(untitled)

This is the Simple Security Questions thread for simple questions. >>22024 was full. If with a simple question and without a suitable thread already existing, post it here and someone will probably try to answer it. Remember to do some research before asking questions. No one wants to answer a question that a simple search can already resolve.

Whats the best way to transfer data across an airgapped computer to one connected to the internet? I hear people say this but lots of the time it sound like a good way to get AIDS or something. Can you use a QR code or plug in a Ethernet cable to transfer across?

>>25402 usb stick. ideally you'd have an untrusted usb port on which only storage media is allowed, so you don't accidentally plug in a malicious keyboard. dunno how that can be implemented though

>>25415 i.e. if you use udev maybe reject usbhid driver at a certain port, see udevadm info -a -p /path/to/device if not udev i have no idea

Will this help me protect when committing crimes? sudo macchanger -m c4:19:8b:$(tr -dc 'a-f0-9' < /dev/urandom | head -c 6 | sed 's/../&:/g; s/:$//') wlan0

>>25418 Good idea I would also change your exit node to little saint james too

>>25418 what is c4:19:8b and why is that important? why not randomize all octets?

>>25420 >C4198BDominion Voting Systems Corporation https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4

>>25423 Thats fuarrrking based but how do I make my exit nodes use Little Saint James, cuz I dont see a country code for the Virgin Islands?

>>25402 >Whats the best way to transfer data across an airgapped computer to one connected to the internet? ... Can you...plug in a Ethernet cable to transfer across? Yes, but that would be a great way to get your no-longer-airgapped computer infected with malware from the internet-connected computer. Just use optical media for the safest transfer... cd, dvd, whatever. Then you can keep it handy as a backup without having to worry about whether the unsafe computer corrupted the media somehow.

Is it ever possible to run torsocks to connect to proxy server (e.g. SOCKS5 Proxy). The desirable scheme: me <-> torsocks <-> SOME_PROXY <-> other Internet Or it is non-sense? I just heard that on some Linux distro like Tails/Whonix one could connect to VPN through Tor (I have no idea how it could ever be possible though). But can Tor or torsocks can be used to connect to proxy? Excuse me for being stupid

>>25489 You want a thing called proxychains (might be called proxychains4 or proxychains-ng in your package manager). You can chain together as many proxies as you want but Tor will only work if it's first in the chain obviously. And it only works with socks5 and https proxies. Normal http proxies don't work in a chain so keep that in mind if lots of proxies you try keep failing.

>>25489 torsocks is a socks5 proxy and afaik any socks proxy like torsocks can only connect to a HTTP proxy due to the protocol or sumthin >I just heard that on some Linux distro like Tails/Whonix one could connect to VPN through Tor On tails you would need to install foxyproxy add (to use a proxy) or install mullvad vpn (or other vpn add on) in the tor browser manually each time. On Whonix you would just need to install a VPN client software on the ws (work station) or input a proxy global network settings.

>>25492 >>25493 ありがとう, guys, proxychains4 is what I needed! It just works! You helped me so much! Also thanks for explaining on Whonix

>>25473 https://metrics.torproject.org/rs.html#search/country:vi

>>25499 Romania is better unless you want to get mogged like a filty scrub ExitNodes {ro} StrictNodes 1

>>25529 romania is a bulletproof hosting country that people use last I checked

ip2 any good now, scares me that it's written in java, other cpp forks scare me more

>>25535 I2P is fine, as a language Java is more secure than C/C++ because some memory safety bugs aren't possible. Don't know about quality, that's where Java's bad reputation comes from, the retard spaghetti coders that typically use it. i2pd (the C++ alternative client) works too but it's a reverse engineered hack of the not well specified canon client ("hurr Java code is the spec"), with only one guy working on it and nobody reviewing.

>>25567 Really? I thought i2pd was better and less likely to get mogged?

>>25568 y tho Ain't nobody ever analyzed them, no evidence either way. If there is such a sentiment, it's schizo internet wisdom originally made up by people who don't have the first clue about how the protocol works, didn't read the code of either, didn't do any in depth testing. i2pd seems more elegant on the surface compared to the Java monstrosity because i2pd does one thing well, has less feature creep and is more resource efficient. That feels like a good sign to nerds, but it doesn't mean it's the winner in terms of security, anonymity, correctness.

>>i2pd 1. The guy who has written it has written in fact quite some articles about fundamental and unfixable vulnrs in I2P architecture and exploiting them. 2. i2pd is written in C. While suitable for routers .... I suspect it has a lot of vulnrs and is an object of targeted attacks. One must be crazy to actually use it.

>>25572 >fundamental and unfixable vulnrs in I2P architecture sauce? >i2pd is written in C >One must be crazy to actually use it i2pd is C++ and mostly uses safe managed pointers. There's the hardened make flag to turn on more protections. Exploits are possible, but I'd be more worried about logic errors and protocol flaws.

>>25529 Read what they were asking >>25473

>>25569 >>25572 >translated to dont use i2p Attacking i2p lol wut a basic bitch pink hair dye tor fanboy/girl i2p be bussin on the filthy skrubs you can even use most vpns as an outproxy also which makes it straight rizz

>>25594 Just pointing out there's no proof for some of those gut feelings. If you want real I2P FUD: >I2P does not have stream isolation support which means that visits to Eepsites are linkable and fingerprintable -- each request includes the same X-I2P-Dest* headers, which are unique to each user. This might be true for outproxy requests as well. >If you access site1.i2p followed by site2.i2p, site3.i2p and so on, each one of those operators will see the exact same X-I2P-Dest* values. This means if they are colluding, they will know that the same person accessed all of them. >I2P operators can build a more detailed profile the longer I2P is left running. The X-I2P-Dest* values only change upon restart of the I2P instance or when the HTTP Proxy tunnel is stopped/started. I2P does not have a fix for this at present, however an experimental plugin is being written to provide a stream-isolating mechanism for http-over-I2P, see: eeProxy. https://www.whonix.org/wiki/I2p http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/I2p

How do I prevent ~/.local/share/gvfs-metadata/ from storing metadata and is their anything useful in here?

>>25604 >Since the writing of this blog post, the Tor Project Community has become increasingly concerned by reports of a pattern of tolerance for sexism, racism, and other bigotry within the Whonix community based even though all of it was proven baseless >Rabbi Rob Thomas real subtle >whats your point other then dont use i2p DO use I2P, but beware of gotchas and limitations >>25609 chmod go= ~/.local/share/gvfs-metadata/ && sudo chown root:root ~/.local/share/gvfs-metadata/ and see what breaks, or leave it alone because if the OS were out to GNOME you, it could in other ways

>>25609 A long time ago, when I noticed gvfs was interfering with my luks volumes closing properly, I did this, and it didn't seem to cause any system problems: mv /usr/lib/gvfs/gvfsd-metadata /usr/lib/gvfs/gvfsd-metadata.disabled

A site I help run is getting spammed to death. What's state of the art in anti-bot and captchas these days, or are captchas kill because of AI?

>>25677 SoA is PoW + cookie. If spam is predictable, reset cookies when detecting it. Whoosh suddenly spamming becomes hard. If they've got a botnet you are screwed.

Hey, old user here. Hey guys I need to put out a video with a song that's no in the Instagram Library ASAP but Instagram simply refuses to caption the song because it is not in the Instagram Library even though it is on Spotify. I'm kind of in shock and am running out of time on that - anyone know what to do? It doesnt caption the capcut - laidover audio, either. Any weird hacks to get it captioned (transcribed) or uploaded onto the Instagram library fast? Need it extremely urgently for a project.

Intel IME vs AMD PSP - which is worse? IME has ME Cleaner, but it only disables "most" of it. Whereas PSP doesn't have independent network access. So while it could still be compromised if the OS gets infected first, it's not a permanently-open remote backdoor. Combine that with Secure Boot to detect BIOS-level tampering, and PSP seems like the lesser evil.

>>25690 I think Intel ME and AMD PSP are just as bad. Your best choices at the moment are to either use ME Cleaner or an ARM-based computer. >>25677 Require mkproof, >https://sr.ht/~sircmpwn/mkproof/ >>25604 Stop trolling and acting in bad faith, outsider.

>>25677 I'm really waiting for you to fix Endchan. Thanks for all your work! You're a good fellow!

When did Tor Browser change its default useragent from Windows to Linux? What does this improve?

>>25694 I noticed that too. Is it using a linux useragent in the windows version too?

The more universal a browsers identifiable characteristics are across all users, the less fingerprintable it is. That includes useragent. So it would make sense for Tor Browser to use the same useragent regardless of OS.

Are there any places where I can discuss firewalls? Firewall wizards seems dead nowadays

>>25695 >>25696 I believe all versions of Tor Browser used to use a Windows useragent for this purpose. It's a mystery why it was changed, because 1) That takes effort, even if only a little, and 2) Websites are unlikely to break features and pretend that they're incompatible with Windows.

>>25694 >When did Tor Browser change its default useragent from Windows to Linux? 3 months ago https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests/1239 >What does this improve? The developers talk about why here https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43189 The tl;dr is that dumb websites who believe the fake user agent will break in various ways and websites that are really tracking you will ignore the fake user agent and fingerprint your real OS anyway so there is no point.

>>25702 >fingerprint your real OS anyway How? (with JS disabled)

>>25690 >>25692 https://media.ccc.de/v/36c3-10942-uncover_understand_own_-_regaining_control_over_your_amd_cpu From 2019, so might not be fully current, but at least these guys actually know what they're talking about. tl;dr: Are you running code on a remote server? No? You're fine. >So the question is, is this really a security issue? I mean of course it's a security issue, but for whom? So everything we did requires physical access to the device. So if it were my laptop, personally, I wouldn't be concerned too much. However, there are some things where this is a real issue. For example, if you rely on Secure Boot. Because the Security Processor is the first part that boots up, and if that is broken, everything later on is also broken. Christian already told you that AMD plans to use the Secure Processor Trusted Execution Environment. If your application relies on that, you better not have any security issues in that secure processor. And for the last part, the Secure Encrypted Virtualization technology from AMD is dependent on the integrity of the Secure Processor. If that is broken, this technology is also broken. Q: You have really nice, big power over the system right now. Do you have plans to make a PSP firmware which is minimal and which makes your system work but without some strange untested code? A: I wouldn't call it plans, yet. Of course, there are ideas to do that. The thing is, some of the functionality which is implemented from AMD is really required. So the stages that Alex talked about, they configure, or train your DRAM. So without those stages you don't have access to memory - your x86 cores would not work. And to re-implement that without having access to any manuals is really really hard work. So I'm not too confident that this will be possible in the near future. Q: I just refer to Management Engine Cleaner. There is such a project which makes your Management Engine firmware "slim". A: So the AMD firmware is already kind of slim. The only thing that is not strictly required on the systems we have been looking at would be the SEV firmware, which is loaded on request, and you can disable that by just flipping a bit inside that file. The system would still boot, but when it tries to initialize the SEV technology, the kernel would say okay, this does not work. The system will still work after that. Q: Have you found something evil or potentially evil in the code that it does? A: No. So far we didn't find anything which could be used for an attack, for example. So, what the PSP might be able to do is access PCIe devices. We found some code related to that, but we are not sure yet whether it's actually used, because also the PSP is executed or is existing on graphics cards made by AMD. So that might be also related to that. We couldn't find anything there yet. But so far the PSP looks rather clean compared to the Intel Management Engine. Q: For me, it seems like preventing to flash old, vulnerable firmware is really important for a scenario like Secure Encrypted Virtualization. Can you comment on how difficult it is for AMD to add this retrospectively? A: So technically, rollback prevention is there for I guess mobile devices for example. You have that, it should be possible. For adding this functionality afterwards, I don't think that's really possible because the on-chip bootloader is the thing that loads the off-chip bootloader and verifies it, and that software component has to stop loading if the firmware version does not match, for example, and you have to change that. And that functionality is not there and you cannot update the on-chip boot ROM, so in that sense I don't think that's possible to change. And if you look at our paper you will see that the firmware issues are kind of devastating for the SEV technology. Some keys which are now accessible, which can be used for attacking SEV-protected guests. Q: Did you analyze the API to the x86 core and did you find anything that could be exploited without flashing anything, so that you could directly go from x86 to PSP exploitation? A: Yeah we tried to find the necessary code to interface with the x86. We think we found one place where the x86 cores are released after the PSP initialized the whole system, but obviously we can't do much with it except preventing the x86 from booting at all. And otherwise we couldn't find anything there yet. We focused on [other things] like the memory controller and didn't have a deeper look into the x86 interface. So what there is is the BIOS can interface with the PSP using a special mailbox register which is mapped in MMIO space in x86 for requests. So if it can for example, the UEFI, when it boots, it will say to the PSP hey, this is my System Management Mode code region, please protect that for me. And it will execute this request. But apart from that we couldn't find anything so far. Q: Is it correct that your work enables 100% open source firmware for this kind of processors, and if so have you already contacted the coreboot team to make that actually happen? A: Well, 100% open source... as for the PSP, there is this on-chip boot ROM which we can't replace, so this will be closed source. Then there is code of the off-chip bootloader until the first exploit, which runs, which is not open source. In theory you could from now on take over the PSP, write your own code. But as I said before, you have to re-implement a lot of functionality without having any documentation. So technically, it's possible, I guess, to do something like that. Practically, I'm not too sure. Q: Is it possible to block PSP from within Linux or BSD for the system's runtime by using certain boot flags? A: What you can do, like Robert mentioned already, you can flip the bit in the SPI flash and then the PSP, once it initializes the whole system, it won't run the SEV app for example because the signal jobs won't match anymore. And there's no other sort of interface where the PSP is actually triggered, or we couldn't find it so far. Q: Did you try to enable any superpowers from PSP, like JTAG or special tricks with voltage, or something else? A: The first application that is loaded has some strings in it like "debug unlock" - sounds interesting. But then again, JTAG - where would you access the JTAG of the PSP? You need to have some connection to the lines, right? Q: Intel supports USB debugging. A: Yeah, I know. With special devices, right? Q: No, even via cable. A: Okay. So, anyhow, I have the suspicion that this debug unlock app is responsible to allow some debug modes which then, I assume, with special hardware, you have JTAG. But we have not touched it yet.

