specific questions about opsec

Hello, I recently started getting paranoid about privacy and anonymity online and would like to ask some questions. First, specifically about 2 companies. I know Discord keeps logs. If I change my Discord and Spotify account emails to another email, is my old one with my irl name and info still permanently left in the database or does it get deleted? Other than that, VMs and VPNs. If I use a VPN that doesn't keep logs on my parent machine, and also use the same Mullvad account for my VM but connect to another server, how can I fuarrrk up and let my activity be traced? Is there any online opsec bible that covers everything? I still don't know exactly how VPNs work. A lot of people could be using the same server, therefore having the same IP address? If you make a post on 4chan and commit a malicious act somewhere else from the same server can it be assumed that they were made by the same person, or is it that many people share that same IP? Does DuckDuckGO block all cookies? Are mails with ProtonMail always encrypted? What happens if you send an email from your proton mail to a gmail address? I tried it and the message was not encrypted. t. I'm young with a cringe online history that I want to leave in the past. I want to focus on studies, projects and stay anonymous. How do I educate myself on this?

Always assume services Hoover up all your data and never delete it. Even if you ask them to using a gdpr request.

>>21412 Next time, use the Q&A thread >>18084 This way you are more likely to get replies (because posters check that thread periodically) and an old thread does not get killed. >is my old one with my irl name and info still permanently left in the database or does it get deleted? You have no way of knowing. They probably keep the logs and they might have sold the data already (or some 3rd party analytics company might have the data). >If I use a VPN that doesn't keep logs on my parent machine, and also use the same Mullvad account for my VM but connect to another server, >how can I fuarrrk up and let my activity be traced? That setup means that the same VPN account has your both identities associated with it. A VPN just means that your traffic goes through someone else's computers. Use Tor Browser if you require real anonymity but do not log in to any accounts while using Tor. >Are mails with ProtonMail always encrypted? No. If you send mail to someone, then the mail is not automatically encrypted, unless your recipient also uses ProtonMail. But note that ProtonMail has your both keys (private and public), meaning they can read your encrypted mail (it's like keeping the key right next to your front door, it would be extremely easy to get access to your private email). If you want to avoid this, you need to generate a key pair using GnuPG on your own computer and then copy+paste the encrypted text to webmail. Read more about it here: https://emailselfdefense.fsf.org/en/ >I want to focus on studies, projects and stay anonymous. How do I educate myself on this? Take a look at https://www.privacytools.io but note that it's entry-level knowledge and take it's advice with grain of salt (especially the advice on VPN providers). Also, switch to GNU/Linux distro (like Linux Mint or Xubuntu). You can learn more about using GNU/Linux CLI by reading this free book: https://linuxcommand.org/tlcl.php

>>21414 >Next time, use the Q&A thread I apologize, I'm new here. I already use Mint and happen to be reading this exact book as we speak, however my knowledge in networking is 0. Thank you. Some questions that occurred: 1. If Mullvad doesn't keep logs and the account info is just an anonymous number with no payment info attached to it (Monero) then how does using the same account on your parent machine and VM but connecting to a different server in both of them how could someone see they are interlinked? 2. Does Tor discourage using a VPN as an extra layer of security? 3. Suppose I am browsing on Tor but also have some tabs open on my main browser, is that a blunder or, does it have no effect on Tor's functionality? 4. I don't understand how some people get caught for unlawful activity like leaking data for this reason: they dropped the leak from the same VPN server they used to connect to their personal email account. But isn't a VPN connection to a server e.g. Frankfurt001 shared by a lot of people at the same time, meaning a lot of people share the same IP address? Thanks again.

