Tag Info

New answers tagged

1

With KVM and Xen, the rogue administrator can take a snapshot of your live machine, then explore at his leisure what is in the RAM of your VM. In particular, he will easily obtain the encryption keys for the encrypted filesystem, and then proceed to read all your files. By the very nature of the snapshot system, you will not notice it. With OpenVZ, you ...


0

OP asks two questions that are related regarding: Encrypting content. Ensuring the content can only be viewed by intended recipient(s) - possibly in the cloud. Given the use-case, while PKI is a good general solution for both issues (encryption for the intended recipient) and is supported out-of-the-box in most email clients (after private-keys are ...


0

I use a VM with a browser that is not connected to any of my personal accounts. When I'm done browsing, I revert the snapshot of the VM to the starting state. That means no cookies, no downloaded files, nothing in cache. This approach meet MY needs for protection, concerning the risks that I care about.


1

You are mentionning two Privacy issues here: Circumvention of censorship & password protection. When it comes to government firewalls, it is wise to use widely spread softwares, as they have been tested a lot and are known to work as safely as you can find. The reference here is TOR and is used daily by insurgents in countries famous for their ...


0

I plan to communicate with my family across the planet who does not know much about encryption. Otherwise I would ask them to simply use GPG. In this instance, I like to make the communications simple. I prepare before hand, a small list of about 100 different passwords, randomly generated, each one is 40+ characters long, consisting of letters and ...


5

A virtual machine is an operating system installed on a virtualization software such as VirtualBox and VMware Player. It emulates the existing hardware of the host machine on which it runs. This means a software running on a virtual machine will "think" it is running on a "normal" computer resources. You can do on it all what you do on a usual computer with ...


3

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


0

Network discovery is a network setting that affects whether your computer can see (find) other computers and devices on the network and whether other computers on the network can see your computer. By default, Windows Firewall blocks network discovery, but you can enable it. Instead you turn off 'Network Discovery' in your system, I suggest you install a ...


1

Regardless of what virtualization technology you use. Once the attacker has access to the hardware, it's game over. In case of a VPS, even when encrypting the root partition, if the key is stored in memory and you have no control of the hypervisor, then you cannot protect your system's confidentiality with encryption. Administrators with access to the ...


0

Yes. AddThis uses JavaScript’s to perform canvas fingerprinting. If the URL (or a part of it) of the script is marked for blocking in a loaded Tracking Protection List, IE will not load the script. EasyList provides a Tracking Protection List subscription, called EasyPrivacy, which includes AddThis URLs for blocking. ...


1

I'm not trying to be mean or unhelpful but I don't know why people keep asking questions about whether Microsoft products and software are able to protect them from security threats. Just give up. Look into this https://adblockplus.org/blog/adblock-plus-and-the-canvas-fingerprinting-threat and read how its possible to prevent canvas fingerprinting. Then ...


1

Something you build yourself may be more secure or it may not be. You don't know how secure a system is until it is tested and looked at by lots of people. This is why the saying "don't roll your own" is very common in security. Your own system would have the advantage of not being vulnerable to out of as many out of the box attacks as a larger system, ...


0

Yes it is possible , of course the location of your browser history depend first of your web browser and secondly of your OS. For example I know that in linux , in ubuntu distrib you can find lots of informations about mozilla web browser on the home folder of a user. All of the informations are stored in sqlite database. For see details : ...


2

Your browsing history is basically a file on the computer's disk. Depending on your attack scenario, many things are possible: For someone who has access to your computer, through a remote-controlled malware or just sitting at your desk while you're away, it is entirely possible to get that history file and read it "without a browser". If, however, you ...


5

First, a word on security: Security does not exist in a vacuum; it is completely dependent on the circumstance. Defending against an unrealized threat is wasteful. Not defending against a trivial attack renders your system useless. As such, blindly adding security measures is an exercise in futility. One must have a well-defined set of goals for a system, ...


2

Almost all software of significant complexity, especially software dealing with network communications, contain vulnerabilities. A subset of those vulnerabilities are known to some bad actors who will use them in various ways (0-days). Whether you build the distribution yourself or use an off-the-shelf distro, some of these vulnerabilities may exist in ...