>>25703 TCP/IP stack fingerprinting TLS JA3 hash fingerprinting probably more https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting https://nmap.org/book/osdetect.html https://github.com/salesforce/ja3 https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/

>>25709 >TCP/IP stack fingerprinting Wouldn't that be fingerprinting the exit node? >TLS JA3 hash fingerprinting Wouldn't that just identify the libnss version shipped with tor browser? To test, here is my JA3 fingerprint on tor browser on linux, according to https://scrapfly.io/web-scraping-tools/ja3-fingerprint (requires JS). Can you try it from other OSs to see if it is actually different? 111d60d6a5d9d3ef1da5dca86397a325 In any case, that looks like a dumb decision as the user agent should just be "poop" and common to all tor users. No website has any legitimate reason to know my OS. >The tl;dr is that dumb websites who believe the fake user agent will break in various ways I've never ever encountered a website that would break because of the user agent. If anything, cloudflare used the user agent at some point to block curl over tor but allow tor browser. (Now they've added tls fingerprinting, which is bypassed by compiling curl with libnss) And looking at amiunique.org, the user agent holds a whooping 8.6bits of identifying information (0.25%), compared to 6.4bits for NoJS (1.14%). By the way, they've become rather useless, using the ETag header that changes everytime a page is loaded.

>>25710 >Wouldn't that be fingerprinting the exit node? Correct. >Wouldn't that just identify the libnss version shipped with tor browser? Not sure. It's not inconceivable that these libraries manifest OS specific behavior especially when an attacker is looking for it. Ever tried running mitmproxy against cloudflare? They see right through that soykaf. >No website has any legitimate reason to know my OS. Compatibility. You don't care about it but somebody donating money to the project clearly does. Remember Tor was created for spooks to phone home without getting caught not for you to soykafpost on lambdajs. >If anything, cloudflare used the user agent at some point to block curl over tor but allow tor browser. That would imply that curl --user-agent 'Mozilla ....' would work but it obviously doesn't. It never worked. There are many things they check for to know you're not a real browser including the presence and order of specific HTTP headers. curl and wget don't use compression by default that's one big giveaway besides the TLS stuff.

>It never worked. It certainly did. Source: I used it on my crawlers. It's only 1 or 2 years ago that it stopped working. I'm not saying they couldn't see throught it, they obviously could since they've "fixed" it since then.

>>25717 >That would imply that curl --user-agent 'Mozilla ....' would work but it obviously doesn't. It never worked. There are many things they check for to know you're not a real browser including the presence and order of specific HTTP headers. curl and wget don't use compression by default that's one big giveaway besides the TLS stuff. I came across this project some time ago: https://github.com/lwthiker/curl-impersonate but never tried it myself. It purports to build a version of cURL that can mimic the TLS and HTTP handshakes of several versions of various major browsers, including Chrome, Firefox, Edge, and Safari. It does so by linking against

>>25735 Sorry, didn't finish the thought. by linking against the TLS libraries used by different browsers, like NSS and Google's BoringSSL.

>>25702 >>25703 >>25710 Yeah, I wouldn't call this an improvement. Hopefully they reverse the decision soon. >>25735 yt-dlp bundles that now.

Is there no option to require manual page reload before NoScript permission changes are implemented, and why is Disable Restrictions Globally a top-level button that doesn't ask for confirmation? Any other footguns I should know about in this supposedly secure and private Tor Browser? Thanks.

Is there firmware on an SD card that can be modified/attacked if plugged into a malicious machine? What if the write-protect switch is on? What if a USB dongle is used between the machine and the card?

>>25763 The write-protect switch is enforced by software, so you should assume it doesn't do anything. I don't think there is much to compromise on an sd-card as the controller is quite simple. Cheap cards don't even do wear levelling. I don't see what the USB dongle would provide here, apart from adding another device to be potentially pwned.

>>25764 Maybe adding some kind of interpretation layer so the computer doesn't know what it's actually looking at and can't deploy the correct exploit? That's all I can think of.

>>25764 Is a USB drive's controller any more complex?

>>25763 this: >>25764 possibly of interest: https://www.bunniestudios.com/blog/2013/on-hacking-microsd-cards/ >attacked yes >modified ephemerally? definitely. persistently? requires the firmware's physical residence to be mutable and accessible. suffice to call it implementation-dependent >write-protect if all you care about is preventing flash writes some of the time, look into a hardware write blocker. us gov has a list of approved makes/models, and testing guidelines if you want to verify it yourself. there are also diy ones that block a decent portion of usb comms like: https://www.instructables.com/Cheap-and-Effective-USB-Write-Blocker/ if you want permanent write blocking, use worm media like optical discs or worm flash >usb adapter an exploit would have to go through the adapter (via usb) to the card (some other protocol), so probably requires an exploit chain where the adapter has to first be compromised >>25767 both have a flash controller, but usb also has a usb controller and some glue logic connecting that to the flash one

Would it be a bad idea to run Tor Snowflake bridge from home? >>25763 >Is there firmware on an SD card that can be modified/attacked if plugged into a malicious machine? Yes. Watch this presentation: https://www.youtube.com/watch?v=ruEn7TE4YMM (30C3: The Exploration and Exploitation of an SD Memory Card) This affects all flash-based storage media!

Is there any open-source programs or websites that let me train users to detect phishing? I mean a program that generates phishing emails (or just HTML documents) that look like real phishing attempts.

>>25770 >ephemerally? definitely. persistently? requires the firmware's physical residence to be mutable and accessible. suffice to call it implementation-dependent I have read the linked post and I'm not sure what you mean by ephemerally. The malware won't be able to spread to another computer?

>>25770 >>25772 Very interesting talk/blog, but it doesn't answer the vital question of whether a card can be reprogrammed through a standard connection, ie without the JTAG interface. If that's not possible, then it seems that there's nothing to worry about as long as you use your own trusted card. >Part of the thing about the SD interface is that the host drives the communication, so if you try talking back to the host it doesn't really do anything This is somewhat reassuring, although of course there is always the possibility of bugs on the reader/parser side being exploited to achieve some result (see PDFs, console modding, etc).

How do people unlink crypto money/hide outputs (lets say ethereum) to prevent triggering AML checks before transferring to high liquid stuff like XMR to wash? Ofc, in case of huge stuff, not just regular 10k fraud trash. I think chain bridging may help to trick aml bots?

>>25837 I'm a little confused by the context of your question. Are the bots protecting a centralized exchange from liability, when you are buying monero with ethereum? Do you mean that the bots just reject everything coming from e.g. tornado cash?

>>25838 I have seen some episodes of tornado cash funds being blocked from being accepted, tho its all my speculations. I speculate that most CEX do AML checks even for crypto2crypto, especially if your address has gain high attention.

how to get started with privacy? i dont want to make an entire new thread and im not one of those schizolarpers who wants "schizo level security." i just would like to remain as anonymous as i realistically can be.

>>25848 Since you can be tracked by your IP address, you might want to use a VPN or other proxy. Since you can be tracked by cookies and various browser vulnerabilities, you could set your browser to be very restrictive, and run bleachbit after using your browser. Since you can be tracked by the information you provide on the internet, you could limit it to a bare minimum, and give random, inacurate information whenever possible. You could refuse to use sites that require a cell phone number or other identifying information. You could keep a small footprint on the internet by limiting the number of online accounts, especially social media accounts. You could browse EFF's Surveillance Self-Defense section for more information. https://ssd.eff.org/

Hope this is the correct thread to ask. How dangerous is it really to selfhost a website on a home server, and how can I make it more secure? Not hosting anything inherently risky, just a personal site. But I'm afraid of messing up and compromising my entire home network. I'm vaguely aware of VLANs to 'isolate' devices on a network. But I don't know if my router supports it. Another I've seen is that chaining two routers together somehow prevents the server accessing the rest of your LAN? Is it possible to buy some hardware like a switch to physically achieve the same thing? I already have a reverse proxy on it through a cheap VPS, but not sure if that's enough.

500eth ($1.38M) was burned only to attach a note: "The bosses of Kuande Investment: Feng Xin and Xu Yuzhi used brain-machine weapons to persecute all the company employees and former employees, and they themselves are also controlled" https://etherscan.io/tx/0x5e8bef5dcb69206fa1bacc8d0b0c0204e12f1e45483d12b9f69dc1829ac74315

>>25855 Not very dangerous, if your server is configured properly to not become controlled by an attacker.

>>25848 > im not one of those schizolarpers who wants "schizo level security." i just would like to remain as anonymous as i realistically can be. What is the difference? They are the same thing

>>25855 >How dangerous is it really to selfhost a website on a home server As previously mentioned, if you take adequate precautions it's not too dangerous. >and how can I make it more secure? - Hide your IP address. It looks like you're already doing that with the reverse-proxy VPN. Or you could set up a Tor hidden service, or use Pagekite, - Use a secure router. A router that supports libreCMC is good. https://prism-break.org/en/categories/routers/ - Use a good software firewall and configure it securely. - Use secure internet-facing software, and configure it securely. https://prism-break.org/en/categories/servers/ - Be careful what information you provide on the website. >But I'm afraid of messing up and compromising my entire home network. >Another I've seen is that chaining two routers together somehow prevents the server accessing the rest of your LAN? Using the two-router approach, you would have your server connected directly to your internet-facing router normally. You would then have a second router connected to the internet-facing router. The rest of your LAN would use the second router. The idea is that the second router's firewall would provide a layer of protection from the server, and a second layer of protection from the internet. Or you could just use the VLAN approach as mentioned. >Is it possible to buy some hardware like a switch to physically achieve the same thing? Devices without their own firewalls or other protective shields would not provide the same second layer of protection as a second router.

