface. While going to fileshare.company.net will resolve to a private network that is only reachable through the VPN. Most companies don't want/force all of an employee's traffic through ...


5

Sign out of Junos to keep your traffic off their network, there is no need to uninstall the VPN client completely. If you had signed in to Junos, it was routing all your network traffic through their VPN. Although you were on your own Wifi, when you logged in to Junos, it would have redirected all your traffic into their VPN. There is a chance that they ...


1

Consequences depend on, who do you want do prevent from tracking you: adversiters and small/poor site owners - sleep safe. big site owners, that can afford Big Data (eg. Yahoo) - they can time-correlate your visits, but rather for statistics, UX analysis etc., than personally. local Police or other local forces - they can possibly deanonymize you, but ...


4

The problem you are asking about is called the Socialist Millionaire problem and has been discussed in research before; as far as I know there is a protocol to do this comparison without disclosing any of the two secrets and without involvement of a third party. I will edit my answer with a full explanation as soon as possible.


0

If somebody else has control of the WiFi access point onward or you're using a shared authentication key then there's very little you can do to ensure that you're not subject to an eavesdropping attack. Somebody with the same credentials who catches the initial association packet will be able to read all further session traffic. If in doubt, you can route ...


4

I haven't studied this specific vulnerability, but from the points you mention I should note: Cross-Frame-Options is not used too much on websites. Although this SOP vulnerability is dwarfed by X-Frame-Options, two months before there was another one where it didn't seem to matter. Most outdated phones where you will be able to exploit one of them, most ...


2

A formal proof might only be made against a formal specification. In other words: you cannot mathematically prove that a software matches a behavior if you are not able first to mathematically define this behavior. I have serious doubts that a general concept such as "anonymity" or "privacy" may be formally specified, and therefore that they can be formally ...



Top 50 recent answers are included