New answers tagged

1

What are some reasonable/interesting ideas of ways to address this issue practically? GPG encryption, with steganography to hide the fact that you're using encryption in plain sight. The basic idea you need to avoid mandatory compromise to encryption, is find any data channel that is not blocked and use non-compromised encryption over that data channel. ...


0

You can try to create a SSH tunnel to tunnel HTTPS through it. I guess this post explains how to perform this in an effective way, otherwise you can find a lot of guides on the web explaining how to create a SSH tunnel.


0

Can I know if my mobile phone/computer camera has been hacked? Honestly these days it is not very likely that you will notice a hack unless you are installing from untrusted sources or have rooted (or jailbreak for an Apple device) in which case the sophistication of the malware is not enough to hide all the usual tell-tale signs (slowness, new ...


4

Figuring out if any device has been hacked is an extremely complex subject. In most cases, unless you know precisely what to look for or have weird side-effects of the hack, you may never notice it. Duct tape on camera lens will most definitely prevent anyone from seeing you. You'd obviously need to cover both cameras on a mobile phone. Other than that, ...


1

Q1 It depends on the sophistication of the attack. For a user of the device it would be difficult to perform an after-the-fact analysis, however there are examples of software that warn user in real time that some other software is using the camera. One such commercial solution for Mac is Micro Snitch. But these measures can be disabled by a prepared ...


2

Good webcams have a built-in feature that turns on the light whenever the camera is active specifically so you can't trick someone into thinking the camera isn't recording when it actually is. If it were done securely, that would be entirely in hardware, so that it can't be bypassed with software. Now, as to whether or not that's actually the case, it may ...


3

The need of creation and capturing acknowledgement of the policies depend upon various factors like present or expected to be done in future compliance audit, logging etc. The policies that any organization should take into consideration will be as below acceptable use policy change management policy critical technology usage policy data retention ...


4

I want to begin my answer by saying I work in IT Audit / Security and this answer derives from my profession. I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. This is not only a good idea but essential to protecting your workplace. The benefits for implementing a ...


6

I recommend you to log user id and IP each time someone authenticate. That way, if a user post something, you know where it came from. Having a log like that is also useful for other purposes, like notifying the user in case you identify multiple IPs are connected at the same time, block consecutive attempts, etc. But for your specific example, I think you ...


1

Another idea: You could buy a cheap single-board computer (think Raspberry Pi). The Pi 3 is fast enough to replace a desktop PC if you're only browsing the internet and watching movies etc and costs about $40. It's powered by an usb phone charger cable (or another computer's usb port) and supports hdmi output. It's small enough that you can hide it in a ...


3

Your IMEI is not bound to your IP stack An IMEI number is used to identify a phone and is bound to each individual device, much like a MAC address is unique to a network interface an IMEI is bound to a device. Unlike a MAC address it does not exist in your network stack. IMEI stands for International Mobile Station Equipment Identity. IMEI numbers are ...


1

You might not like this answer, but it seems to me that you are just experiencing confirmation bias - "the tendency to interpret new evidence as confirmation of one's existing beliefs or theories." Due to watching CSPAN, you have the belief that the government would go to extreme measures to spy on you, and due to this you now have a heightened awareness for ...


1

Anyone can create new email accounts with "John1234", and those usernames are considered "public" so you have no control over that. What is more interesting is how the spammer got a hold of the distribution lists. I would highlight the "change password" advice and make sure that proper hygiene is being practiced.


0

Use a hot-swap cage for you hard drive, and remove the hard drive when not in use. Take away with you or keep in a safe place. Such drive can be connected to the usual SATA connection. Unlike with USB, you do not loose your speed and it can be any capacity. The OS can boot from this drive no problem - and they really cannot get anything from your computer ...


6

I see two possible uses for this even with logging disabled: A user violates some other part of the ToS, for example by paying for their account using a stolen credit card. An operator of a website which is targeted by a user's illegal activities contacts the VPN provider, and the VPN provider sees that the connection to that website is still open so it ...


6

Claim to "not log" is not the same as "not monitor connections". First is saving traces, second is analyzing activity when it happens, that does not necessary generates logs. However, while not totally clear, I understand they claim to not monitor too: NordVPN does not monitor, store or record logs for any VPN user. They do not monitor logs (since ...


3

As far as I know, there haven't been leaks or admissions that Skype uses this kind of technology. However, other techniques can be used. First, law enforcement agencies can ask Skype to give them certain data about a Skype account: In response to a subpoena or other court order, Skype will provide: • Registration information provided at time of ...