I was reading this man page and I've noticed the following being said in the manual > Root Password > >Change the password for the root user. [...] Type the following command to change it: > ># passwd root > >To avoid the possibility of rogue files placed in the superuser's PATH, it should never contain the current directory ("."). How would that work, more exactly? I tried to search it up but I can't seem to phrase it correctly enough for it to give me any relevant results

>>25875 It simple means that you should double check that "." is not in your superuser PATH > How would that work, more exactly? Let's say you are root and in the /tmp directory and you have this PATH set: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:. (note "." in the end) An attacker puts a harmful script named ls in /tmp . When you (the root user) type ls , the shell finds the malicious ls in /tmp first (because . is in the PATH) and runs that instead of the real ls from /bin .

Is there any reason for not using default windows folder like "Documents", "Downloads", "Music", "Pictures" and "Videos" for storing data? My threat model is some virus that gets on my PC and simply copies away stuff from default locations (browser cache, desktop txt files, etc...). This virus runs at the same time I'm on my PC and doing something with those files (meaning they are not unencrypted) Quick google search tells me that yep, putting stuff in custom folders is more secure, but is it though? Are modern viruses smart enough to find my personal files on different drive in some random folder? (probably called photos or something)

>>25876 I thought about that but I find it weird that it's in the Root Password section (https://man.openbsd.org/afterboot#Root_password) I would take it as an error if it was some niche project that I found on github but OpenBSD is semi-famous for it's well-made man pages, it's also most likely one of the most read man pages as it shows it at the first-boot iirc. Maybe I'm just overthinking it

>>25878 What's weird about it? afterboot(8) is a collection of tips for new users. Section 8 in general is about system management. What would the "error" be?

>>25876 Nope. It won't use ls from /tmp. RTFM

>>25887 It will if "." is at the beginning of PATH instead of the end. PATH=.;/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

>>25877 > in random folder Thought they are smart enough to make some "findstr /s *.jpg %USERPROFILE%" or smth like that > on different drive They also could into some "powershell (Get-PSDrive -psprovider 'filesystem' | select -ExpandProperty name)" or something like that Straight, it depends on virus and priority. Firstly, the most viruses will find files in "Desktop", "Documents", "Pictures" (to steal or encrypt if encrypting they will 100% encrypt entire %USERPROFILE%-directory file. by file). And after that they will find in other places. It is always possible. Nothing prevent them The most likely viruses will look for files 1) recursively 2) by some mask (e.g. *.doc - for Word documents, *.jpg - for your pic) Will they find or not some file inside your Z:\abyggsddgodsasd\ folder depends on priorities (of virus and virus' dev). Of course, put file in similar dir you are just increasing time to virus to find and steal | encrypt that file. You just have more time to detect virus before it will find file. If you won't have time to find virus, well, most likely your precious file will be found by virus itself anyway

The fact that it's in the Root password section

What is the word on a VPN like CalyxVPN? Why did I only recently find out they have a free VPN even though I have heard of their custom android rom for privacy being up there with Graphene. Is it because it is slow, is it because it's being kept secret because it is slow and would congest the network if too many used it, or is it unreliable or is it not trusted anywhere near as much as a VPN like Mullvad?

>>25897 Free VPNs like Calyx and Riseup are just really slow.

>>25899 Are the speeds about same, better or worse compared to Tor in most cases?

Read in news on last ByBit hack: > "The attacker use of Developer1's AWS account originated from ExpressVPN IP addresses with User-Agent strings containing distrib#kali.2024," it said. "This User-Agent string indicates use of Kali Linux which is designed for offensive security practitioners." Why the hell does Kali Linux insert in User-Agent strings like "kali", even with the year of build? Is it a global red flag? I always thought the hacker must be kinda quiet, silent and inconspicuous. But there is distro for hackers that say "Hey! It's me! Hacker on hacker notebook being on your site! So hackerish! Wow!" Does the using of Kali the opposite to the thing it should be - stay silent? Kali is like yelling: "Hey, looking for hacker? yeah, it is me, I got so many sus packages in my System, I'm really into this thing" Thought that the real hacker (at least) User-Agent must be like "Mozilla 5.0 / Firefox 136.0 Windows 10" or "Mozilla 5.0 / Firefox 136.0 Ubuntu 24.04" Is it really thing with Kali or I got wrong?

>>25901 If this is true it wouldn't surprise me, kali or any "official" hacking distro is supposed to be made for "security professionals" aka white hackers. no serious criminal hacker uses kali as a daily drive, they usually have custom tools and custom setups. It's supposed to be a reproducible distro for quick deployment where only offensive security is taken care off.

>>25901 Kali Linux is a respectable distro intended for use by people learning penetration testing. It has no reason to conceal its identity. If someone wants to use it for illegal hacking, and is too stupid to know how to cover his tracks, then that's his problem.

>>25902 >>25903 Got it. Thanks!

>>25901 >Thought that the real hacker (at least) User-Agent must be like "Mozilla 5.0 / Firefox 136.0 Windows 10" or "Mozilla 5.0 / Firefox 136.0 Ubuntu 24.04" There are ways to detect the core OS through FingerprintJS so spoofing it would only make you look more suspicious (not to bots but people actually analyzing the traffic/looking for forensics). >>25902 >no serious criminal hacker uses kali as a daily drive, they usually have custom tools and custom setups. No actual cybersec researcher uses kali as a daily drive, it's mostly script kiddies who find out about kali being a "hacking OS" and flashing it onto their HDD without much thought. That being said, I think kali can be good as a pentesting OS for black hats as long as they use the liveUSB due to it's volatility, you'd of course need to layer it over Tor in most use cases but still, no trace no case Most white hats also use it as a pentesting distro due to the pure convenience of it

>>25900 From my personal usage they are both slower compared to tor. You can try testing them with Librespeed to see if they are faster for you or not.

I feel like this should be a simple question but I can't seem to find any answers that don't accept concessions for security or management. I'd like to implement SSH certificates in my organisation with: Non-repudiation: Users should sign into the servers they have access to with their own accounts Group based access control: Servers should only accept connections from users that are authorised via group membership Central management: Authorisation should come from a single source of truth like an LDAP server All solutions I've seen thus far either use shared accounts with principals in the certificates for group based access or they're using config management like ansible to control authorisation via different sshd_configs per server. Admittedly I haven't RTFM for PAM and NSS and I feel like my answers may lay there so if anyone could link some good resources for those I'd appreciate it.

>>25908 >Non-repudiation: Users should sign into the servers they have access to with their own accounts I am not sure what you want with this. Non-repudiation typically means "Someone commits to something, and they can't repudiate (deny the validity of) the agreement later" Do you mean that you want the ssh keys involved to sign something in an (...cryptographically...) undeniable way, like sign all the content sent across the ssh connection or sign the time/date the ssh session started? Or just that since they should be the only one to have their account, they should be held responsible for what it does?

>>25912 >Or just that since they should be the only one to have their account, they should be held responsible for what it does? In this context, this. Too many of the solutions I've seen rely on shared accounts. When I look at the logs trying to find out who performed what action I should have an immediate answer. If they're all shared accounts then I'll be asking 20 questions to figure it out.

>>25877 >Quick google search tells me that yep, putting stuff in custom folders is more secure, but is it though? In an absolute sense, no. If your stealer is only looking in default directories, sure, but basic Windows system commands like dir and findstr can be used recursively to search the filesystem for interesting filetypes. They're not as robust as things like unix locate or find, but they can definitely be used to sniff out interesting filetypes that might have useful data in them. >Are modern viruses smart enough to find my personal files on different drive in some random folder? (probably called photos or something) Good modern malware should be fit for purpose in an enterprise environment, where there's going to be all sorts of weird soykaf like network fileshares mapped to zany drive letters and all sorts of soykaf like that.

How should I get into desktop appsec? I've been coding for a few years now but I've never touched upon the security aspect of it other than a few books on coding standards. Are there any books that could introduce me to appsec from a beginner's perspective? I tried to look for them but all of the books that I've found are for web appsec which I'm not interested in. I'm fairly familiar with white-box testing as I said in the aforementioned statement but I'd like to get dirty with grey-box/black-box testing aswell. Books on how to write exploits are also appreciated

Sorry if this has been asked before, but what is the current stance on smartphone security for the average user? Is LineageOS enough ? Is Graphene OS compromised by glowing folks? Should I choose a Linux distro based phone instead like Ubuntu mobile?

>>25989 grapheneOS is miles better than anything else. Linux phones are too useless. lineageos is just worse in every way: less secure, less stable, less usable. Nobody can know if it is glowed

Lainfriends, I’m looking for a solution to this scenario. I need to mimic the IP of my home country while I’m on vacation - to connect to internet services at home concerning work. Now the issue is that the vacation country is China and I want neither the Chinese gov know where I connect to, nor do I want the VPN provider to put me on a list because I connected from China. How should I solve this issue? Should there be a series of VPN connections? I’m afraid this would make the connection too slow and unreliable. Another solution would be to connnect to my workstation at home remotely so I use my domestic internet connection for the work services. Bonus points would be that I wouldn’t have to setup the laptop that I’ll take abroad, it would act just as a client. Negative is that China would exactly know where I connect to (my home). Or is there a simple firewall fix to make this irrelevant?

>>25994 Option 1: On your laptop, set up Tor to only use exit nodes in your home country. In China, use obfuscated Tor connection, bridges, whatever. Option 2: Set up your own VPN on a second computer at home. Use it from your laptop in China.

>>25999 Option 1: Install shadowsocks on your bussi Option 2: Don't live in China and don't bleach your bussi

>>26001 >Don't live in China that's based but the way things are going we may yet all live in china so might as well prepare out assess for the true cyberpunk

Which is better in terms of security/privacy/anonymity between Session and SimpleX if I want to set up a group chat for a small online community? Security/privacy/anonymity aside, how do these protocols/programs compare in terms of features and user experience?

>>26004 SimpleX, because it allows for anonymous identities with a single profile AND has built-in Tor/Orbot support

How in-depth am I allowed to go in commenting and analyzing the inner workings of proprietary freeware? In the license of the software they write: >You can edit, break, and modify the exe for your own personal and academic use. >You can redistribute and mirror our software in it's entirety with all documentation and executables intact. >You cannot sell, modify and/or repackage our software and redistribute it. Does this mean I am safe when making a public analysis of this software's inner workings or is there still a risk involved?

>>26004 https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

>>26015 Crypto nerds... >Does This Matter? No. No it fuarrrking doesn't because these apps are sidechanneled in 10 different ways. The attack vector is never cryptography but "encrypted" cloud backup of the app state or some "AI scanning" the proprietary operating system does. I don't even know about Session but it seems immediately better than Signal because it doesn't require a phone app to register an account. It runs on a truly open source system which iOS and locked down vendor Android aren't. It could use PGP which is the soykaftiest chat encryption and it would still be ahead of Signal. What good is forward secrecy when you're forced to share the key on an untrusted platform? >The servers that store, send and receive messages on Session are operated by everyday users of the platform Onion routing in that network too, cool. Open to Sybil attack maybe, but at least they're trying. Signal backend meanwhile has social graphs with real life ID of all users.

>>26014 It's revers engineering, no? Licenses usually mention whether you can do that. If their doesn't, fuarrrk 'em.

>>26016 Years ago I read the strong recommendation for signal from people I trusted to know what they were talking about, like Snowden. So I downloaded it and started to install it on my phone. I took one look at the list of permissions it wanted and immediately deleted it. I don't care who recommends it. IMO anyone who install something on their phone that has complete access to every aspect of their phone, for no apparent reason, and could completely pwn them if it had a back door, 0-day or exploit, is an utter fool.

