sr2

9 yıl öncediscuss

> So they have publishers by the balls "forcing" them to use AMP to get higher in their rankings.

Except that I don't write blogposts to please the Google search engine. A site can be found via many other ways. News sites like Reddit are a great way to be discovered, aswell as HN. There's also link dumps like Pinboard which are another way to discover, aswell as others. Twitter, etc

sr2

9 yıl öncediscuss

Hypponen's law: Whenever an appliance is described as being "smart", it's vulnerable

https://twitter.com/mikko/status/808291670072717312

sr2

9 yıl öncediscuss

That's why all phones should have a decoy feature so that when asked to produce a password, you just give them the decoy pass, and it unlocks a clean profile with no way for them to find anything personal, and or incriminating.

sr2

9 yıl öncediscuss

There's a useful guide[0] if you're going to use a VPN and you should take it seriously. Personally I think a VPN is only ever useful for routing traffic over hostile networks (like at shady cafe wifi) and spoofing your geolocation to access geo blocked content.

[0] https://gist.github.com/joepie91/5a9909939e6ce7d09e29

sr2

9 yıl öncediscuss

What's to stop someone renting an offshore VPS, like say, in somewhere like Hong Kong[0], and that isn't part of the 'fourteen eyes' spying alliance?

[0] https://privacytoolsio.github.io/privacytools.io/#vpn

Also what's to stop someone stacking anonymously-bought VPNs on top of each other (proxy chaining) similar to how onion routing works, and creating their own homebrew Tor? If the VPN provider is peeking at the logs (which it shouldn't be doing), then all they see is another VPN IP. VPNception!

(Something like the SHALON[1] technique is useful for this, for example):

------------

> Abstract—In this paper, we introduce a novel lightweight anonymization technique called Shalon. It is based on onion routing, aims to reduce complexity, and delivers high bandwidth. We have, compared to the widely known approach Tor, slightly reduced the level of security in favor for greatly increased performance.

> The most significant advantage compared to other approaches is that Shalon is fully based on standardized protocols, which makes our approach highly efficient and easy to deploy. It also makes Shalon easier to understand for normal users, eases protocol reviews, and increases the chance of having several implementations of Shalon available. In this work, we provide a description of the design and implementation of Shalon, a performance and anonymity analysis, and a discussion on the scalability properties.

[1] https://pdfs.semanticscholar.org/6f30/f14ff4972ddd787bf7e859...

sr2

9 yıl öncediscuss

Too much emphasis on education and college in this article. Hacking requires 'thinking outside the box'; often called lateral thinking[0]. Formal education in the subject of hacking is nice, but doesn't allow for the creative mind to fully explore systems. There's a phrase:

   Don't Learn to Hack - Hack to Learn

In terms of earning money from hacking, there are tradeoffs made in both whitehat and blackhat hacking. One noticeable tradeoff in blackhat hacking is having no boss, and penetrating a system on your own terms. Whitehat hacking might pay more and be more respectful and a nice little haven where you can avoid jail, but it's often riddled with a rigid framework for getting into systems and doesn't encourage the lateral thinking I previously mentioned. Instead it's a corporate cubicle job where hacking is often automated and routine.

On the other hand, there is grey hat hacking which many fall into at some stage to strike a balance, and often balance criminality with a respectful whitehat job that pays well.

[0] https://en.wikipedia.org/wiki/Lateral_thinking

sr2

9 yıl öncediscuss

"Why Tipping Should Be Banned", by Adam Ruins Everything is worth watching if you are of the school of thought that tipping is bad: https://www.youtube.com/watch?v=q_vivC7c_1k

The gist of the video is that if you're tipping, then a waiter/waitress for example is not being paid enough, and tips are deliberately designed to bolster their unfair income.

sr2

9 yıl öncediscuss

+1 for tinc

sr2

9 yıl öncediscuss

For those who don't want to click, here's the abstract:

> Populism may seem like it has come out of nowhere, but it has been on the rise for a while. I argue that economic history and economic theory both provide ample grounds for anticipating that advanced stages of economic globalization would produce a political backlash. While the backlash may have been predictable, the specific form it took was less so. I distinguish between left-wing and right-wing variants of populism, which differ with respect to the societal cleavages that populist politicians highlight. The first has been predominant in Latin America, and the second in Europe. I argue that these different reactions are related to the relative salience of different types of globalization shocks.

sr2

9 yıl öncediscuss

Just make sure your catchall is renewed well into the next five years. Heck, you can do a 'rollover renewal' that lasts 10 years if you wanted.