-3

You're right, if they really do not log anything, it's impossible. There could be two reasons for this: They do actually log something It's just for legal reasons. Personally, I'd be wary of such contradictions, but ymmv.


1

For HDDs, you generally need to overwrite the data several times (with either random data or specific patterns) to completely destroy traces of old data. Otherwise it can be recovered by using advanced data forensic methods. For secure destruction of information stored on the HDDs, the U.S. DoD Unclassified Computer Hard Drive Disposition specifies three ...


2

We have a whole bunch of questions on the difficulty of wiping data from SSD's. You should have a good browse round this site. Simple answer is: By default, SSD's leave more data on the drive. This is because of wear leveling - overwriting doesn't exist as a concept in the same way as on a physical platter. That said, there are known solutions, the most ...


0

My primary PC consists of a passwordless desktop PC, that anyone in the house can use. From this machine I connect to a Windows 10 machine running on Azure. I don't have an issue with anyone installing keyloggers etc (I don't think!) but there are a number of 2 factor authentication options freely available to home users that would make the password for that ...


3

I encountered the following ages ago from somebody who was excessively paranoid: Full disk encryption where /boot was on removable media and the master password had to be entered from a grid display so that the keystrokes that corresponded to the letters of the master password changed every time the computer booted. My personal recommendation involved here ...


9

Just buy a notebook and carry it around with you. If you don't want other people to check your data, don't leave your data near them. If any part of your machine is compromised, everything on your machine is compromised. Hacking hardware is not necessarily expensive and you don't really know how far would this person go to get access to your data. The ...


1

While it might be in theory impossible to prevent an attack given physical access, you can do a lot to limit the physical access to what matters, thus limiting the attack vectors. I think your best option would be a custom Linux boot CD plus an encrypted USB stick for storage. Many distros make creating a custom CD fairly easy, including Arch and Gentoo. A ...


8

Not sure why nobody has mentioned this yet (maybe I don't understand the site that well). Put a camera in your room (one WITHOUT wifi capabilities). Get your linux system set up, casually mention it to your housemates in passing conversation. Record them breaking into your personal computer and reading your information. Have them arrested and fined, use the ...


2

Apart from what others said (Live CD, full disk encryption etc), the following are some precautions. (1) Download your Linux distro on a trusted computer. Don't do that on your Windows system because the ISO image may get replaced/infected/amended secretly. Don't just trust checksums (checksum utilities can be fake, too). (2) Sign on your Live CD/DVD/USB ...


3

I see lots of people mentioning that physical access is game over. While this is true given a well resourced attacker, there is a defence against less well resourced ones: Qubes OS and antievilmaid. https://www.qubes-os.org/ Qubes is essentially Xen running Fedora VMs (you can have other VMs, including Debian and Windows). antievilmaid is a program which ...


12

I like the answers that suggest you run Linux from removable media. It hides the fact that you're taking precautions from your not-so-nice house mates. There's a few problems with it, though, from a practical standpoint. You're sacrificing drive speed and space, but what's more important is that carrying your whole operating system around with you is ...


0

Yes, it is very possible. Your company has multiple ways of monitoring employee activity and traffic that is passing through their network. Depending on the type of company you work for, if they are constantly monitored and audited, etc will have an impact on the likelihood. Of course, this will greatly vary in every company, and it's best to keep browsing ...


20

There's some things to consider that differ from all the answers previously given: what you're looking for is privacy, not security. While they seem very similar, the goals of each are different, and the ways to implement each are different. If you were looking to implement security, you would remove other users' admin access, lock down each users' ...


3

Also, I forgot to mention. If you want to set a BIOS password, and depending on how much hassle you want to go through, you could invest in a case that has a lock for the side. While that wouldn't entirely prevent intrusion, it would prevent people from tampering with it if they didn't want to be detected. That way they can't just remove the CMOS or access ...


3

Other folks had some great ideas. I didn't read down to determine whether or not this was already mentioned, so I apologize if it has been. I know you mentioned you cannot physically lock the door to your room, but how about working solely off of an external hard drive, encrypting it, and locking that up elsewhere, in a lockbox or safe or something like that?...


84

I hate to be this guy, but Law 3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. You are asking how to best lock a plywood door. People are giving you very good suggestions for locks, but none of them matter since your system is physically vulnerable and your attackers are competent. They will just ...


10

You can not secure the system under the conditions in your question. No matter what, with physical access to your machine there is no security. With the exception of the bios password every counter measure on this page could be circumvented by booting into rescue mode (in one form or another). The BIOS password is easy to reset. It's usually a jumper or ...