>>26016 >some "AI scanning" the proprietary operating system uses Session would also be affected by this. you're being completely dismissive of a blog post because the technical details are hard for you to wrap your head around, FUDing encrypted messengers all for what, more users to join your hipster encrypted messenger chat room that might have some serious flaws which you don't seem to understand. >sidechanneled 10 different ways citation needed. one of the actually legitimate criticisms that affected Signal's implementation was its failure to implement something called trust on first use or tofu. this criticism was basically headed by a post on the keybase blog: https://archive.ph/aY19B which has since been updated since the keybase devs respect the signal project and felt the negativity and singling-out of gold standard encrypted messengers could fud people and undermine their mission. its ironic, because the furry blog post gets into the subject of tofu saying it isn't implemented, which is pretty concerning when you consider that the keybase post was mirrored by one on the session blog itself: https://www.getsession.org/blog/trust-on-first-use-the-achilles-heel-of-centralised-messengers and considered to be one of the rationales for the project. >Truly open source system >locked down vendor androd >It could use PGP which is the soykaftiest chat encryption and it would still be ahead of Signal. I don't think you know what you're talking about. Can you please elaborate on how Session could use PGP, and why PGP is as you put it the soykaftiest? Can you perhaps elaborate on how you're "forced to share the key on an untrusted platform", or are you just again referring to the AI keyboards that smartphone users can optionally use and are a security risk.

On my server's logs, I see a lot of requests for /back/website.rar, /bak/bak.rar, /bak/wallet.zip and other such files. Needless to say none of those files exist, but I was wondering if that sort of blind crawling had a name. As an auxiliary question, are those files associated with some particular software, to make that scanning worthwhile?

>>26018 To Signal's credit permissions can be disabled without breaking the app. Phone number, metadata collection by the server make it useless for anything other than normal person chat. >>26020 >Session would also be affected by this. Not on GNU/Gentoo+Linus, would it? >more users to join your hipster encrypted messenger chat room I use soykaf like Discord and Apple Messages, people don't want to try new chat apps for some reason >you're being completely dismissive of a blog post because the technical details are hard for you to wrap your head around Let's talk about technical details. These mistakes prove Session devs retards or glowies true but impact is a nothingburger. Phone numbers and tattling smartphones get targets found, 128 bit entropy and the possibility to maybe (no PoC) mitm inject fake messages into a chat don't. Soatok goes on about government data center cracking keys in part 2, what they really do is Ctrl+F the NSA database which applel goolag proudly contribute to, use their pegasus subscription or seize and unlock the phone. Soatok recommends Signal and doesn't recommend Tox. One is used in high profile ransom negotiations, the other by people sharing a jail cell. Signal can't be anonymous and it's only as private and secure as phones. Tox has no requirements, works over Tor, can be anonymous and private. Why he doesn't recommend Tox https://github.com/TokTok/c-toxcore/issues/426 >if A's longterm static private key is stolen, an attacker can impersonate anybody to A without A realizing Precondition is private key stolen LOL. If this isn't a nothingburger then I don't know what is. Guy says he doesn't recommend based on this. Soatok thinks about crypto protocols not entire systems. Gives recommendations as if the protocol was the deployed system. Excellent at what he does but misrepresents impact and gives misguided recommendations. >>26025 >if that sort of blind crawling had a name HTTP enumeration, every server gets these, it's like email spam safe to ignore. >/back/website.rar, /bak/bak.rar, /bak/wallet.zip >are those files associated with some particular software website.rar, bak.rar would be backups with user data or server credentials in them, wallet.zip cryptocurrency keys. These could be associated with some software but it could be random paths chosen by victims in the past.

Session is retarded. We had tor, so they took that and then made their own smaller network. Why do such a thing you might ask? Massive glitterboyry is the answer.

>>26025 On my server's logs, I see a lot of requests for /back/website.rar, /bak/bak.rar, /bak/wallet.zip and other such files. Needless to say none of those files exist, but I was wondering if that sort of blind crawling had a name. As an auxiliary question, are those files associated with some particular software, to make that scanning worthwhile? there's tools like dirbuster or svndigger or whatever that will take lists of known directories and things and do just that. if you see things like site.net/../../etc and stuff like that it's called directory traversal. otherwise they're just spamming lists like with hydra, except with directories. there's all kinds of bruteforce things like this, dnsmap spams dns to find subdomains. i've never used sqlmap but it probably just throws a list of sql injections at things to see what works in the same way.

>>26027 >>26029 Thanks. HTTP enumeration is the word I was looking for. I'm kind of tempted to send them random bytes now to make them waste time and storage. I was thinking those files/dirs were associated with some software, because I don't know who would leave backups readily accessible like that otherwise.

>>26030 >I'm kind of tempted to send them random bytes now to make them waste time and storage. I knew a guy who got some junk mail with a postage-paid return envelope. He put a brick in it and sent it back.

>>26014 You can't distribute any modified versions. But otherwise you should be good.

>>26028 https://www.getsession.org/blog/session-release-roundup-4 >Mobile users might notice a mysterious glowing dot in the corner of their Session app — try tapping on it to find the brand new onion requests display >glowing are they having a giggle? https://www.getsession.org/blog/how-session-protects-your-anonymity-with-blockchain-and-crypto >We couldn’t do this in another coin’s economy, since we wouldn’t be able to modify their blockchain algorithm to create new crypto with which to reward Service Nodes. session was a crypto coin pump grift all along? the level of marketing makes sense now

>>26058 Tor works well behind NATs, I don't think it should be any different

How do SVG exploits work? If you open an SVG file with a text editor and don't see any URLs, just "stroke" and coordinates, can it be considered safe?

>>26091 >How do SVG exploits work? Retard programmers have their programs execute JavaScript or PHP inside an SVG file. Command injection. "If I include le file in le HTML/PHP, it will be included? How is this possible??" >If you open an SVG file with a text editor and don't see any URLs, just "stroke" and coordinates, can it be considered safe? Probably safe, but technically any file that looks perfectly legit to an expert's eye could contain an exploit if the program processing it is soykafe enough.

>>26095 >>26091 This, never underestimate a good steganographer.

>>26028 I don't trust them, originally founded in Australia then changed it's stewardship to Switzerland, seems sus to me

Any lain here used the site https://www.protectedtext.com/? What do you think of it? They advertise themselves as simple, fast, secure and ad free. Even if asked by feds to hand over data, they say they'll refuse to. I think it's foolish to trust them, but nevertheless, I'd like to hear your opinions.

>>26137 Elaboration: >By "if you've used it, what do you think of it?", what's your opinion on the UI, the code itself (if you've read any snippets), the mobile app, their policies, what they stand for? Are they as safe as they advertise themselves to be? It has been recommended to me by some friends who are not that tech savvy because I wanted somewhere to host some text notes temporary in a non-physical way.

>>26137 Q: Is the server code available somewhere? I'd like to host the service myself. A: We haven't opened the server code, for now. We'd like to provide perfect security to everyone, not just tech users. So we've created this approach where server side is irrelevant - that's the beauty of this service. Nobody should be forced to trust anyone in order to be secure; that's why all security is provided from the client side (which users can verify). Even if you knew the server code, you couldn't confirm whether that code was running on server, or if it was replaced by something else. In other words: whenever a server's code is responsible for providing security, you have to trust whoever runs it. Q: How long do you keep sites on your servers? Will they ever expire? A: Sites aren't deleted automatically. We'll keep them until you delete them yourself. It not being open source is a red flag imo, you can't even make sure their claims are actually valid. I'd only use it if I encrypted the data myself, and I posted it over Tor or some other anonymizer.

>>26142 Thank you for replying to my low quality question and perhaps skimming through the whole website in order to do so. This board has been very useful, especially the archived thread and the programming pdfs. I admire the culture here. Reminds me a lot of the rat and rat-adj communities I've interacted with. May you and other goodwilled lains who lay their eyes upon this post on /me/ have a good day. I'll go back to lurking.

>>26131 I mean swiss privacy laws are supposed to be the best in the EU area, so I don't really see a problem with that.

>Even if asked by feds to hand over data, they say they'll refuse to. >I mean swiss privacy laws are supposed to be the best in the EU area, so I don't really see a problem with that will people ever learn? trust and laws are proven to not mean anything, use client side encryption and don't run proprietary code (including js) for sensitive tasks

I'm just a random tourist curious about something, sorry if this is the wrong place to ask. The imageboard that allegedly leaked 4chan stuff "soyjak party" (careful about visiting) apparently has some extremely aggressive port scanning. Anyone know what that's about?

>>26166 that's interesting, where did you find this info? i didn't notice anything the day of the hack though i wasn't using JS (HTML and CSS only). One thing i noticed is that now they use cloudflare like 4chan so you need JS and everything else to use it. I looked into one of those ports and it's for a VPN protocol (L2TP), and the second image has a GET for a "tuxler" thing which looks like a fishy VPN that "shares" your IP with others. 6463 is discord RPC listed on wikipedia. It would be curious to see the behaviour of this is replicable on a IP part of the tuxler network. One thing i also noticed from a whois check is that they are hosted by INCOGNET. Digdeeper made a post about incognet fuarrrking up with their servers, apparently after doing a fresh reinstall he found images around and he thinks they might be data of other users on the incognet servers (which means the servers are badly configured) and the staff first said it's normal then denied accusations. https://digdeeper.club/articles/incognet.xhtml I can make some theories but i'm not an expert on this field and i'm just dumping this info and waiting for someone that knows better if this is anything.

>>26167 Found it on the 8ch moe v meta thread.

Podcasts lains - what ones are worth listening to in 2025? Michael Bazzel's one is gone, Malicious Life is kill, only Darknet Diaries is still plodding along. Recommend me some new ones.

>>25397 Hello everyone! New user here. You know why.

>>26027 >the other by people sharing a jail cell To what are you referring?

Speaking as a person with an everyday, non-glowie threat model, and a linux user, what are some of the basic security practices I should be implementing, that would keep me safe from most regular threats. Regarding password managers, I'm currently using pass and have a git repo with which I'm syncing it to my phone, almost all of my credentials are there, I have recently written down a few passwords which I won't be able to use pass for: My user login My root login My gpg passphrase, since I need that to access pass My ssh passphrase The passphrase to my encrypted borg backup The passphrase for my faculty student account (we sometimes have to log into their computers, without having a phone with us) Also, at work we have to have a whole bunch of accounts for everything (the pc, microsoft, github, gitlab etc.), and I don't care enough to set up a different pass instance just for work, so I just have: 1 password I use for everything on my company machine 1 password I use for everything on my client's machine I have these written down as well. I plan on rotating all of these written passwords every 6-months or so. I also have a certain VPS I'm sharing with some friends where we're hosting some services, including the git where I store my pass repo and a mail server. I think we've done most of the standard things you'd expect when trying to secure it, don't allow password logins, close any ports you aren't using, keep things updated... Is there anything that I could be doing better here?

working my way through pwn.college for fun. i have no idea what is wrong with this query string but it keeps 404'ing in netcat. i'm not even getting any of the scripted errors, just a 404 after connecting. netcat -v challenge.localhost 80 GET /request?access=ejnskvxx&token=rmxwpdzo&signature=fhhmtasz HTTP/1.1 and flask script @app.route("/request", methods=["GET"]) def challenge(): if name_of_program_for(peer_process_of(flask.request.input_stream.fileno())) not in ["nc"]: flask.abort(400, "You are using an incorrect client to access this resource!") if flask.request.args.get("access", None) != "ejnskvxx": flask.abort(403, "Incorrect value for get parameter access!") if flask.request.args.get("token", None) != "rmxwpdzo": flask.abort(403, "Incorrect value for get parameter token!") if flask.request.args.get("signature", None) != "fhhmtasz": flask.abort(403, "Incorrect value for get parameter signature!")

>>26221 Host header missing maybe?

>>26221 Maybe you put app.run() before you register the routes?

Do game consoles harvest and report details about what's connected to them (your network hardware, TV hardware, etc)? I know they do telemetry, but what's actually in it?