>>21412 Nobody knows how they operate their databases, but it is certain that nothing is getting deleted. Whatever data they absorb will remain forever. I don't feel like elaborating on my points. If you care you'll ask for elaboration. I assume you are speaking of virutal machines when you say VM. This is good. More people should utilize virtualization. You should virtualize everything. All it takes is one exploit to root your entire system. Although you may use a soykafty virtualizer. Your request is routed through a VPN before reaching its destination. The destinatory site cannot trace your connection beyond the VPN server, it will only get an IP from the VPN. There is a plethora of ways that specific activity on the internet could be linked to you regardless of the anonymizer you use. Just because other people are using the same VPN server as yourself doesn't mean they would fall under suspicion. You shouldn't be using a VPN if you are concerned for your "privacy and anonymity" online. The majority of these VPN providers are honeypots. Protonmail is a honeypot as well, their encryption is backdoored. They have given the information of thousands of their users to the authorities over the years. https://proton.me/legal/transparency If you want a somewhat decent provider look into RiseUp, or danwin. There is also Disroot but it seems to be the soykaftest of those three. There may even be new alternative email providers as well. All you really need to do is a little bit of research when deciding on a provider to use. Read their privacy policies and such. Dig for information on them that would suggest they are a honeypot. If you wish to encrypt email use PGP. You shouldn't even be using email in the first place if possible. If you are going to use email use a mail client. Shit email providers don't support them. Claws is a good mail client, you can use PGP in Claws. If you are already using VMs while attempting to obscure your IP with a VPN, you should really just use Whonix. https://www.whonix.org/ Here is their site. In essence Whonix forces all of your connections through Tor, read about how Whonix functions if you are interested. It is a great utility for someone who is not very knowledgeable, you will also most likely find their wiki to have useful information. There is not one specific, preset path to attaining "privacy and anonymity" online. There isn't some guide that is going to teach you everything you need to know, there are plenty that will teach you everything that some guy thinks you need to know. Don't take such guides as gospel, they give a lot of soykaf advice. You will learn with time, as you learn you will revise the measures you take. You will be leaking information about yourself during your journey, you'll probably become less traceable as you learn more, eventually you might reach a point where you have significantly limited the extent to which you are traceable if you are willing to do what is necessary. Most are unwilling. Within a few months you'll probably be fine, it just takes time to discover information, everything is easily learned. You'll never be completely untraceable, nobody is.

>>21416 1. They can't, only mullvad could if they were malicious 2. My understanding is that a VPN shouldn't really help you in most threat models if you are already using Tor. If your adversary can deanonymize you on Tor, then you are fuarrrked regardless, most likely. 3. Only if you correlate your Tor traffic with clearnet traffic. Dont do this. 4. The VPN provider has your info, they can figure it out

>>21423 Quiet, you, OP asks good questions.

Anything you send to a large service like a big social service or big CDN, is saved indefinitely. Intelligence agencies simply make them cough up the symmetric keys used to encrypt connections to users, and then copy the encrypted packets at any point where they cross one of the hundreds of backbone providers they have made deals with. They will decrypt that traffic and do whatever they want with it, share it to other agencies of other governments, etc. On top of that, the Discord company itself is probably sharing the data with plenty of its shareholder companies (and by extension, their jurisdictions). If you tell someone a secret, they recorded it!

>>21426 if a person has accounts on discord, google, and other services, but has begun to research anonymity and privacy, what should he do? where should he start? would deleting all the accounts help?

>>21453 in the same situation. the best advice i heard is to keep an alias. You want to be private without standing out. If you start to use Iceweasel or a hardened firefox browser suddenly, you're going to stand out to anyone snooping on your history. I think the best course of action is to "act" normal. Keep your accounts and use them but don't use them for important information. Make yourself look like a normal standard citizen. For whatever else, use a completely different computer with a VPN or tor. If you want to browse alt-thinking websites, browse them with your second computer. Don't make yourself suspicious or conspicuous

>>21453 if my goal were to leave my past online history buried, before thinking of VPNs, browsers and SEs, first thing I would try is to abandon my current username and make a new one. A new identity. New email, etc... I don't think you need to delete your accounts, just merely abandon them. In case you really need to go back to them. Delete them if you truly think you won't need to go back to those identities. Be it Protonmail or Gmail or self-hosted, you gotta have no direct connection to your old identity. I think the question of IPs and traceability thru these means are of irrelevance here because I doubt anyone can have the means to discover your old identity by just these means. For example: Personally, I find out about artist's past work they hide away because they loosely mention it by accident or I find their past work tied with their current name on boorus. (+, I doubt a huge entity like Spotify will want to know your old identity anyway. I asssume that they treat every new account like a nobody from the start. Easier than to dig at all for any semblance of past likes and preferences.)

>>21456 >>21454 Thanks! I always use a VPN, but my internet activity/traffic is mixed. I use everything from one ip (VPN). I think I can be easily tracked by feds. Creating a new account is a good idea! For last 6 months I am slowly deleting old account, one by one. On some accounts I have changed nickname to unique or very common (like John123 or something). But still a lot of my accounts has my old nickname, which is connected to me IRL. Still would very appreciate any other advice about this topic, if anyone have something to say then go ahead! thanks again!

The /sec/ and /tech/ threads are full so I ask here. When I ping duckduckgo.com it gets the ip and then does a reverse lookup on the ip which resolves to a subdomain of azure-dns.com which is a microsoft company. Isn't that a privacy issue with microsoft knowing every time you resolve duckduckgo.com? Also I may be misreading this but it seems like devices on my network are adding themselves and excluding themselves from the multicast group. Why would a device exclude itself if only to add itself back later? Another thing I noticed is that devices are spamming MDNS requests and replying to those requests they just sent. First of all, why would a device even need to solicit itself constantly? Isn't it just way more efficient to wait until someone sends a request to multicast or broadcast asking for a domain, and then having that device reply?