1

Not just IP/pings, but if your computer is "discoverable", it means it will allow requests for other things such as public/shared files, remote control/access, any printer resources that may be shared, and DLNA/streaming, homegroup, etc. - any one of those may have a vulnerability that can now be exploited


0

A Cookie allows a website to place a small file on your computer, which is usually used as an "identifier" that then can then go do a query against in their database and go "ah, this is customer X who was browsing Y earlier today" - normally (outside of security exceptions which are patched), a site can only read it's own cookies, however, many rely on a ...


2

Most of the time, scammers aren't technical people, and they won't look for your IP address in mail headers (since they sometimes leave theirs). Find a mail provider that doesn't forward it, just to be on the safe side. This extremely entertaining resource, 419eater.com, should give you the basics. As far as safety is concerned, it boils down to not giving ...


2

One aspect I have not seen mentioned is the fact that many login difficulties arise because a user's preferred name was taken before he tried to register for a given site. If "JSmith" tries to log in and can't, what he really wants to know is not whether the site has an account named "JSmith", but rather whether the site has an account for him named JSmith. ...


7

There is an old tradition of not distinguishing between "that username does not exist" and "that username exists but the password is wrong". It comes from older times, when both attackers and defenders were new at the job, and the context was different. At that time, the attacker was "outside" and he wanted to guess a username+password pair in order to enter ...


3

What matters the most in terms of security is what does an attacker gain from knowing whether a specific ID or email address has an account with your site? For instance, if you're doing any kind of business that can be seen as a privacy issue, or whether accounts on your site can be used to spend money or have any intrinsic value (in other words whether I ...


19

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


3

No, you should not let them know if the username doesn't exist as it would let an attacker discover account names which they could then attempt to crack. If you send a generic "A reset email has been sent, please check your inbox." even when the account doesn't exist an attacker gains gives nothing from trying.


2

This sounds like a Zombie Cookie. There are a large number of places a web site can store state: cookies, Flash local storage, ETags, etc. When you clear your cookies, you do not necessarily clear all these places. Web sites can store an identifier in some of these other places, and track users despite them clearing their cookies. If you use a dedicated ...


0

I think you'll find this very interesting to read: http://words.zemn.me/csp Core message: What I realised was that what CSP abuse allowed me to do was to allow me to make assertions about redirection and use the results of those assertions to determine information about the user. (...) Something like this could easily be used to work out who the user ...


1

I did some research on this in 2012 for a blog I was working on at the time. However, my research was more tailored to what a webmaster can see after a user clicks the +1 button. The conclusion I came to was this: http://analytics.blogspot.com/2011/06/1-reporting-in-google-webmaster-tools.html "Finally, the Audience report shows you aggregate geographic ...


0

Have you seen PrivacyBadger from the EFF? This 'learns' which cookies track you across multiple sites, then will eventually start blocking them. Once it's learnt a good proportion of cookies, you will want to clear all your cookies from your browser, then any old ones will be deleted.


1

This is more of a comment than an answer, but apparently I'm not allowed to comment yet. If you're concerned about the privacy of your cloud storage, you may want to consider Tresorit as an alternative to Google Drive. It offers client-side encrypted storage & syncing, so the Tresorit engineers aren't even supposed to be able to tell what files you're ...


5

What about hosting those files on other hosting services which have client side encryption like: Tarsnap, which has open source client and does client side encryption. Tahoe-LAFS SparkleShare, which has GUI clients for all operating systems. more on https://prism-break.org/


4

There's any number of ways that your company's network administrator may have identified you. The principal thing you need to realize is that, while you may be using your own device, you are on your company's network. That grants the company a lot of visibility to the traffic your device generates, should they choose (as it appears they have) to examine it. ...


1

To answer one of your questions: any Google employee who has administrative access to the hosts (file servers) on which the drive data is stored will have read-access to your data: this includes the operations engineers, service engineers, system administrators: these type of employees are typically the ones with that type of access. The answer to your ...


5

How to get noticed in a professional network Your network admin is able to see that "chuck" is connecting to an internal E-mail server from the Mac address "00:05:02:11:22:33" and that this iPhone address is connected through the access point on first floor of the library. This is just a practical example. There are many other ways. Notwithstanding the ...