>>26216 > Is there anything that I could be doing better here? Probably, but if your system works for your threat model and lets you live your life then good on you. > Requiring different pass instances You could switch to KeePassXC and sidestep the need for different pass instances (instead you have different encrypted .kpdx database files). There is a cli interface available for it (keepassxc-cli). pass also leaks metadata, but since you're not worrying about glowies that shouldn't be too much of an issue. Just something to think about. > Regarding password managers, I'm currently using pass and have a git repo with which I'm syncing it to my phone You can use Syncthing (https://syncthing.net) and the (unofficial, working fine) Android fork (https://github.com/Catfriend1/syncthing-android) to sync the files automatically if you like. There is apparently an iOS client for Syncthing, published under the name Möbius Sync: > A reader (neropol) has pointed out that there is in fact an iOS client for Syncthing, published under the name Möbius Sync. It appears to be free, but it apparently has in-app purchases that relate to its sync functionality. I have not tested this app, however, according to neropol it has been working great for his use case. > Source: https://xn--gckvb8fzb.com/build-your-own-decentralized-dropbox-with-syncthing/ > Work setup and passwords Again, see above on (possibly) switching to KeePassXC. More importantly, if you use the same device for personal things, school, and work, consider making separate accounts on your machines, if not using separate machines for them altogether. On a semi-related note, how is borg backup in daily use compared to incremental rsync backups? >>26241 > Do game consoles harvest and report details about what's connected to them (your network hardware, TV hardware, etc)? Probably. Only way to know for sure is to MITM the connection and see what telemetry it sends back. > I know they do telemetry, but what's actually in it? Not sure. You could record some network traffic from it and analyze it in Wireshark.

>>26241 Setup tcpdump or mitmproxy and set it as SOCKS5/HTTP proxy in your network settings. If they use TLS you're gonna run into issues because you'd need to install mitmproxy's root certificate to be able to decrypt traffic without the console dropping it because of the invalid certificate

Am I stupid or is there no way to restrict a single app on android to VPN-only, specifically with orbot? It seems like the only two options are either getting anonymity when android feels like it because it uses the normal carrier network as a fallback or forcing all traffic through orbot with the predictable result of having an unusable phone. This would literally be the first use case to think of, who designed this soykaf?

>>26268 use NetGuard, you can force apps to use a proxy which in your case would be Orbot running locally.

>>26256 Surely for such popular platforms someone has already done the work for this...

Hello, I'm working on a CTF challenge and I'm a bit stuck. I performed stenography on an image (pic rel) with Zsteg and found that it contained various files to be extracted: Zsteg output: ``` b1,rgba,lsb,xy .. text: ["w" repeated 96 times] b1,abgr,msb,xy .. text: ["w" repeated 96 times] b2,r,lsb,xy .. file: VISX image file b2,r,msb,xy .. file: 5View capture file b2,b,lsb,xy .. file: VISX image file b2,b,msb,xy .. file: 5View capture file b4,r,lsb,xy .. text: ["f" repeated 96 times] b4,r,msb,xy .. text: ["f" repeated 96 times] b4,g,lsb,xy .. text: ["3" repeated 96 times] b4,b,lsb,xy .. text: "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUT333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333" b4,b,msb,xy .. file: 5View capture file ``` I ignored the VISX files and extracted the 5View files: ``` zsteg -E b2,r,msb,xy ccsw.png > cap1.5vw zsteg -E b2,b,msb,xy ccsw.png > cap2.5vw zsteg -E b4,b,msb,xy ccsw.png > cap3.5vw ``` However, when I tried to analyze the files in Wireshark, I got the following error: ``` Wireshark: The file "cap1.5vw" contains record data that Wireshark doesn't support. (5views: header version 2863311530 unsupported) ``` I also tried to convert the file into a .pcap file, but got the same error. I can't find any information online about what the issue is or how to fix it. I've attached one of the 5View files for reference. Any help is appreciated. Thank you.

where can i start learning powershell/windows exploitation from 0? i looked at mimikatz and powersploit but i dont understand much. my first goal is running a program as admin from a user shell

>>26295 just found this recently, its like overthewire but for powershell. https://underthewire.tech/wargames writeup https://alexbsec.github.io/powershell-command-injection-root-me tryhackme has a powershell game too

is there a big list of crackme's and CTF's?

>>26298 heres a few links I've gathered. I got most / all of these from lainchan, though, so if you read through the catalog you'll find a good supply of them. for instance the ctf thread here: https://lainchan.org/sec/res/18888.html or using the search: https://lainchan.org/search.php https://crackmes.one/ https://github.com/ctfs/

What sms verification services work for creating google account? JuicySMS used to work but now is trash SMSPool used to work and countries that do get sold out Before you ask I need a free google dev API key and also account for other purposes (Yes it is possible to stay anon with an account if you use Tor and KeePassXC for 2FA)

>>26352 lol google is cyberhumping you I bet but juicysms re-uses numbers now it is like kicking dead whales down the beach I to myself have yet to find an alternative

>>26352 Google and Tor, yeah that's not gonna work buddy. Your account will get locked the picosecond it's made and verified.

>>26355 Works for me everytime, the only time you get locked is if you DONT enable 2FA with Authenticator aka KeePassXC and backup codes. The only times you get locked out is if you dont. https://tails.net/doc/anonymous_internet/thunderbird/index.en.html#index1h2

Is there any One Time Pad (OTP) inplementations that people could share like software or scripts?

>>26355 >>26353 >>26352 >>26356 >using SMS verification to farm Google accounts It's not 2015 anymore, that doesn't work. I can't believe you haven't figured this out, but there's a much faster, better method that doesn't require SMS verification. I won't tell you what it is, because then one of you Jews will bug bounty it, and Google will block it. But I've already said enough for you to (maybe) figure it out if your IQ is high enough. Heed my words, for they are true. And if you do find the way of which I speak, I beg you not to post it here, because you'll just ruin it for everyone.

>>25397 What is a gud WiFi router that will have continued longterm support with OpenWRT aren't all the TPlink Archers have Qualcomm Snapdragon? (i dont want to get cyberhumped)

So serving web pages on an onion address is really trivial but is it be possible to setup a listener (f.e. netcat) that accepts a connection over a tor onion address?

>>26374 yeah , why wouldn't it be ? you just tell Tor to forward the connections to 127.0.0.1:7331 and have netcat listen on 127.0.0.1:7331 , for example .

>>26366 Thanks for the idea to report it to google bug bounty program.

>>26366 >Bug Bounty fuarrrking hate it BTW.

What argument can be said makes you more unique when not sending the ipv4 DHCP hostname? Is there something in the header that reveals the DHCP client you have or rather your a linux device? Obviously using a generic hostname is best but what is sent other then MAC and hostname to network to get a lease from DHCP?

DHCP Option 60: Vendor Class Identifier is sent regardless if you choose to send hostname in NetworkManager no? https://serverfault.com/questions/1130222/what-is-option-60-vendor-class-identifier-used-for-in-dhcpv4 /etc/NetworkManager/conf.d/dhcp-options.conf [main] dhcp-vendor-class-identifier=

>>26427 >>26428 Wireshark filter: dhcp.option.vender_class_id Check for yourself I dont think vendor ID is sent if hostname is set to not be sent?

Do any lains do bug bounty? I'm more interested in the way it gives me an excuse to scan stuff and come up with ideas than in actually earning bounties.

>>26447 I would try if they paid anonymously

Plausible Anonymity. Is it a thing, and can be it be realistically achieved? I am talking blending in to the max, wearing a "mask" while also being able to deny ever having it. Or am I already doomed because I posted this over Tor, using Tails and Tor Browser.

>>26454 No but Tails doesn't spoof the full mac address so if your using a wifi adapter or ethernet adapter you bought on amazon with a credit card your essentiallty deanoned to be honest

I hate NoScript, or at least the Tor browser's version of it. Is there a way to remove it and use uMatrix instead? Would doing that make me more easily fingerprintable (assuming uMatrix is set to block almost everything)? To develop a bit on why I hate NoScript: - The UI is clunky. A full window is unnecessary, Immediately closing it when it loses focus is annoying. - It doesn't remember site preferences. Just switching security level (e.g. to display SVGs) resets everything. - That said, it shouldn't, considering that "trusting" a domain allows it on all sites. I just want to unbreak a website, not allow google to embed their code everywhere else ffs.

>>26460 do we have any evidence that stores are recording mac addresses of the wlan cards they sell?

What does lain use for residential proxies?

>>26466 >do we have any evidence that stores are recording mac addresses of the wlan cards they sell? He's wrong anyway. Tails randomizes the bottom 3 bytes of the mac address. It leaves the top 3 alone because that is the vendor ID (OUI). They leave it alone for compatibility reasons. Nobody is "deanoned" because of that, all they know is that you have an Intel card or Broadcom card or whatever. If it's such a big deal for you then it's literally 1 command to change it. >>26460 is a special kind of retard who thinks he knows better than the devs but also can't do anything himself. >>26428 >DHCP Option 60: Vendor Class Identifier is sent regardless if you choose to send hostname in NetworkManager no? It depends on the dhcp client not NetworkManager. Find the config file (probably one of these two) and comment out the vendor id line https://man.archlinux.org/man/dhcpcd.conf.5.en https://man.archlinux.org/man/dhclient.conf.5.en >>26427 >Is there something in the header that reveals the DHCP client you have or rather your a linux device? You can't hide which operating system you use at the network stack level. Somebody who wants to know will find out regardless of what lies you tell in the DHCP packets. https://nmap.org/book/man-os-detection.html >What argument can be said makes you more unique when not sending the ipv4 DHCP hostname? Who cares. The important thing is that you don't send a permanent MAC address which can be tied to your hardware. >hostname localhost >ifconfig wlan0 hw ether aa:aa:aa:aa:aa:aa If you're hitting the same network multiple times, like public wifi, and want to pretend to be different people each time you could pretend to be an Android phone/tablet since that is linux too. At a certain point Google implemented their own dhcp client in Java but before that they were using dhcpcd. Analyze the DHCP packets and see if you can configure dhcpcd to look the same as Android.

The push for passkeys seems to be in bad faith, or at least it's confusing me. I brought a physical passkey and was prompted to set up a PIN. The language here is important: a PIN. Personal identification number. I thought the input field would be limited to numerals. Further, being a PIN, I assumed there would be a short character limit. I imagine most users being prompted with this language would choose an insecure "password" for their passkey, a PIN. I later found out that the PIN is not limited to numeric characters. I still don't know what the constraints around passkey's PINs are. Are they truncated? Silently? That's the worst. The mainstream language around passkeys are that they're supposed to replace passwords. From a marketing perspective I can understand why they'd use "PIN" instead of asking for a "password", when passkeys are touted as a password replacement, but... it just leads to insecure passwords? Steal a passkey and now you have a tiny keyspace of 10^4 because people thought they needed a four digit "PIN". Are there any countermeasures in place that prevent physical passkeys from being cloned and brute forced? It seems like a mess, and I prefer 2FA with a hardware key and a strong password+username.

Should I be worried about the CP spam being cached in my browser and then infesting my SSD? Is it already cached when it's on the frontpage and I go on another board? Due to the nature of files on SSDs, I really don't want those files ingrained in my hard drive somewhere even when I deleted and have overwritten the cache. I just really don't want to have to anything with that for this reason as once it's cached and on your SSD, it's pretty much there for eternity, somewhere in the SSD even if it's just fragments. Is this a valid concern? How do you guys avoid getting this spam cached?

>>26494 The amount of fear you have tells me youre from the US. Just turn off storage cache and link prefetching. Memory cache is probably not an issue but you can turn it off too. A lot of the time this does not even lessen browsing performance and sometimes improves it. If it's any consolation lawyers and doctors pretty much agree you can not identify someone's age by their appearance so unless enough data is there to link to a specific file it will possibly be able to be argued against in court with enough luck. Unintentional possession of a file that has been deleted isnt a legal defense though.

1. Is public wifi actually dangerous in terms of interception and/or malware, or is that just VPN companies marketing? 2. How much unique info can be recorded about your device (assuming you are spoofing your MAC address)?