>>21519 Use searx. You can find instances here ---> https://searx.neocities.org or https://searx.space

I recently used this to delete all my Discord messages ever, from almost every server/DM I could delete them from: https://github.com/victornpb/undiscord Now, there is no guarantee they're absolutely gone from the face of the Earth. Maybe, maybe not. However, in my opinion, it's more likely that they are really deleted, and here's why: 1) When you delete a video or a picture on Discord, you'll see that they are no longer available if you try looking at them again through a link (I think it takes a few hours to happen); 2) I also backed up some chats before deleting my messages. I only backed up the messages, because downloading media would have taken way too much storage. In a server with about https://old.reddit.com300.000 messages, the HTML file alone was almost a 100MB. My point is: the amount of data they need to host is already massive, imagine if they also made a backup of everything? Consider they provide all their services for free, excluding Nitro (which probably isn't enough to cover the costs); 3) Maybe a weaker argument, but: they claim deleted messages are gone forever, which may or may not be a lie. But lying about this would go against the GDPR, I doubt they want to risk a fine. To expand on the second point: I want you to think about Discord's financial situation. Discord is mostly funded by investors. But what return would they get, when the service is almost fully free? Maybe ads, maybe currently free features behind a paywall (they recently expanded their free upload limit though), maybe selling user data. It's not a happy possibility, but it's possible nonetheless. I suggest at least deleting all your messages and hoping for the best.

>>21532 Weird reddit link got there somehow lol

I got infected with this: TrojanDropper:Win32/Tnega!MSR Its bad? Im done? Why windows defender dont remove i??

>>21536 The fact you've been told what the type of malware is is likely evidence that Defender was doing its job identifying the malware. First, back up your important data and documents to an external drive or a cloud storage in a way that you feel comfortable with. After that, you have a couple options: Have near-complete assurance that the malware is gone by reinstalling your OS, or you can try TronScript. Remember to read the instructions carefully before running, and be aware that certain options could cause issues later on. Good luck. https://redd.it/10rucm2

>>21532 oh that's a cool tool, thanks. how did you backup discord messages? I would like to backup whole server including media

>>21412 Recently moved a bunch of my friends over from Discord. Chances are, (and I used to not believe this either) if they're real friends of yours, they'll move onto another platform with you. I suggest Matrix, it's a little bit jank but it's the best you've got if your friends are normal people. Also if you're too lazy to host an XMPP server kekekek. Oh but hosting a Matrix homeserver is miserable. Don't bother unless you're really paranoid. I happen to not care too much, just more than your average person. >>21674 I saw you sign another message on another thread. Why bother? Ain't the point of this all to be anonymous online? Or are you trying to get famous with a bunch of idiots posting on Lainchan.

How hard is it for someone to find me on discord if they know my discord username?

>>21412 People routinely get doxxed via old emails and old usernames. It happens via the service itself leaking it, archived copies, data leaks, and even insiders. If you need to leave your old history behind, you really need to start entirely new accounts, especially for socials like Discord. Segmentation of identities is at least as important as masking your IP.

>>21985 >1. For example, someone is logged in their Gmail account on one tab, and then makes a bomb threat on a forum on another with the same VPN connection. In what way did they troll themselves doing that? >hmm the bomb threat was made from Mullvad Estonia server number 5 with wireguard. They threatened to bomb university x. Hmm when we look at the logs for the university email tracking pixel analytics, it shows that student y also uses estonian mullvad servers with wireguard 1000s of different ways

>>21412 >I'm young with a cringe online history that I want to leave in the past. Consider that this data probably will be hacked and leaked some day. Normal people will be able to buy it and dig into it. These companies keep old backups, even if they delete your recent data, they keep those old backups around. 3 letter agencies consume that, but you have nothing to worry about unless you did something against the law. Remember that the internet is full of cringe teenagers doing soykaf, you are not the only one. I would be more concerned about those companies selling your data to random people, and these people giving 0 soykafs to security and your data ending up on a breached-like-forum.