This is to stop somebody eventually gaining control of the domain when it expires, setting up a catchall on it, and then being able to login to every single account you used with that address.

Some registrars protect a domain after expiration so nobody can hijack it and claim it as their own, but you often have to pay extra for this service.

sr2

9 yıl öncediscuss

There's also iPredator[0] run by Peter Sunde. PRQ is the work of Gottfrid Svartholm. Your traffic goes through Sweden, so you're safe!

[0] https://www.ipredator.se

sr2

9 yıl öncediscuss

> Have you MITMD your connection

Yes, with another Sysinternals tool called TCPView https://technet.microsoft.com/en-us/sysinternals/tcpview.asp...

You don't even need an AV product, you can spot malicious activity by eye alone.

sr2

9 yıl öncediscuss

This was before the client even connected for the first time. And the IPs were well known C&C servers used for collecting keystrokes and screenshots of your O.S

sr2

9 yıl öncediscuss

> the OpenVPN protocol is easy to be detected and banned in some highly censored network.

Tunnelbear are one of the few VPN providers that use a thing called obfsproxy to circumvent this kind of censorship. They call it 'Ghostbear'[0] but really it's just an obfsproxy bundling which uses the domain fronting technique.

[0] https://help.tunnelbear.com/customer/en/portal/articles/2435...

[1] https://en.wikipedia.org/wiki/Domain_fronting

sr2

9 yıl öncediscuss

Yeah and use a decent client like Viscosity, or if your O.S supports OpenVPN config files natively, just use them.

sr2

9 yıl öncediscuss

I spotted loads of malicious network traffic, and using the Sysinternals Autoruns[0] utility I was able to spot attempts at persistence. I also checked the outbound connections and they were C&C servers. I can't remember if the installer was digitally signed or not, but there was definitely malware in it. I always make sure to opt-out of any AD ware that might be bundled with an installer, but this seems to have been injected surreptitiously, and installed with very little interaction.

Just be careful with the bespoke VPN clients as they are very juicy targets for MITM attacks. I know I would be going after VPN software if I wanted to do ex-filtration for a small subset of users trying to hide their tracks from governments and ISPs.

[0] https://technet.microsoft.com/en-us/sysinternals/bb963902.as...

sr2

9 yıl öncediscuss

Even if this site was not a joke, I wouldn't trust an online password generator, especially if the pass is generated on the backend instead of the client. A quick Google for 'password generator' yields hundreds of these sites which are more than likely run by the same outfit and are possibly logging the passes into a database to make cracking various accounts easier.

There's a few PW generators which run on the client only and don't send any requests to third parties, and I use them sometimes. They are typically very JS heavy and use different seeds to generate sufficient entropy, like client fingerprint, mouse co-ordinates, timezone, etc

sr2

9 yıl öncediscuss

Another two I heard TheGrugq mention in one of his talks are Mullvad and PRQ

https://www.mullvad.net

https://prq.se/?intl=1

sr2

9 yıl öncediscuss

I'm not sure about Liberland, but I know in the Isle of Man that Bitcoin is thriving: https://www.middletonkatz.com/wp-content/uploads/2015/06/Isl...

sr2

9 yıl öncediscuss

I found malware in the PIA installer. Not sure if it was planted by PIA themselves or I was subjected to a MITM attack, and so I would never use any bespoke VPN software again. Best just downloading the OpenVPN config files and plug them into something like Viscosity[0] (which I trust over the more bespoke VPN clients made by the VPN providers themselves).

[0]: https://www.sparklabs.com/viscosity/

Submissions

Drive-by remote code execution by MAMP

How to Turn Off Snapchat’s Stalkerish Snap Map Feature

Catapult – Simple, Secure and Fast Data Transfers

By Killing Encryption, Our Leaders Are Delivering Us to the Terrorists

Collate – A Cross-Platform Markdown Notes App for Windows, Mac and Linux

Seald – Instantly encrypt and manage your documents, messages, contracts, data

About encrypted backups in iTunes

Smart Glass Solutions to Replace Electronic Window Shades

Overview of the U.K Parliament Attack. Nothing new if you can run Burp Suite

What Mary Had

Does China’s Mass Collection of DNA Violate the Right to Privacy?

Arq Backup – Cloud Backup for Mac and Windows

Torus – A secure, shared workspace for secrets

Encrypt and check your secrets into git

Snapchat's New Feature Has Got a Lot of People Worried

Instagram testing private sharing with favorite friends

Unbreakable: China doubles down on quantum internet

Instagram doesn't encrypt stories

What Is a VPN?

Hushed Burner Number App – Temporary Phone Number

comments