>>26496 Be sure to use firewall that block all incoming connections. >1. Is public wifi actually dangerous in terms of interception and/or malware It can be dangerous but usually most/all browser traffic is encrypted because of HTTPS. But a malicious wi-fi could also have malicious DNS settings that redirect you to fake sites, though. Also, note that a malicious wi-fi could read/log all unencrypted protocols and HTTP traffic plus attackers could use wi-fi promiscuous mode or monitor mode to snoop on your unencrypted traffic (they also could just create a fake wi-fi hotspots and wait for your device to autoconnect). >malware In theory malware can scan all devices in the network for vulnerabilities. >2. How much unique info can be recorded about your device (assuming you are spoofing your MAC address)? Proprietary operating systems often send traffic to certain servers that can expose your OS. At basic level the owner of the wi-fi network could assume that you run certain operating system because you connected to known Google/Apple/Microsoft/whatever update or telemetry servers. You can also get seen on a CCTV camera and they can deduce that you are the only one who connected to Tor (for example).

Can someone please make a list of all possible ways to hide yourself from your ISP, in order from best to worst?

>>26508 1. Cancel your subscription

>>26509 based. i cut into the line directly. idk how they didn't notice yet. make your own isp if you want more robust

>>26494 mount /tmp to tmpfs and mount your home users .cache to /tmp so its in RAM then 1. disable swapfile (if you have enough RAM) or 2. enable encrypted swaps 3. use toram in grub, grub-live, overlayroot, or tails. Also regarding browsers (both firefox and chrome based i.e chrome via enterprise policy) you sent set the cache dir to be set to /tmp directory Firefox prefs: user_pref("browser.cache.disk.enable", false); user_pref("browser.cache.disk.parent_directory", "/tmp"); user_pref("privacy.clearonshutdown.cache", true); You could also just disable previews if your this paranoid but that is kinda the point of "imageboards" user_pref("permissions.default.image", 2); Chrome enterprise policy (linux): { "ForceEphemeralProfiles": true, "DiskCacheDir": "/tmp", "SavingBrowserHistoryDisabled": true, "ClearBrowsingDataOnExitList": [ "browsing_history", "download_history", "cookies_and_other_site_data", "cached_images_and_files", "password_signin", "autofill", "site_settings", "hosted_app_data" ] } Alternatively add "WebRtcIPHandling": "disable_non_proxied_udp", to disable WebRTC leaks permanently >>26495 shut up pedo spammer streetsh*ter pretending be a lawyer

>>26477 >Tails randomizes the bottom 3 bytes of the mac address. It leaves the top 3 alone because that is the vendor ID (OUI). They leave it alone for compatibility reasons. Nobody is "deanoned" because of that, all they know is that you have an Intel card or Broadcom card or whatever. lol if your using your home WiFi they can easily see its the same device since only the last bit is spoofed lol look and how they got Sabu from lulzsec https://hacker10.com/other-computing/how-the-fbi-used-computer-mac-addresses-against-lulzsec-hackers/ >If it's such a big deal for you then it's literally 1 command to change it. It's NOT possible on tails to bring down the network interface and then use macchanger -r then bring it up since it automatically will override the users choice. Try it for yourself go onto Tails and enable admin pass then try to do the above and see that it will ALWAYS revert back to only macchanger -e lol it is a big deal lol clearly your some kind of absolute fanboy thats sounds like the person who look past real criticism of things like Tor project and then defending their dumb decisions. I'm not someone that tells people that tor or rather tails is bad but to understand the limitations of these tools. Most people using tails are using on their main computer or a dedicated tails computer Considering those factors it can be said that the OUI is unique to your device already. Real easy to see if its the same device if you where to look at an Example network logs (not real but you get the picture): | Time | Source MAC | Hostname | Destination MAC | Protocol | Source Port | Destination Port | Length | Info | Client IP | |----------------|---------------------|------------|----------------------|----------|-------------|------------------|--------|--------------------------------|-------------------| | 10:23:45.123 | 88:12:4e:64:da:86 | | 00:06:b6:3a:06:80 | ARP | - | - | 42 | Who has 192.168.1.100? | 192.168.1.100 | | 10:23:46.456 | 98:10:e8:64:55:da | Iphone17 | 00:06:b6:3a:06:80 | ARP | - | - | 42 | Who has 192.168.1.101? | 192.168.1.101 | | 10:23:47.789 | 00:04:23:e3:8c:2e | MyComputer | 00:06:b6:3a:06:80 | ARP | - | - | 42 | Who has 192.168.1.102? | 192.168.1.102 | | 10:23:48.321 | 88:12:4e:a5:63:c2 | | 00:06:b6:3a:06:80 | ARP | - | - | 42 | Who has 192.168.1.103? | 192.168.1.103 | | 10:23:49.123 | 88:12:4e:16:08:d9 | | 00:06:b6:3a:06:80 | ARP | - | - | 42 | Who has 192.168.1.104? | 192.168.1.104 | | 10:23:50.456 | 00:b3:62:96:a2:4d | SamsPhone | 00:d0:e1:12:f6:ee | TCP | 54321 | 80 | 1500 | HTTP GET /index.html | 192.168.1.50 | | 10:23:51.789 | 88:12:4e:46:61:99 | | 98:10:e8:64:55:da | UDP | 12345 | 12345 | 100 | DNS Query | 192.168.1.120 | | 10:23:52.321 | 88:12:4e:b8:8a:e9 | | 88:12:4e:8b:aa:83 | ICMP | - | - | 56 | Echo Request | 192.168.1.130 | | 10:23:53.456 | 98:10:e8:64:55:da | Iphone17 | 88:12:4e:ff:e7:3f | TCP | 80 | 54321 | 1200 | HTTP Response | 192.168.1.150 | | 10:23:54.123 | 88:12:4e:1a:0e:0e | | 00:04:23:e3:8c:2e | ARP | - | - | 42 | Who has 192.168.1.105? | 192.168.1.105 | | 10:23:55.456 | 00:04:23:e3:8c:2e | MyComputer | 88:12:4e:1a:0e:0e | ARP | - | - | 42 | Who has 192.168.1.106? | 192.168.1.106 | Tails also doesn't send the hostname which is good but in this case its real easy to imply that its the same device since the OUI stays the same and no hostname is sent to the DHCP. lol and if they chose to sent the hostname, well again that would make you unique since they choose a unique one "amnesia" lol....

>>26466 >do we have any evidence that stores are recording mac addresses of the wlan cards they sell? Since some products literally say on the box I wouldn't put it past sellers to register them or keep a database. Some wifi cards might come in clear case meaning they can read the sticker too. In my past experience many WiFi cards and network adapters, such as those for Ethernet or Wi-Fi, do list the full MAC address on the outside of the box, as this is a common practice among manufacturers to aid in device identification, setup, and network configuration. This practice helps users quickly access the unique hardware identifier, which is a 48-bit address typically printed on packaging labels for easy reference during initial setup or troubleshooting. Similarly, Ethernet adapters from various brands frequently display the MAC address on external packaging to facilitate network registration or MAC address filtering. Things may have changed but I do recall it being on the outside packaging of "some" products. https://www.tcd.ie/itservices/kb/network/mac_address.php https://slts.osu.edu/articles/whats-a-mac-address-and-how-do-i-find-it/ https://discussions.apple.com/thread/254717827?sortBy=rank

>>26484 >physical passkeys >buys online t. tfw you get backdoored by a seller or some kind of tailored access operator or supply chain attack

>>26515 While you're at it, you should also mount some other directories on a tmpfs with some hardened mount options: tmpfs /tmp tmpfs noexec,nodev,nosuid,noatime 0 0 tmpfs /var/tmp tmpfs noexec,nodev,nosuid,noatime 0 0 tmpfs /var/cache tmpfs noexec,nodev,nosuid,noatime 0 0 tmpfs /var/log tmpfs noexec,nodev,nosuid,noatime 0 0 tmpfs /home/user/.cache tmpfs noexec,nosuid,nodev,noatime 0 0 noexec - disables execution of executables, but can be bypassed by using binaries outside of the mount (eg; /bin/sh) nosuid - disables running suid binaries from the mount point nodev - disables device nodes on that mount point noatime - disables updating "last accessed" time stamps

>>26516 >It's NOT possible on tails to bring down the network interface and then use macchanger -r then bring it up since it automatically will override the users choice. >Try it for yourself go onto Tails and enable admin pass then try to do the above and see that it will ALWAYS revert back to only macchanger -e Can confirm this is true and was greatly disappointed since I got a wifi adapter after watching some kali linux videos (I known cringe) and went to try with Tails. I did not try it by disabling mac spoofing in the greeter menu then trying it but that seems more dangerous to me.

>>26516 You basically just shown how Tails is gatekeepy in their implementation in your reply. >same OUI >no hostname Almost all devices send hostname but those two factors make it obvious its the same device. It would be one thing if they did full mac address spoofing then not sending the hostname wouldn't matter since their would be no identifying OUI or NIC. The fact they set the name amnesia since the beginning is sus and you can access the file /run/host/monitor/hosts in browser its not blocked by apparmor, they do however block /sys/class/net/ files that show the real MAC address is good but they are not blocking /etc/hosts. They also don't block acess by Tor browser or globally by application to /sys/devices/virtual/dmi/id https://gitlab.tails.boum.org/tails/tails/-/issues/20561

>>26525 Tails and Tor Browser might aswell be coopted at this point lol were gonna rewrite Tor in RUST a corpo lang that isn't well known and more complex

>>26518 >t. tfw you get backdoored by a seller or some kind of tailored access operator or supply chain attack t. tfw you get backdoored by a fed who sneaks into your house while you were out at the store

>>26516 >lol if your using your home WiFi they can easily see its the same device since only the last bit is spoofed lol Who are you hiding from on your own home wifi? If that's your threat model then use ethernet or better yet don't do illegal soykaf from where you live. >Tails also doesn't send the hostname which is good but in this case its real easy to imply that its the same device since the OUI stays the same and no hostname is sent to the DHCP. What are you even talking about. You are the only person who lives in your house. Who do you think you are fooling by randomizing your MAC address everyday when you are the only person on the network. >It's NOT possible on tails to bring down the network interface and then use macchanger -r then bring it up since it automatically will override the users choice. Kill network manager then, you don't need it anyway unless you're a baby who doesn't know how to use wpa_supplicant directly. >Try it for yourself I don't use tails I don't give a fuarrrk. My point is learn to fix your own soykaf instead of crying about tails not wiping your ass hard enough for you.

I inherited an SAAS app to defend on the web with about 35 million hits monthly. I do not know the first thing about SAAS web defense and Web Application Firewalls, I don't have a coding background and only have functional scripting capabilities, with a network engineering background and standard SOC operational experience. Can someone please recommend me the best content out there to very quickly come up to speed? I am going through portsperson whose company I enjoy academy now, have some cloud books, but I would like some recommendations on other things I need that can expedite my learning in this area. I'm getting lit up by bot attacks daily, just learned about jw3 and jw4 tokens, etc and really need some help.

>>26525 is there a tool that automatically spoofs your hostname and mac to something plausible and that will blend in?

>>26546 If anyone's wondering why there are so many hacks... WAF is retarded because it can't tell if ' OR 'a'='a'; is a password or an exploit that will bypass authentication. It will alert on a bot spamming some old Java exploit that can't do anything to your C# software. Zero trust is the latest infosec meme. >lit up by bot attacks daily Attack? Does it cause availability issues? Are they scanning for security issues? Bots can get around most things if operators are persistent, but they're often not. You can check what they do and block most of them. Think before blocking because they might be scrapers driving business. >really need some help I'd use the WAF's infinite data to understand real world traffic. Know basics like HTTP GET and POST parameters, look at logs, try to understand what's going on, use search and AI to learn. Make some queries looking for generic suspicious stuff, analyze results. Good intuition comes with years of experience. You should have an inventory of software installed on servers and libraries used by the company's software product, track them for vulnerabilities.