theres a nice def con video about opsec of a drug site manager or smth

>>22269 uh my nebraskan heroine addict friend i made on the darknet said that guy was wrong about stuff and I listened to his darknet diaries episode and yeah he was kinda foolish, privacy stuff that was set up to protect against stalker-type adversary when he was trying to break the chain between him and darknet activities. threat models are not interchangeable and he probably put himself on some of the broad low-tier watchlists with his retarded antics. like with this stuff you need to think for yourself and be able to hold a few different concepts in your mind at once. here are some. threat models in a sort of order -government (no way to legally completely hide outside of the witness protection program, but you can force them to either leave a papertrail or engage in a lot of corruption) -corporate conspiracy (pretty much a stalker but maybe they can bribe corporations/employees instead of waiting for db leaks. this is kroll corp territory) -stalker (how to keep your location etc hidden from a dedicated searcher willing to attain some technical competence) -retarded coworker googling soykaf (how to keep BS slandering you off of your search results, how to remove info from the "we tell you about people" type websites, how to abuse EU laws to make companies pinky promise to delete your data) understand risk of unknown unknowns- how to reason about what you truly know about a solution and what you cannot confirm. How to think about the security properties and a capabilities you want like they are a robust mechanism with few moving parts. understand the multipolarity of identity/action. If you dox someone, but you don't connect those docs to anything- what does it matter? "here is a single mother in the midwest, her address AND her name" "uh okay but I already knew that people like this existed, why should I care?" Similarly, segmentation is king because you can segment your identities/activities so that getting "doxxed" in one respect doesn't mean anything in another way. e.g. people realize you are using a fake name on tinder, but nobody realizes you are hitler in disguise

>>22270 Not sure what you have heard nor the foolish privacy stuff that would protect against stalker-type adversary, but definitely the other points you've given were correct.

>>22236 There is none. Ignore the schizo.

>Hello, I recently starte getting paranoid about privacy and anonymity online...How do I educate myself on this? Here are some good starting points: https://prism-break.org/en/ https://ssd.eff.org/ https://help.riseup.net/en/security

>>21453 Usually that ones require account for watch content and besides a lot of people have it. If you can't evade this, my idea is threat them like they deserve, make a throw away email in https://cock.li and not interact at all, working like an anon for them. If you already upload some of your life to them the damage is done, simply change to some generated identity , delete or edit your pics to nosense and then ask to cancel account. The best you can do is threat this places like no welcoming for you.

>>23651 - I forgot, Use ublock everywhere. Blocking Js and fonts everywhere and whitelist the ones domains you trust. There is no solution in the actual internet without put effort in your side for maintain anon. Actually I can say with security, and after check by myself, I did it. It's like back to 2005.

>>23655 Hi. I checked out the site you lonked. First impression is a really easy going, old-fashioned site. But unfortunately, upon further inspection and reading some of the articles, it turns out to be a very soft-sell misinformation-propaganda distribution point skillfully designed to appeal to very naive people. Oh, well.

I've grown tired of this "opsec" stuff. Here is what "opsec" is: Common sense/basic logical deduction Research The research allows you to form an opinion on something, forms your logic. Maybe I am being a curmudgeon. Most of this thread is stupid questions, the answers are self evident, or readily answered by doing your own research™

>> >ProtonMail has your both keys (private and public), meaning they can read your encrypted mail Very good advice except for one small error. Proton Mail doesn't have your private key. The provate key is generated on the user's machine and is never sent to Proton Mail. Proton Mail only has the hash of the private key. For that reason, Proton Mail can't read a user's encrypted messages.

>>25920 Proton Mail has a desktop app and a cellphone app. They are installed once and used thereafter. They are not downloaded every time you use Proton Mail. They are not dynamic or changeable at Proton Mail's whim. They have the same protections from modification/corruption as any other app you install. They are open source and they are audited.

>>25922 >Proton Mail has a desktop app and a cellphone app Where is this desktop app you speak of?

>>21412 ProtonMail is not even good for everyday use since 1. Many online services (even pornhub) blacklist it 2. You need to pay in order to use a 3rd party email client like thunderbird

>>25923 >Where is this desktop app you speak of? I just apt install proton-mail

>>25924 >ProtonMail is not even good for everyday use Works fine for me. >You need to pay in order to use a 3rd party email client like thunderbird The Proton-mail app is free.

>>25925 >I just apt install proton-mail Of course you do. https://github.com/ProtonMail/WebClients/tree/main/applications/inbox-desktop >Proton Desktop is an Electron-based project that offers a native desktop experience for Proton Mail and Proton Calendar. Do you know what Electron is? It is a web browser that only runs a single website. This does not giving you any of the protections you are claiming in >>25922

