New answers tagged

18

A VPN masks your IP address. But the HTML5 geolocation API isn't based on your IP address. It is a Javascript API which can be used to ask the web browser directly where it thinks it is located according to whatever information is available to it (system locale settings, nearby wifi networks, GPS sensors, IP address of the network interfaces as you see them ...


-3

Your VPN does not route all traffic through the vpn interface - in particular, the encapsulated vpn traffic itself necessarily travels via your normal internet connection - otherwise it could not reach your other vpn endpoint. This may allow to determine your "official" IP (which would be the external IP of your access router in the typical case of a NATted ...


12

Try disabling HTML5 geolocation if you don't use it. In Firefox, set geo.enabled to false in about:config. There have been bugs, and there will be again, example 1 and example 2.


37

I just checked this with my VPN in http://html5demos.com/geo Although I VPN through Germany, it still shows my nearby location in London. If you read https://www.mozilla.org/en-US/firefox/geolocation/ , you will see: If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address Then Firefox sends this ...


0

Yes for end-user to site many people do this you just have to figure out how to get the VPN to use a centralized authentication system which you can tie into a 2FA system. For site to site you can also do this but just keep in mind that if the link goes down for any reason you'll keep the network down until you can get the 2FA entered. One indirect ...


2

It will not make a single complication! Use the next things in your server: OpenLDAP - it will hold the user info goSA - a fine web interface to utilize all the operations you need administering users and groups in LDAP pam-ldap - a very handy authenticator for PAM standard/interface/library So! for your OpenSSH use PAM auth method and use pam-ldap to ...


2

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection. The answer to all of ...


3

No, L2TP over IPSEC only encrypts once, the encryption is done by IPSEC. It is used when you wish to encrypt your data link layer. IPSEC will handle IP packets. Your data link layer is converted into L2TP IP packets, with no encryption. Then you encapsulate the L2TP in the IPSEC protocol. If you don't need to transport your data link layer over IPSEC but ...


0

1) Depends. The VPN itself indeed only encrypts from 1 to 2, however, if 3 (The website you're visiting) supports TLS/HTTPS, 2 -> 3 is also encrypted and secured, only not by the VPN. E.g: 1 = user 2 = vpn 3 = web-server Without TLS: 1 ---[VPNencryption(plain_text)] -----> 2 ---[plain_text] ----> 3 With TLS: 1 ---[VPNencryption(tls((plain_text))] -----...


0

The port might be consumed by rpcbind. What rpcbind does, is described here An excerpt: When a client signs up for a given interface on a particular host, usually with a clnt_create() call, the stub code asks rpcbind on that host a question, something like "on what UDP or TCP port is protocol number X listening?" rpcbind, unlike most other ONC ...


1

NOTE: All of this assumes you are talking about TCP 111 (vs UDP). If you are using a VPN service, you are sharing that Public IP with many customers and being NAT'd somewhere along the way. This Public IP is generally not directly routable to you as a user of the service, as such, there isn't much to worry about. That being said, it's hard to know (...


0

Install BurpSuite tool on your laptop and make it listen to all interfaces. Then you can set your android phone to send all the traffic through BurpSuite. If you want to see encrypted data too, then install burp CA certificate on your android phone. This link has all the steps. Portswigger There might be issues with some of the apps which use SSL channel ...


1

First all packages are going through the TLS encrypted VPN. Then all apps could communicate over another encrypted connection (for example https). So these packages are encrypted multiple times. If you want to sniff, the simplest way doing this is install the sniffer directly on your device and install your own root certificate (this is a high security risk)...


1

If an attacker has managed to install software on your PC, that software can initiate a connection to an outside system, unless you have configured your firewall to block outgoing traffic as well. This connection can carry back data to your PC, even through your firewall, the same way a web browser receives data from a web server. And if you block outgoing ...


2

set the firewall to BLOCK ALL TRAFIC... If you manage to set the firewall to block all incoming and outgoing traffic then you cut off the access for the attacker as long as the firewall is set in this mode. But note that if the attacker is already on your system he might have installed software to monitor the system and can later retrieve the collected ...


2

If the concern is just as far as the WiFi hotspot and the users who are connected to it, then as long as you are connected to the VPN, the traffic should be encrypted and cannot be viewed by any other WiFi user. There are some concerns however, on the type of VPN used, which encryption method it is using, and so on. Also, I think the biggest concern would ...


4

It is as strong as the SSL configuration of your tunnel between your laptop, and the VPN gateway. All traffic now goes through the tunnel to the VPN gateway where it reaches out to the Internet. The VPN gateway will then ferry the response back to you.


1

I am the CEO of a real no Log VPN service. Here is how I would do it without violating a no log policy. I would create Layer 7 filters on the firewall that would pattern match abusive traffic in real time and then mark the matched packets. Once you have the abusive packets marked you could login to your router or WAF and monitor the marked traffic. From ...



Top 50 recent answers are included