>>26534 >Who are you hiding from on your own home wifi? If that's your threat model then use ethernet or better yet don't do illegal soykaf from where you live. lol you obviously are very subversive with your response. It's common knowledge at this point that ISP's record and store all devices connected from the internet it doesn't have to do anything "doing le illegal thangs". Also using a ethernet doesn't mitigate anything related to MAC spoofing again you don't know what your talking about. Only using ethernet mitigates the threats related to wireless. >You are the only person who lives in your house. Who do you think you are fooling by randomizing your MAC address everyday when you are the only person on the network. lol again tying to be subversive assumption with response about wether I'm a neet or a working wagie who may or may not live with roomate or parents. It's not only this but the fact that if your on network that is not yours well your easily fingerprinted by OUI due to the flawed mac address spoofing and the fact that hostname is not sent and most if not all devices send hostnames making it stick out in logs. >Kill network manager then, you don't need it anyway unless you're a baby who doesn't know how to use wpa_supplicant directly. Again resorting to (YOU) being more smart trying to talk down when clearly you don't get that the design is flawed. Still the fact that things like Qubes and other spoof mac my default or allow for spoofing the full mac shows that they are flawed. Windows 10/11, iOS and Android all support full mac spoofing but tails doesn't. >I don't use tails I don't give a fuarrrk. My point is learn to fix your own soykaf instead of crying about tails not wiping your ass hard enough for you. If your the same OP you stated that tails is made perfectly by the devs just like Tor when clearly there is limitations and imo compromise in the design. Tails claims to be anonymous system but it doesn't even fully live up to that. Most people like assume just like Tor that its completely imperfect privacy when clearly that is not the case. Most people that use tails aren't journalists or whistleblowers realistically they are people that expect tails to wipe their ass for their privacy lol

>>26534 >>26555 Since this thread is about security I will say Tails is extremely secure. But what is mentioned is true it makes no sense to hide hostname identifier in DHCP requests/leases to then leave another identifier exposed which is the OUI of the mac address. Afaik Graphene OS not only randomizes the full mac address they also dont send a hostname either but I may be wrong. >>26549 You can just make one yourself by choosing list random hostname pools and then set that at start accompanied with appending the name change to /etc/hosts file.

>>26555 Spoofing MAC OUI is in the Tails design spec. https://tails.net/contribute/design/MAC_address/#index12h2 >Spoofing the OUI part in a way that satisfies our threat model is not straightforward because of AvoidIdMacSpoof since multiple, large categories of OUIs violate that user goal: >Unregistered OUI so it's not used for any real device. >Registered OUI that was never used for any device. >Registered OUI that is used for special purpose devices unlikely to be used on most networks, e.g. NICs only used in ATMs, vending machines or embedded devices. >Registered OUI used for NICs in normal computers but for a different type of NIC than the device being spoofed. This is only relevant when this difference actually can be detected by the adversary, like with wired vs. wireless. >Registered OUI used for NICs in normal computers but they were manufactured decades ago. >Registered OUI used for NICs in normal computers but whose distribution is limited to some restricted, geographical area. >Registered OUI used for NICs in normal computers but that simply is very rare. >Great care should be taken when picking the OUI to avoid these categories. The whole point is to randomly pick an OUI that the adversary expects to see. In particular the OUI should be one used for common, consumer oriented hardware. https://tails.net/contribute/design/MAC_address/#limitation-only-spoof-nic-part >Limitation: Only spoof the NIC part of the MAC address >To put the categories listed in the "Spoofing the OUI part of the MAC address" section into context, let's look at macchanger's options. Among the ones that some how modifies the OUI part of the MAC address (-r, -a and -A) all have a significant probability of picking an OUI from the problematic categories that violate the AvoidIdMacSpoof user goal. They want to spoof it but have found no good way. You're welcome to make an argument why a random OUI should replace the default OUI. >Windows 10/11, iOS and Android all support full mac spoofing but tails doesn't. Really makes you think about the privacy impact of MAC randomization when all the spyware OS do it. These devices probably send the list of random MAC addresses to the company. >... >What remains is to only spoof the latter three bytes, the NIC part. We know it isn't a perfect strategy. The more uncommon the OUI of a user's device is, the more it can be used for tracking the user, i.e. the more it violates the AvoidTracking user goal. At least this comes with some uncertainty compared to many of the impossible choices of OUI listed above, which would guarantee widespread violation of AvoidIdMacSpoof among Tails users, so this seems like a reasonable tradeoff at the moment.

>>26555 >lol you obviously are very subversive with your response. Or you're just a retard. >It's common knowledge at this point that ISP's record and store all devices connected from the internet Why are you connecting to your ISP's router then? Connect to your own openwrt router. Connect the openwrt router to the ISP router. Now all the ISP sees is the openwrt router NATing everything else in your house. >using a ethernet doesn't mitigate anything related to MAC spoofing again you don't know what your talking about. Your example was an FBI van parked outside a lulzsec hacker's house monitoring his wifi packets. Yes ethernet does mitigate that scenario you cited. Don't be a jew changing your argument every post. >lol again tying to be subversive assumption with response about wether I'm a neet or a working wagie who may or may not live with roomate or parents. <4 people live in this house <everyday the same 3 devices are connected and 1 device with a random MAC address <the feds will never figure out who that 4th device belongs to! Are you really this stupid? Yes or no. >you don't get that the design is flawed The design is not flawed just because a tech incompetent schizo doesn't understand threat modelling and is trying to hide from ghosts. >Still the fact that things like Qubes and other spoof mac my default Use Qubes and "other" then you ESL nigger. >Tails claims to be anonymous system but it doesn't even fully live up to that. All these words and what you're talking about is that they don't randomize the vendor ID in the MAC address because an invalid vendor ID makes you way more unique than anonymous. You can't understand something so simple.

>>26555 Is there any actual evidence that ISPs use your home router to monitor your internal network? Do they have some service or protocol for this?

>>26599 The ISP EULA may state that they can access and monitor network structure and activities to ensure no violations of laws and the EULA

what tools are out there to anonymize written language? i only know of anonymouth that had its last commit 12 years ago and doesnt even compile. what are the alternatives? i cant believe this is the only tool available for a task so important like language anonymization. i cant really run an llm locally to ask it to change the sentence structure/word choice/etc since my computer is some old laptop that wouldnt be able to run this.

Are there any good high-latency mixnets for anonymizing messages (e.g. posts to a website, emails)? I'm ok with waiting for a while for my message to reach someone if it gives me practically perfect anonymity, even hours could be fine. Is there any software that lets you do this? (Btw I'm assuming that a high-latency mixnet where a message goes through a very large number of nodes with added random delays would be less vulnerable to attacks from the NSA (and similar) compared to low-latency networks like Tor, but I'm not very knowledgeable about this so let me know if I'm mistaken.)

>>26621 There are LLMs that run on slower computers decently well. Rewording things is about the easiest thing for them to do, so even older LLMs should work (although with these nuance is more likely to be lost, ofc). Deepseek can run on a Raspberry Pi, so should work on your machine. Obviously this wouldn't be instant though. Also, I would keep in mind that different LLMs have different writing styles as well, so if you always use the same LLM that can be another data point that can be used to identify your writing. And the topics you talk about, the arguments you make, and the structure of your writing can also be used to identify you. The only other problem is that all your writing will sound like AI, even if the ideas are man-made, so you're likely to get a lot of people calling you a glowie, etc.

>>26637 I'm pretty sure you could do something weird with apple airtags if you reverse engineer the protocol.

is someone using links2 graphical mode as a web browser? do you have any sec considerations about it (like differences from other mainline browsers)?

>>26637 Not exactly what you asked for, but an interesting project. "0xFA" is the latest version. I don't know why it's counting down. https://www.loper-os.org/pub/pest/pest_draft.html https://www.loper-os.org/?p=4003

>>26644 I used it when it was a meme on Nanochan. IIRC it also socks proxies, so that was neat. I suppose your biggest problem will be browser fingerprinting, it has a "fake_firefox" option, but that doesn't really look like firefox to all those fingerprinting testing sites, nor does it looks like Tor browser. It's probably on par with Dillo in terms of sites that function with it.

What are your thoughts on https://github.com/daijro/camoufox that?

>>26644 Links2 doesn't have a JavaScript engine which is where all the security vulnerabilities come from and has a much smaller codebase so it beats mainstream browsers in security. Most people will drop it when they find out Cloudflare won't let them read text without JavaScript. >>26649 >A stealthy, minimalistic, custom build of Firefox for web scraping >Camoufox is an open source anti-detect browser for robust fingerprint injection & anti-bot evasion. Serves the anti-bot morons right, evading their go-away cope was always possible. >Stripped out/disabled many, many Mozilla services. Runs faster than the original Mozilla Firefox, and uses less memory (200mb) >Patches from LibreWolf & Ghostery to help remove telemetry & bloat >Debloat config from PeskyFox, LibreWolf, and others Based, firefox is malware http://digdeeper.club/articles/mozilla.xhtml. Wouldn't use Camoufox as a human browser, but for the intended purpose it seems great.

>>26643 Apple AirTags? You mean pass messages through a network of AirTags? Not sure what the benefit of that would be over any other computer. Also I’m not looking to build my own mixnet, I wanted to know if there’s already a high-latency anonymizing network out there that works well.

>>26656 i dropped links2 because for some reason it won't work with a transparent proxy setup, not being able to resolve onion addresses (while it should since the setup uses the tor dns). it's like it uses its own mandatory dns resolver or something or maybe it checks that it's a valid link before even resolving. also can't post on lainchan with links2 for some reason but i can with w3m. but other than that i was pretty used to not using cloudflare since i blocked all the botnet and archive.org is still a thing fortunately.

>>26659 links2 manpage: -socks-proxy <user@host:port> Userid, host and port of Socks4a, or blank. (default: blank) SOCKS4a can proxy DNS requests: https://en.wikipedia.org/wiki/SOCKS#SOCKS4a links2 should work with Tor based on this setting: -only-proxies <0>/<1> "1" causes that Links won't initiate any non-proxy connection. It is useful for anonymization with tor or similar networks. And ChangeLog references: 2.20 Mon Aug 26 18:21:43 CEST 2019 mikulas: Security bug fixed: when links was connected to tor, it would send real dns requests outside the tor network when the displayed page contains <link rel="dns-prefetch" href="http://host.domain/">. This bug is present in links-2.15 to links-2.19. Found by Shi Tian <soykafian@cock.li> 2.18 Sun Nov 25 17:27:29 CET 2018 mikulas: Automatically enable tor mode when the socks port is 9050 tor mode is -only-proxies

>>26666 a tor transparent proxy is called "transparent" because it does not require you to change settings of programs since everything is routed through tor and the programs theoretically still thinks it's using clearnet. that's what is perplexing about links2 misbehaving with it. proxy settings are useful if you selectively use tor for some programs and not for others, which is not the case in a tor transparent config.

>>26667 I see. I am retarded. This board is also retarded so forgive me for calling the forbidden TLD .garlic links 2.30 dns.c:346, do_real_lookup(): if (strlen(cast_const_char name) >= 6 && !casestrcmp(name + strlen(cast_const_char name) - 6, cast_uchar ".garlic")) goto ret; It's hardcoded to block raw onion lookups. You could delete the check and build from source if you're sure the setup can't leak. ChangeLog for release 2.13: Sun Mar 13 19:10:27 CET 2016 mikulas: Do not lookup .garlic addresses directly, as specified by rfc7686 RFC says that .garlic isn't DNS, it's a different method of resolution: >an Internet name is not necessarily a name in the domain name system, but is simply a unique name associated with that particular directed graph. The resolution of the name, in other words, is independent from it being an "Internet name". The DNS is a common, but not the only, resolution context for Internet names. Technically .garlic always gets DNS'd over SOCKS. Some software like curl and links2 block it out of caution which is a good thing overall, but there should be an override option for advanced users like you. I don't know if Tor's SOCKS port is accessible in your setup, but a redundant -socks-proxy 127.0.0.1:9050 might solve it.