3

I did some admin-work in the past in a company where past admins didn't leave many notes. But there was hardware that was vital, connected to the networks, and not trustworthy. From that experience I can tell you that the old saying is right: if you have physical access and are determined, game over is only a question of time investment. You can make it ...


5

I would get two USB sticks. The first would have the capability to be set as read-only at the hardware level with password protection, and the second would be either a normal stick or a PIN-enabled stick (but these tend to self-destruct if the wrong PIN is entered a few times, so beware...). Install your operating system on to the first stick, and configure ...


4

This would be my plan of action: Lock down the BIOS by adding a BIOS password to the setup. I would not add a startup password to allow users to use the computer without my supervision. Disable automatic booting from USB, CD and network. Force boot from USB/CD and install Linux with an encrypted home folder and encrypted swap on the hard disk. If possible, ...


65

Depending on the performance you require and money you are willing to expend, a removable "Live USB" or completely bootable normal system on a USB "hard drive" (a small ssd would work great) might be an ideal solution considering your "unique" constraints of needing high security against local attackers. It would allow you to just leave the compromised ...


20

Here is an all inclusive solution since you stated you were not worried about hardware/USB/physical attacks. Install Virtualbox/VMWare/Other on your desktop. Go about creating your guest and put that guest on a removable USB key. When you're done with your work, power off the virtual machine, remove the key, and it's a wrap. There are plenty of other ...


92

Use a strong and difficult password for the root user. Secondly, always login and work from another user with no administrative rights (also strong password). Enable the BIOS password option. Every time you power on your computer, the bios itself will ask you for a password before even booting on. It will also prevent everyone from applying changes to the ...


3

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be trackable through the generation of unique links. Consider using a privacy-oriented search engine, like DuckDuckGo. You have their word they aren't trying to ...


3

does rotating proxy increase the difficulty to find your real IP? No. Your "real IP" is either disclosed in some way, or it is not. If it is not, it does not matter how many proxies you pass through. Multiple proxies may make more difficult to track your activity, i.e. establish that actions A and B were both performed by the same entity (for that, see ...


0

On the network layer it doesn't really matter how many proxies within a chain are or how many proxies in your rotation are: Your real IP address is cascaded and should not be revealed. But as you mentioned there might be fingerprinting techniques (e.g. user-agent individualism, cookies) or other leakages (e.g. announcing source addresses in SMTP and HTTP ...


-2

I think the point here is not which kind of data is collected because it is more or less stated here: http://windows.microsoft.com/en-gb/windows/preview-privacy-statement or on any other privacy statement you accept when installing, instead the interesting fact is that the mentioned data is going to be correlated to your account. Just think of what kind of ...


1

Since I can't comment yet, here's another answer on the subject about: Lights-out management with Intel Active Management Technology on Intel vPro processors which is capable of remotely controlling and modifying virtually all aspects of the system, including the ability to download and update software and firmware regardless of the computer's power ...


2

I had just happened to watch 32c3 conference talks, and while I am far from being into hardware security at least two of those talks touch upon the topic of chipset binary blobs. Both might add to an answer. This one by Joanna Rutkowska of the Qubes OS project discusses in some details Intel ME and SMM technologies and security concerns. She also discusses ...


1

Dropbox and others have encryption by default, but if your account has-been compromised, you lost one layer of security. Are you familiarized with the concept "Security in depth"? It Means That You need to add layer after layer (like an onion) to feel more secure. Maybe you need is a very strong password to secure your Dropbox account. Then you need to ...


4

Privacy and confidentiality are different things... A Zip file, even encrypted, is still there, and onlookers may observe not only the archive presence, name and size, but also the individual names and sizes of files within the archive, because these are not encrypted. Traditional Zip encryption is weak and can be broken within a few minutes, regardless of ...


1

Let's say the i5 contained some spy routines, "collecting info" on you, it would still need to get the data out for it to pose any threat. The only practical way to get the data out would be over IP, which is easily detectable, analysable and blockable. From a more paranoiac view, there might be RF signals leaking from the system, forged by the blob or not, ...


15

Do binary blobs pose a potential security threat? In short: yes. Binary blobs are by definition not auditable (barring extended reverse-engineering). You don't know exactly what they do, and whether they have backdoors. One particular binary blob I'd like to highlight is the one in the Intel Management Engine (and the AMD equivalent, the Platform Security ...



Top 50 recent answers are included