>>25920 >Even if you audit the code one time the code might be different tomorrow or even 1 second from now. this is all assuming the js you initially received is inscrutable and that capability wouldn't be detected, it is not a serious analysis of proton's code and falling back on the same >I can't read code hypothetical you posted earlier. if the js updates itself, then that would be evident from initial inspection of it. >doesn't mean protonmail won't send you a backdoored version of the code to steal your password or private key after you become a person of interest. because in the real world a webserver can't just know who you are, especially if you're practicing opsec. >And what does your setup look like for continuously capturing and decrypting and scanning this SSL traffic for leaked secrets? I'm glad you asked! modern web browsers have built-in tool for doing exactly this. if you press ctrl-q and click on the "network" panel, you can see all the requests. there also exist tools for blocking new requests, such as uMatrix, that notify you with a high degree of friction whenever webpages want to load additional resources. many security autists use something like this in their web browser. > "I could do it in theory" therefor it's fine. every aspect of your "critique" is an untrue theoretical, so it's actually absurd that you would exceptionalize your own reasoning like this. >all you need is a basic understanding of how the web works something you evidently lack, as it is not a "dynamic javascript environment that protonmail [sic] has full control over", nor are you trusting them to run arbitrary code on your computer. in addition to the security tools already mentioned, modern web browsers are designed to protect laymen like yourself from seriously insecure webpages. >He is making common sense points (You) are not making common sense points, you are repeating arguments that have already been disproven in a different thread because your narrative got shot down in that one. and now you are also sameposting about it. >pornhub blacklists it oh, now i see what the real criticism is. fortunately for you, the browser security features mentioned earlier should protect you from some of those malicious pornhub ads you click on.

>>25928 >this is all assuming the js you initially received is inscrutable and that capability wouldn't be detected, >if the js updates itself, then that would be evident from initial inspection of it. This is how dynamic websites work. It is always asynchronously pulling code and data from the servers while the page is open. That's how new emails pop up in your inbox without you having to refresh the page. >because in the real world a webserver can't just know who you are, especially if you're practicing opsec. Except the part where you are logging into a specific email account. Protonmail can't decrypt your emails at rest but they can wait for your to login and then inject javascript into the page to steal your private key. That is something they can technically do with enough political pressure even if they haven't been caught doing it yet. A service like protonmail is still 100% trust based. It is not at all comparable to managing your own pgp keys and encrypting/decrypting the emails yourself outside of the browser. >I'm glad you asked! modern web browsers have built-in tool for doing exactly this. if you press ctrl-q and click on the "network" panel, you can see all the requests. Oh jeez. If you had said burp or mitmproxy then somebody might have taken you seriously. Ok so I logged in to protonmail and I have 82 requests and 10MB of data just from the login process. Your plan is to click on each one of these messages and inspect it manually to see if any data was leaked? Assuming you even know what your private key looks like base64 encoded on the wire. >there also exist tools for blocking new requests, such as uMatrix, that notify you with a high degree of friction whenever webpages want to load additional resources. many security autists use something like this in their web browser. Take your own advice. Open developer tools and watch your browser poll mail.proton.me every few seconds. Is uMatrix blocking those requests? If it did then you wouldn't be able to get your emails... >something you evidently lack, as it is not a "dynamic javascript environment that protonmail [sic] has full control over", nor are you trusting them to run arbitrary code on your computer. in addition to the security tools already mentioned, modern web browsers are designed to protect laymen like yourself from seriously insecure webpages. Browsing the web with javascript enabled is actually downloading and running arbitrary code from random websites. Browsers run the javascript in a sandbox in order to try to prevent malicious code fuarrrking with your files or unrelated websites. What we're talking about here though is javascript code from protonmail running within the context of the protonmail webpage. You already know that when you type in your password this javascript transforms it into a public/private key pair which is used to encrypt/decrypt emails going to and from the protonmail server. There is no technical reason at all that protonmail can't add an extra function to send your private key to the server.