7

iPhones default to "Chuck's iPhone" as their network name. You change that by changing your device's name. Same with any iOS device.


2

Cryptography is a form of smart obfuscation, it does not make things "secure", just "secure enough, for now". If someone REALLY is out to get you, he would store your encrypted data until a later date when encryption can be broken - anything from stronger computers to software vulnerabilities like "heartbleed" will do the trick to decrypt your stuff in the ...


1

It is possible for the admin to access the underlying Untangle system via ssh or the local console and use any commonly available Linux tool to see the raw packets. Untangle discourages it as automatic updates may remove your tools, or the tools may break the system.


1

A local certificate authority (CA) must be setup by an administrator. The administrator tells your browser that this CA is trustworthy. The proxy server uses this CA to sign the forged certificates at which point the HTTPS proxy (in this case, the Untangle server) would now have the ability to decrypt the HTTPS traffic. Can the administrator track what ...


4

It depends. Untangle has the capability of intercepting HTTPS using a man in the middle proxy (https://www.untangle.com/store/https-inspector.html). If this is enabled, the HTTPS inspector can see all HTTPS traffic. This however requires that all desktop client install a root certificate issued by the Untangle device.


0

As a complement to the other answer, which focus on the "unblur" feasibility, keep in mind that depending on the software used to create the image files, some format allow to store a thumbnail version of the image within the same file (this is the case for JPEG images). A common mistake would be to blur the face on the main image, but keep the thumbnail ...


3

Blurring removes high-frequency detail from an image (by applying a convolution that is essentially a weighted average of some kind). It is not possible to restore the original image from the blurred version, However, it may be (usually is!) possible to restore a similar picture which has enough detail to be recognizable, and even if that is isn't possible, ...


2

I think the traceability of your connections will be recorded on the log file of untangle server but not the content of your conversations .


1

Apart from statements like NSA has your data when uploading it is based on the assumption that your data being on your disk is not somehow accessible. Like others stated, if your data is encrypted in a strong manner on your disk and uploaded in the same way I would regard the online version more safe in terms of redundancy (google is managing the replication ...


13

Not instantly. Although, that's what I want to believe. What you could do is the following. Download the Truecrypt version 7.1a and create an encrypted storage file (option 1 from the wizard) and choose 3 algorithm based encryption with a SHA-512 key. Put all your sensitive files in here and upload the encrypted file to Google Drive. When you want to work ...


7

Any data you upload to Google Drive (or Skydrive, or Dropbox for that matter) should be considered duplicated by the NSA. Apart from arbitrary queries from the aforementioned secret service, law enforcement agencies from any country may gain access to them through legal means (subpoenas and so on). And of course, Google engineers could in theory browse your ...


39

Google has access (obviously). The police will have access if they have a valid search warrant. A national security letter will give the FBI secret access. Various three-letter agencies may have access, depending on how they're doing at circumventing Google's encryption. (Google started encrypting its internal traffic after it was revealed that the NSA was ...


2

In short, yes and no. You can't completely remove blur but you can definitely revert some of the changes. If you have a choice between blurring and blacking/whiting something out, go with the latter. Blurring essentially rounds and moves things around, and with the right algorithm for certain blurs information can be revealed. By adding a layer that can't ...


0

Many organizations have a central email server that's the only one to be exposed to the outside and which forwards emails to some satellite node (one per geographical site or per organizational department) which isn't visible to the outside network. Furthermore email can be forwarded from server to server. Since forwarding can be based on the content of the ...


1

SMTP is a very, very old protocol, dating from the early days of the Internet when connections weren't reliable and security wasn't a major issue. Many of the issues with SMTP (open relays, unauthenticated senders, etc.) are the result of trying to provide reliable delivery on an unreliable network where everyone knew everyone else (or at least everyone ...


0

Intermediate email servers aren't generally required, but they allow for scale out, and allow for specialized email services to handle particular requirements such as: AV/AS scanning Content Filtering for information controls 3rd party auditing via BCCing (for SEC registered reps, schools, etc) Specialized routing (P1/P2 routing, sender routing) ...


2

Converting my comment as an answer: There has already been a lot of news on this point. Federal agencies do, in fact, ask for keys and get them.



Top 50 recent answers are included