2

Suppose I need to connect to the internet but I cannot (or I don't want to) trust anything outside of my laptop. Therefore I will need to make sure all connections are secure, so I guess this means they should be encrypted and the destination should be able to be trusted.

To browse the web, I can use Firefox with the plugin "HTTPS Everywhere" set to "block every unencrypted request", and if I'm not mistaken I guess that should be enough for surfing the internet. However, browsing the web is only part of the story. There could be some processes or applications that don't make secure connections, including "default" or "core" applications like the system updater itself, or some applications maybe be misconfigured. So what should I do to make sure Linux only uses secure connections that can be trusted, even at the cost of having to avoid or block any insecure connections?

closed as too broad by StackzOfZtuff, Gilles, M'vy, Serge Ballesta, Mike Ounsworth Aug 16 '18 at 1:13

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Which threat are you protecting against? TLS will only ever help against MiTM attacks and eavesdropping. – vidarlo Aug 1 '18 at 15:57
  • @vidarlo, basically not trusting anything between my laptop and the destination, especially not trusting the local network (and not trusting VPNs either). Some exceptions could be made for example for Google's DNS, I can trust their services, but not everything that's between me and them (unless the connection is secure). So you see why the question is about "secure connections". – reed Aug 1 '18 at 17:39
  • 1
    Set up a VPN tunnell to the target. Set up firewall rules that drop traffic to all other destinations. – vidarlo Aug 1 '18 at 17:40
  • 1
    Run your own VPN server if you don't trust 3rd party VPN. There are plenty of non-commercial VPN software you can use. – Bernard Wei Aug 1 '18 at 19:19
  • @BernardWei I don't think a VPN will be the same as a sytem-wide "HTTPS Everywhere". That what I'd be interested in. – reed Aug 2 '18 at 8:43
1

To browse the web, I can use Firefox with the plugin "HTTPS Everywhere" set to "block every unencrypted request", and if I'm not mistaken I guess that should be enough for surfing the internet.

-

basically not trusting anything between my laptop and the destination, especially not trusting the local network (and not trusting VPNs either). Some exceptions could be made for example for Google's DNS, I can trust their services, but not everything that's between me and them (unless the connection is secure). So you see why the question is about "secure connections"

This doesn't make any sense at all. Why would you trust a TLS encrypted connection to random sites, but not trust a VPN solution?

TLS will not protect you against malware. It will protect you against eavesdropping and MiTM-attacks.

Ubuntu, for instance, uses signatures and timestamping to secure updates against tampering, even though it's transmitted over plain http. At worst, an attacker can force you to not get updates; he can't really give you malware via the update mechanism.

If you have a remote device you have to access securely, set up a VPN to that service, terminating as close to the service as possible. Drop all other other outgoing traffic from your laptop.

Oh, and I'm very curious about your chain of thoughts leading to your conclusions about security...

  • And blocking package updates (because they're not secured at connection level) will make you less secure pretty quickly. – dave_thompson_085 Aug 2 '18 at 4:01
  • A VPN can read all the traffic, a random site only sees whatever I send to it. I never mentioned malware in general, the point is in fact only about eavesdropping and MITM, so any possible malware has to be injected in the connection (MITM). As I said, I am assuming I can trust my laptop and the destination, but not what's in between, so the conclusion is pretty obvious: if HTTPS is a must for this scenario in a browser, how can the equivalent be achieved system-wide? Could be some steps to take, stuff to check, rules in iptables, etc, I don't know. – reed Aug 2 '18 at 8:40
  • Or the malware may be served up in ads... over https. – vidarlo Aug 2 '18 at 9:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.