>>25929 > That's how new emails pop up in your inbox without you having to refresh the page. yes and you know the contents of the requests in question. they are not encrypted with secret codes that you can't access. in fact you changed the goalposts from your original post claiming it could hypothetically send your key unencrypted (it can't anyways) to claiming it was encrypted in a way that you couldn't detect. it doesn't matter though, since it's still wrong. >That is something they can technically do with enough political pressure even if they haven't been caught doing it yet. this is something from that blog post you made months ago and its just as wrong now as it is then. from devever blog: >It is worth noting that this law also applies to non-web applications where the service provider supposedly being secured against is also the client software distributor; thus, the “end-to-end encryption” offered by Whatsapp and Signal, amongst other proprietary services, is equally bogus. (Both Whatsapp and Signal ban use of third party clients, and enforce this policy.) >By any normal definition of the term, a cryptosystem is backdoored if the vendor of a cryptosystem retains the ability to bypass it after its deployment. In this regard all web-based “E2E” cryptography can be regarded as backdoored, as can Whatsapp, Signal, etc. This would also apply to the securer alternatives like session, simplex, etc, and it would basically invalidate all secure applications ever. we know this is not true for any number of reasons from the fact that high-profile collectives continue to exist, whistleblowers stay out of jail and recommend these applications, and, tellingly, that governments want to ban Signal, session, simplex, tor, etc. >burp or mitmproxy because they're frankly not necessary to analyze the traffic in question but you're correct that those tools could also show you network traffic. I'm glad you're finally researching this topic outside of some untechnical old person (you?)'s blog post where he bitches about signal. And, I appreciate you actually opening your browser tools to take a look, I was hoping that naming the thing you have the most immediate access to would encourage you to use it. On the note of positives, I'm also glad you've stopped pushing the self-hosted mail as secure alternative to proton narrative since you last came here about it. >Browsing the web with javascript enabled is actually downloading and running arbitrary code from random websites. it's not, the code is not arbitrary otherwise browsing the internet at all would put your computer at risk. attached is a whitepaper detailing some of the reasons why this is not the case. >assuming you even know what your private key looks like base64 encoded on the wire if by "on the wire" you're referring to the packets sent out by the web browser in question then yes, I do know what base64 looks like, it is actually the purpose of base64 to be identifiable as possible and contain data redundancy so the contents are easily uncovered as well. Unlike certain beginner level ctf challenges might lead you to believe, base64 is not a format for secret messages it is a format for ensuring successful data transmission. >There is no technical reason at all that protonmail can't add an extra function to send your private key to the server. if this is how you address the argument that Proton has no way of know who (you) even are if you practice opsec then congrats on yet again changing the goal posts. at this point it seems clear to me you're not interested in seriously discussing the pros and cons or else you would have brought up the actual incidents that did involve Proton, engaged with the security audit, etc. instead of alluding to a blog post that argues true security is impossible, the entire industry is wrong, you should just give up and that anyways, you love big brother so you can Dominate on an anonymous imageboard. It's unfortunate really, since i actually do think that webmail is categorically a bad idea when dealing with state actors, that depending on your threat model considerations should be made regarding operations security and so forth. you however seem interested in dragging the conversation away from the real technicalities of the situation as well as away from the actual actions of law enforcement to hammer on a man's "law" made in a blog post that is in direct contradiction with how the security industry operates and verifies security - you know, the principles and operations that actually do keep people safe.

>>25916 Funny watching the CIA In-Q-Tel Crypto AG machine bury itself in real-time. No wonder the Taliban won. And now America retreats. Btw Applebaum sure would be funny if a Satellite accidentally de-orbited itself into your house.

>>25930 >they are not encrypted with secret codes that you can't access. Yes and no. You can see the data inside the browser with developer tools but once the data leaves the browser process it is encrypted with SSL. Running wireshark even on the same machine will capture nothing but encrypted data. And only the browser and the target website has the decryption key. If you're serious about analyzing every packet sent to mail.proton.me then you need to write a script. To write a script that runs outside the browser you need to decrypt the data. The two ways of doing that are get the browser to accept a self signed certificate then you can man in the middle yourself or get the browser to dump the encryption keys used for that session and then you can decrypt the packet capture afterwards. >in fact you changed the goalposts from your original post claiming it could hypothetically send your key unencrypted (it can't anyways) to claiming it was encrypted in a way that you couldn't detect base64 is not encryption. Obviously a leet hacker like you already knows this but I'll explain for the lurkers. Encryption keys are just big numbers but http is a text protocol so you need a way to encode the data into a text format. base64 is merely the most common way of doing that. The fact that there are dozens of other ascii compatible encoding methods they could use is not something I wanted to rub your face in. >this is something from that blog post you made months ago I don't know who you think I am. I can only answer to the posts I actually wrote which is >>25929 >>25927 >>25923 and >>25920 >because they're frankly not necessary to analyze the traffic in question If you're serious about analyzing every packet sent to mail.proton.me then you need to write a script. Just opening developer tools in the browser is not adequate. It would be a good project. Extract your private key from protonmail's totally readable javascript (according to you). Write a python plugin for mitmproxy which scans every POST request to mail.proton.me for the private key. I guess you should also scan the urls for GET requests too. You'll learn some stuff and you can put it on github or a blog to impress future employers. It won't prove that protonmail didn't steal your keys though. There are any number of ways they can exfil the data including just sending it one bit at a time everytime it polls the server for new emails or just attaching your key to an email your wrote. >pushing the self-hosted mail as secure alternative to proton Learn to use gpg and then every email provider is as secure as any other. The problem with self hosting is that most of the people you want to email use some corporate provider who will assume your custom mail server is spam and refuse to deliver your emails. >I do know what base64 looks like You don't know what your private key looks like though do you. All HTTP POST requests are base64... >if this is how you address the argument that Proton has no way of know who (you) even are Dude you are not this retarded. You login to their website. That's how they know who you are. If law enforcement wants to decrypt the emails for a protonmail account you use they can force protonmail to inject a javascript backdoor into the webpage after you login to the account. It doesn't matter how many times a 3rd party company audits the code because everytime you visit the site you are downloading new code from the server. That's why the idea of doing anything secure inside the browser is retarded. >you love big brother so you can Dominate on an anonymous imageboard. If you can put your ego away you might learn something.

