Tag Info

New answers tagged

0

Along with attempting to request the data, you can always read the privacy policies of the companies you are concerned with. The real issue though will be in (1) determining just how many companies have your data and (2) determining how much data they have of you. If you are just looking for logins, newsletters, and such you could try using a tool that ...


3

The exit node does not know your IP address -- that's the whole point of onion routing. Rather, it knows which relay node to contact in order for the data to eventually get back to you. In order for your IP address to be revealed with certainty, the entire chain needs to be vulnerable; if the entry and exit nodes are both vulnerable, an attacker can make a ...


2

TOR recently started to reject all the servers which have not updated their SSL. There is also initiative to block any servers that come online with unpatched SSL in the future. These cuts result in ~12% network capacity drop for Tor. That resulted from blocking ~380 servers. Below is an excerpt from the message on Tor's mailing list: I thought for a while ...


4

Depending on the applicable data privacy law in your country, you might have the right to request a company to send you all the personal information it collected about you. This usually works fine, though you have to send this request to each company you think is storing some data. Also, data privacy authorities often provide standard letter for this. There ...


0

There is one risk that hasn't been mentioned here yet: when you're having both Tor Browser and a different browser open, you may accidentally confuse them and either enter identifying information in Tor Browser or perform activities which you wanted not to have tracked back to you in the other browser. There is no great technical risk, but you'll have to ...


1

Yes, an app can access either camera without requesting the user's permission (except in China as you found out). All apps have unrestricted access to view the camera feed of either the front-facing or rear-facing camera and take pictures/videos. However, access to the Camera Roll to save such media does require the user's consent. Most apps on the App ...


-3

Thanks gents, Apparently this is related to heartbleed. I had an email received from TRA as follows: Telecommunications Regulatory Authority Republic of Lebanon e-Security Alert: Beware of Heartbleed Bug A serious vulnerability named the Heartbleed bug was announced Monday night (04/07/2014) in OpenSSL* (version 1.01 and OpenSSL beta 1.0.2.). The ...


2

This looks like a bug. Actually, regardless of whether there was interception or not, this is bug: when you spy on someone, you certainly don't want to make that person aware of the spying. But in this case, I'd rather incline towards a more mundane buffering issue. In phone networks, especially mobile networks, audio data is split into individual packets ...


-2

Ubuntu is the most secure operating system in the world, check out this link http://www.technology91.com/ubuntu-12-04-lts-tops-gchq-security-report-over-windows-and-mac/


2

One censorship method that hasn't been mentioned yet is TCP Reset packet injection, which terminates undesired connections via forged TCP RST packets. The Great Firewall of China has been known to do this for years (source: http://www.icir.org/vern/papers/reset-injection.ndss09.pdf). Often this is used in conjunction with DPI, such as to do protocol ...


5

Some research on this topic: Empirical Analysis of Internet Filtering in China (2003) For some 1,043 of sites tested, we confirmed that DNS servers in China report a web server other than the official web sever actually designated via each site's authoritative name servers. We call this phenomenon "DNS redirection," though others sometimes refer to the ...


0

In addition to Bob's answer, there is another security disadvantage when making use of GET requests with sensitive parameters. The URL, which includes the sensitive information, is sent to third-party web servers hosting resources referenced by the resulting HTML page. Example: First request: GET /someCode/pages/somePage.jsf?pin=MzAwMDY3MDI2OQ HTTP/1.0 ...


4

It's a question of resources actually. If a country were willing to devote a enormous amount of time, money, and expertise to the problem, I believe it would be possible to effectively block a few select sites. The reasoning is that all the circumvention methods themselves need to be broadly publicized among the target audience to be successful. A ...


32

You have covered the main ones. In short: it's very hard, if not impossible, to effectively block a site you want. You can make it hard by using the techniques you've mentioned: blocking IPs, redirecting DNS, blocking HTTP requests to certain sites / containing certain keywords. These methods are thwartable by proxies (in the case of deep packet ...