>>25932 >There are any number of ways they can exfil the data including just sending it one bit at a time everytime it polls the server for new emails or just attaching your key to an email your wrote. Writing such a backdoor and injecting it into the protonmail webpage with beef or mitmproxy would be another cool project.

>>25932 >Running wireshark even on the same machine will capture nothing but encrypted data. And only the browser and the target website has the decryption key. correct. this is another reason why I suggested you use the in-browser tools for it. >you need to write a script >you need to write a script you also said this in the last thread. you don't need to write a script, but what you described is a valid (albeit wheel-reinventing) way of analyzing the traffic. >base64 is not encryption now you are just repeating my point back to me. >I don't know who you think I am pics related from when we had this argument months ago. you are rehashing arguments from the devever blog post "Web-based cryptography is always snake oil" which specifically argues that >the purpose of adopting snake oil “E2E” is not to deliver actual security, but to act as a kind of cunning legal maneuver to exempt themselves from the usual legal obligation to honour warrants, subpoenas and other court orders. By nominally adopting “end to end encryption”, these companies can theatrically throw up their hands when the government comes to them with a warrant: “Well, we'd love to help you, but there's nothing we can do!” it should be obvious this is an absurd assertion. >extract your private key from protonmail's totally readable javascript if my key was embedded in the javascript itself there would be much more serious problems (which would have been in the audit you still have failed to read anyways). >they can exfil data including just sending it one bit at a time. this is, again, assuming that some unstated method of code obfuscation exists that is not only irreversible but steganographically hides code functions for your browser to execute (also undetected) and send secretly within the request, hiding the information from even the browser. this is another absurd assertion. >Learn to use gpg and then every email provider is as secure as any other. untrue. webmail applications are not inherently secure as a program like thunderbird would because they rely on the browser's security and a secure integration between browser and webapp. This is actually something directly addressed in the security audit you spent the last several months not reading. furthermore, when we step out of whatever fantasyland you're trying to construct here you might find that different providers have a history of violating user security (under warrant) in different ways, based on how they provide their service. Lavabit, tuta, proton itself being some clear learning examples. Protonmail was created to do better than these services and provide actual security. It did to an extent, but you still need to be careful. >You don't know what your private key looks like though do you. All HTTP POST requests are base64... by your own acknowledgment, private keys are known. >that's how they know who you are if the outgoing emails are identified as part of an investigation for the particular address, then yes, "they" (being law enforcement) do know to investigate the content of that email and will send a warrant to "them" (being proton). Note that these are two distinct entities, and not one entity with the capability of both. Furthermore, we know that a number of secure email providers have cooperated with law enforcement and the degree to which they have done so. What you've described has not been identified and there's likely a number of cybercrime operations that would not exist if they did. I don't see a reason to assume that, in spite of the lack of cases where this very paranoid sounding exploit was utilized, it is still in use and will be weaponized if you use proton. As we have been humoring a number of your hypothetical worlds so far, I want to secondarily address your point of interchangeable security between private mail providers because they are not: https://digdeeper.club/articles/email.xhtml is another security autist's paranoia-world that describes the pros and cons in terms of data collection for different secure e-mail providers and the ways in which they do horribly. I would say I personally disagree with a number of the author's assertions, such as expecting email be provided for free. It's certainly a valid point that credit card information can be used to dox users of your services and limits the totality you can offer in terms of private communications, but accepting anonymous payments in present day is extremely doable. the blog in question is horrifically disorganized as well. this does not prevent it from being a marginally useful resource and unfortunately the best I've found so far in terms of listing secure email providers, most noteably it includes a number of criteria that would seriously compromise user security in ways that using PGP doesn't protect you from at all. your advice of "encrypt emails with PGP independently of what's being offered" is not in itself a bad one, however, it also isn't the secure alternative to an insecure email server nor is it really supported by the fantasy in which all law enforcement agencies and proton work together on a js-based, steganographic mitm that is run n your computer and undetectably sends your private key to the government. >If you can put your ego away you might learn something. aware that you're mirroring my patronizing tone with an intensification of deliberate ignorance, allegedly to test if I know what I'm talking about after assuming you were being tested. but I'm not the person who rehashed the same points that were addressed months ago in hopes that I could continue pushing the same flawed argument. that was all you.

>>25933 a project that would probably look extremely good to a lot of people is a no-js webmail portal, or a secure mail service which accepts payments in monero. the former actually sounds doable, now that i think about it..