11

"Efficiency" depends on your goals. An important point to be made is that all blocking techniques can be circumvented, at a price. For instance, an individual can use a satellite phone to get connectivity which cannot be blocked by his country, save by direct physical intervention of armed forces. But using such systems is quite expensive. Countries which ...


1

I made a 16384-bit master signing key with 4096-bit subkeys using a modified version of GnuPG about a week ago. Then I imported it into a trial version of Symantec Encryption Desktop (formerly PGP Desktop). The key (and all of its subkeys): will not encrypt, sign, or decrypt anything. cannot change password. cannot modify preferences (like encryption, ...


1

Your "master key" has value only insofar as its public part can be used to verify that which was signed with it; and this includes other people. For instance, your "master key" is your ultimate resource to revoke sub-keys. So if you mind about interoperability, then you cannot make the master key as big as you would wish, even if your GnuPG binary has been ...


1

A "master signing key" (ie your identity) should be safe enough for a lifetime, because ideally you don't ever want to change it, right ? Yes, that's the idea. I am considering using 4k keys for encryption and documents signing, and a 8k+ key as "master key". That means I will use my master key only to sign my owns keys, and other ppls keys. Also ...


-2

Although the data you send is decrypted it is not possible for the IT staff to actually view the data you have sent, the only thing that is looked at is the web address.


2

The answer is yes, he can see what you're doing on the internet when he is connected to your WiFi network. The encryption protocol used is pretty much irrelevant. Whilst WPA2 will generate a unique session key for each client association, if the attacker captures this he can still decrypt your traffic. Even if the attacker doesn't capture it, he can forge ...


-2

Short answer: WEP? Yes. WPA? Maybe. WPA2? No. WEP is broken and you shouldn't be using it for a multitude of reasons so we'll skip that. Some WPA networks can be exploited by attackers who do not know the password. http://www.aircrack-ng.org/doku.php?id=tkiptun-ng WPA2 is what you should be using. In this scheme each client connected to the access point ...


0

With basic means (i.e. software to write to the memory card) I am rather doubtful that it is possible to trustedly delete all sensitive data. Inside of such a SDXC there is a complex microcontroller. Those microcontroller is not known to you and its software/hardware is proprietary. The memory size shown by the SDXC must not reflect the complete data the ...


10

This topic has already been covered here and there. To sum up: If you simply overwrite the complete disk (as a block) with data (random, null bytes... it does not matter), then there may be parts of surviving data, which could potentially be recovered by extracting the chip and reading from it directly. You cannot know what data has survived without taking ...


1

The best alternative will be quantum locking of communications in peer to peer sessions but it is still developing, extremely expensive, has distance limitations for now


1

You asked quite a lot of different questions here. I'll try answering each. Spoofing/sniffing: The cure is encryption. More specifically Public Key Infrastructure. Then B can't modify (or even decrypt) data that it's relaying. The only question here is how you want to implement the key exchange (so that it can't be attacked). Open ports: An open port is ...


0

The following article explains some ways that NSA could undermine the security of SSL: http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html To summarize, here are some of the methods the NSA may be using to break internet encryption: Compromising RSA keys, either by remote software exploit or subpoenas and gag orders. Suborning ...


2

There is nothing in the "Snowden revelations" which even hints at any special NSA ability at breaking RSA. Even taking all that Snowden says as gospel, NSA is still at the same point as everybody else, meaning that breaking 1024-bit RSA is "theoretically feasible" but subject to the building of a very special machine whose design has been roughly sketched, ...


-1

I think there is no alternative for RSA as its the most used algo for all public key crypto mechanisms, I read somewhere that NSA pay RSA in order to keep the algo weakest, actually using an RSA key with less than 1024 bits is vulnerable to brute force attacks, security experts recommend 2048 bits as key length, but NSA still have the possibility to spy ...


0

using Bank account number alone will not let you directly reach any thing , but on some banks it is used as username for online banking , or it will be asked by customer service person as layer of authentication, or it can be used for social engineering and be part of information gathering



Top 50 recent answers are included