>>25934 >you don't need to write a script Sounds like you don't know how to code. Clicking through the developer tools and eyeballing the requests manually is retarded. How are we even having this conversation. >pics related from when we had this argument months ago. Not everybody who disagrees with you is the same person. If two different people are telling you the same thing then maybe it's time to shut up and start listening. >it should be obvious this is an absurd assertion. I don't care about this dude's legal autism. My argument is purely technical. By all means use protonmail just don't oversell the protection they're giving you. >if my key was embedded in the javascript itself there would be much more serious problems It would help if you actually read my previous posts. <when you type in your password this javascript transforms it into a public/private key pair You will have to read the javascript to figure out how to dump the key. >this is, again, assuming that some unstated method of code obfuscation exists that is not only irreversible It's javascript. The backdoor can load, execute and then delete itself within a second and you'd never see it. >hides code functions for your browser to execute (also undetected) and send secretly within the request, hiding the information from even the browser. this is another absurd assertion. Obviously the protonmail code that generates your private key, uses it to encrypt emails and then sends the emails to the server can simply just send your key to the server too. The only absurd thing is you thinking that you will spot it happening because you know how to open the developer tools. The rest of your post is pretentious /hum/-tier trying too hard to sound smart dribble. I thought I could teach you something but your ego is too damn fragile.

>>25936 >clicking through the developer tools and eyeballing the requests manually is retarded you're going to pretend you already knew about these, im sure. but beef and owasp ptk provide ample functionality without having to write a whole new script from scratch. I'm sure there's plenty of other tools already providing the functionality. >Not everybody who disagrees with you is the same person. you are, though. its evident from the arguments being made to the way you argue. either way, you're deliberately failing to address the arguments made in https://www.lainchan.org/sec/res/24002.html . a thread which this whole conversation would be better suited for, to be honest - you're giving the impression that you failed to successfully argue your points in that thread so you came to a different one to spread the same FUD hoping nobody would call you on it. >If two different people are telling you the same thing then maybe it's time to shut up and start listening. several people have told you why you're wrong. I'm not even the person you originally started arguing with. >I don't care about this dude's legal autism. My argument is purely technical. Hugo Landau believes he is making a technical argument too. he's not, but hey that's how it is when you're wrong. >You will have to read the javascript to figure out how to dump the key. >It's javascript. The backdoor can load, execute and then delete itself within a second and you'd never see it. >Obviously the protonmail code that generates your private key, uses it to encrypt emails and then sends the emails to the server can simply just send your key to the server too. >>25933 is right. proof of concept or gtfo. I'm not coding a protonmail backdoor for you. >I thought I could teach you something but your ego is too damn fragile. your task, Professor, is simple. provide a sample piece of code doing anything that you've described. you don't even have to code it yourself, you may use any existing CVE to provide an example.

>>25937 >proof of concept or gtfo Are you retarded or pretending? They literally store your secret key on their servers, just name exactly what prevents them from using it? Even if it is encrypted by your password, what's so complex about sending it to their servers?

Proton Mail has been around since about 2014. In all that time, and with all their users, and all the emails sent, and all the people who would dearly love to expose Proton Mail as untrustworthy... Has there ever been a single case of Proton Mail being caught... - taking a user's unencrypted private key or - storing it online unencrypted or - or using it to read a user's encrypted emails or - taking any means of unencrypting a user's private key If so, please provide a link to a reputable source with adequate evidence. Thanks.

have you thought about stopping using discord?

>>25943 >no im definitely not the balding retard who calls end to end snake oil on my blog >cites the blog >rehashes arguments from it >literally calls it snake oil can it get any more obvious?

>>25911 A hash is meant to be an irriversible operation, so if they only had the hash of the private key, they wouldn't be able to reconstruct the private key in the browser for a new login. The other anon is correct, if the user is not providing the encryption key to the browser themselves at every login, then protonmail are, which means they have the key on their end. This is the reason why telegram doesn't handle secret chats across multiple devices well and whatsapp requires the browser to connect to your phone for the web page. There is only one theoretical way in which they can not have your private key and still allow for new logins. Your password is your encryption key. There is an easy way to check if that's the case: if you reset your password, do you loose all data and previous emails? Everything that you do not loose can easily be read by protonmail on their end without your help. That being said, protonmail had an instance of selling out their users to the feds: https://www.youtube.com/watch?v=QCx_G_R0UmQ At the end of the day, you should treat protonmail like any other mail service. Consider it insecure and encrypt with gpg.

>>25949 children like you undermine the entire anti protonmail argument, please don't do it again. >A hash is meant to be an irriversible operation, so if they only had the hash of the private key, they wouldn't be able to reconstruct the private key in the browser for a new login. they don't fuarrrking store the hash of your private key, as the other retard says, they store the hash of your password, and the private key encrypted by your password. this gives a false positive that they can't read your private key, which is untrue, because there is absolutely nothing that prevents them from stealing your password. this is the problem with snake oil. it looks good, until it doesn't.

One of the best OPSEC guides available https://github.com/superswan/onion-irc-opsec-guide