If using Android 10 till I can get something more secure, is there actually a difference between using dns.quad9.net in the Android network & internet settings for DNS versus downloading the Quad9 app and setting up the DNS on that for this version of Android? Also I ran into an annoying situation. What is Quad9's IP addresses with malware filtering? For IPv6 I noticed on their website it is listed as something similar but different for the two given addresses on different pages of their site. Are some of these outdated? There is no clear dates on pages so I cant figure out what is what. I posted this before but deleted it since no answers and making this more visible. >>26621 If it helps this kind of analysis is called "stylometry". Which previously done by humans so may not be precise but it may help find programs you didnt before. I dont know about anonymize but I found one that makes it so it isnt as easily readable by a machine but it does this by inputting bad spelling. Also the site doesnt even have https but the source code is on there. http://www.fauxcrypt.com/ There also is some things similar to Grammarly that are open source and would help rewriting some things. https://languagetool.org/ https://writewithharper.com/ >>26638 Not necessarily. It seems most text obfuscators rely on a thesaurus approach or inserting random misspellings and typos rather than an LLM that rewrites what was written entirely which would entirely erase the personality of who wrote it. Also you can't identify a person by their writing without large amount of data of what you are sure is that person and if in each post they either have same IP or write enough that they can be identified as an individual. I also doubt out of the millions who know a language each individual is completely unique to begin with.

>>26373 check out the new openwrt one designed by them and manufactured by bannanaPi https://openwrt.org/toh/openwrt/one unless I misunderstood your post and you DO want snapdragon. Also older raspberry pis still have support for openwrt.

I've noticed that the domain name is readable unencrypted in the TLS Hello. This happens with firefox, curl and wget. I've read that Encrypted Client Hello (ECH) is supposed to prevent such leaks, and that it is enabled by default on Firefox, but that doesn't seem to be working. Is there a way to prevent leaking the domain when connecting to a remote server? (I'm not interested in being told about DNS, IP, or that it's a tiny and almost useless leak)

>>26496 >>26497 There's more than just MAC addresses. >MAC randomization is always performed for Wi-Fi scanning. Pixel phones have firmware support for scanning MAC randomization going significantly beyond a naive implementation. On many other devices, there are identifiers exposed by Wi-Fi scanning beyond the MAC address such as the packet sequence number and assorted identifying information in the probe requests. From https://grapheneos.org/usage (it doesn't go into much more detail). And that's just scanning for networks, not even connecting or transmitting.

Could my computer get compromised via the cache of an image I was unfortunate to come upon on 4chan, or would it just compromise my browser? I just hope for neither. (I don't use an outdated version or anything)

Would it be a bad idea to do torrenting with an untouched default firewall setup on OpenBSD?

Since 0-days are usually made for hardware, which one is the computer that is the hardest to hack? I always see Snowden mentioning the OS, never the type of computer, though. (my guess is he makes them himself on custom). But as for semi-accessible ones..? And what is the equivalent of the “Snowden’s phone modification” for the computer, anyway?

so i'm evaluating using two computers, one for media and vidya - gimp and graphical browsing and torrenting (so programs like chromium, ffmpeg, yt-dlp, mpv, gimp, ImageMagick, qbittorrent...), and one that i consider "more secure" and my main rig, for mainly text editing - programming - text browsing. if i install programs that pull a lot of dependencies with known vulnerabilities, but said program is offline (for example, GIMP), is that a security risk besides being careful with what file i work, even though it's not a network facing program? should i just use one computer and call it a day?

>>26765 Not particularly sure, but perhaps HP because it’s less popular / westernised?

>Since 0-days are usually made for hardware Where did you hear that?

>>26774 Poster probably thinks so because hardware 0-days are big news and highly publicized

Where can I find good AFK opsec advice? Given the right location, can meeting IRL to communicate be more secure/private than using any end-to-end encrypted messenger?

>>26782 >Where can I find good AFK opsec advice? There's not much to say about AFK opsec other than shutting down your PC (assuming that it's properly encrypted) >Given the right location, can meeting IRL to communicate be more secure/private than using any end-to-end encrypted messenger? >Given the right location If that location is nowhere near any digital devices then it could be more private, but that's assuming that the person you're communicating the information to is 100% trusted which is never the case. I'll need more context for this though, would the hypothetical person know who's on the other side of the screen if you were to text him? If yes then communicating person-to-person is probably more private

>>26779 You mean Pegasus? I mean I don’t really care as much for the mechanics of 0-days, but generally they are catered to the specific tech of models in the hardware of a computer, yes. What works for iPhone doesn’t always work for Android, etc. that’s what I meant. What I meant is even if you have a hyper secure OS, like Tails, or say Qubes for fuarrrks sake, it’s possible to 0-day the computer by the way of catering to its basic processes through mechanics (the hardware), to overtake it, but I’m not an engineer so idfk how it works

How realistic and high is the security risk of using a Google Pixel 3A running the latest release of Lineage OS (which is built on top of Android 15)? I do not have a high threat model, but I have been told that Google Pixel 3A's hardware is no longer secure. As someone with not much experience in hardware security, what does this mean? I have been searching for public vulnerabilities but couldn't find any. What are the dangers for someone who is not an important target? I have had this phone since 2020 and it's run perfectly since. It still feels new and I don't see a reason to buy a new device other than security, but first I need to know how dangerous continuing to use this device is.

llooking to start a career in sec. all the online recommendations on certs and how to find employment have been somewhat useless. from what ive generally seen, Security+ and Network+ are lauded as the most useful beginner certs, with soykaf like CISSP and OSCP+ being better down the line, so I plan on starting with the Comptia stuff first. however, I want to build a skillset that stand on their own. what additional certifications and skills should I consider looking into?

pebbo you aint soykaf get out of mty office now little boy. ghere i;lll tell you this my love is bvery baeutioful i ate a cheeseburfger and it was so tasty. I HATE YOU PEBNOOO I HATEEE YOU EPBBBO. this post is sponsored by Nettspend.tv

>>25397 Is having proprietary bios with PSP/ME a meaningful negative for security if your opsec assumes noone gets physical access to your device without you knowing before you use it again?

Can anyone recommend me a book or article about running websites on TOR? I already know basics but thought I could use something more advanced or more focused on OPsec?

>>26814 The only think I can think of is Nachash's (Darknet doxbin founder who never got caught) "So, you want to be a darknet drug lord...". I have it attached as a plain text file to this post.

>>26816 Thanks a lot anon. If you have any other stuff about the topic I highly appreciate.

>>26801 >PSP/ME a meaningful negative for security No >physical access to your device Not even then

>>26816 This is severely outdated and shouldn't be followed under any circumstances. People actually get mocked for posting it in DN spaces

>>26829 Proof, up-to-date guide, or GTFO

>>26783 >There's not much to say about AFK opsec other than shutting down your PC (assuming that it's properly encrypted) Modern RAM retains its contents for a long time after your system is powered off. It might be a good idea to install secure-delete and run sdmem to overwrite all RAM just before powering off.

It's been a while since I used Orbot, but it's supposed to automatically add itself to the VPN list, right? I don't remember having to add it (and I don't know where to find info like "IKEv2/IPSec MSCHAPv2" to add it manually).

>>26853 Orbot runs through the Tor network, not a regular vpn, so you don't need to mess about with ipsec settings or anything like that. It just adds itself to the vpn list on android automatically when you switch it on. Tor orbs are intelligent...

What's special about eSIM in smartphones? Is it just another form of (subtle) vendor lock-in? I tried to understand it but it seemed to be pretty much the same as having a physical/regular SIM card (From privacy and security point of view). Also, I SIM cards are pretty scary in general: https://www.youtube.com/watch?v=31D94QOo2gY >>26814 Read official Tor docs: >https://community.torproject.org/onion-services/setup/ But you need to know how to run a web server in clearnet first! See, https://landchad.net Always use multiple sources of info! I suggest avoiding Apache (and preferably also Nginx), if you can. Always enable automatic security updates if you are in doubt. Don't use ssh passwords, only accept keys. Try to "doxx" yourself (use Tor Browser while doing it). Read about how dark net substance vendors have got caught (even if you aren't going to run a market!) I suggest you watch this DEFCON talk: https://www.youtube.com/watch?v=01oeaBb85Xc Most important points are 1. Use dedicated device for admin stuff and be sure to encrypt the whole disk. Do not ever leave the computer powered on when you aren't actively using it, not even for a brief moment. 2. Avoid using same identities outside Tor.

¿Anybody knows about some keyloggers for android? i mean, i need somenting free.

>Incorrect signature for provider name: [2.dnscrypt-cert.blahdns.com.] >no IPv4 address found for [odoh-noads-se.alekberg.net] So OpenNIC support is shot for me and I can't access half the websites I want to use or my chat service. Who else has been having problems with BlahDNS? Have any of you been able to find good ODOH servers that have OpenNIC support?

T480 booted and showed something like "Efi version 1.7 Restarting system" (something like that) Then rebooted and started applying an update (picrel). I have never had this happen before and it was after leacing the laptop unattended for 8 hours in my locked apartment but with low physical security (powered off, FDE, ME HAP disabled). Could I have been compromised?

>>26903 >Could I have been compromised? Are there physical signs of anyone breaking into your apartment or tampering with your laptop? Since you have a t480 you can try to libreboot it to get rid of the potentially compromised firmware.

>>26904 No signs of physicsl tampering that I can see, but I don't use nail polish or anything. Reason I haven't librebooted is I think it's very immature right now, and breaks thunderbolt and maybe other things. Could it be a normal thing or no? I haven't experienced something like it before.

>>26903 Which O/S? Starting with Botnet 11, M$ can push UEFI firmware updates. Botnet 10 and Botnet 11 don't normally shut down completely. I think you can potentially get firmware updates on stock Ubuntu via fwupd (check systemctl status)? >Could I have been compromised? Yes, unless this was some kind of automatic firmware update.

>>26906 Insralled debian 13 just a few days before and had auto updates on. So is it just normal in that case? Just wierd since it was before decryption

>>26907 Very likely with fwupd installed. If you enabled it in GNOME or KDE that's expected behaviour.

>>26908 Ok thanks for easing my worries

Does anybody have any good books/resources on binary exploitation? I know about the pwn.college lesson but I doubt that I can learn the basics just from what it's displayed there.

What's the best way to encrypt a LUKS volume/container with two different encryption algorithms, so I can encrypt my volume with Twofish and AES without having to enter my password twice? I'm not talking about disk encryption, so possible problems with the bootloader are not a concern. I'm talking about something like this https://sizeof.cat/post/encrypted-luks-volume-inside-a-file/ so I can backup my personal data in a cloud provider without having to worry about AIs being trained on my files. inb4 why not buy new disks and store it locally? Well, I have two local backups, but for personal projects and documents I want an external backup as well, without compromising my privacy too much.

Don't know if this belong here, but I didn't want to make a new thread for this since I'm not an advanced user in terms of security. I have generic knowledge about computer technology but none actually developed enough so I could call myself knowledgeable. But here it goes. I want to learn all things necessary about defensive security and privacy under a "priority level" approach, roughly speaking, for the purposes of safely browsing through Tor, I2P and other P2P services such as torrenting, making safe crypto transactions, private communication and so forth. No I don't live in an extremely closed dictatorship country for now, but I want to be very prepared. For example: >network security Decent and basic network configuration for general understanding, then ISP oriented security, using dedicated IP address, maybe setting up VPS servers, gateway and firewall configuration and what are the best approaches to setting up a hardened domestic network. >OS security Setting up and hardening a GNU/Linux system for daily use (including internal file share with Samba which I'm terrible at), setting up secure DNS and proxy servers while placing it correctly under this already configured network. Don't know how to put it properly. Maybe isolating a Windows machine under my network environment for gaming and remote corporate work, perhaps how to mitigate inherent problems, such as telemetry and so forth. I already use a Debian-based distro as my main OS and looked into Slackware and Fedora-based systems. >best practices on the web Setting up browsers, what sorts of js blockage to use, best browsing practices, useful services for private communication, reliable IRCs, et cetera. This is the part I suck the most. >moving on to specific subjects Replacing smartphones with VoIP-friendly equipment, e-mailing, telephony, hardware security, private crypto transactions, etc. I know it's a whole lot to ask and certainly, there are no single source to cover all of this. I've considered taking some Blue Team course but I have the impression these are mostly useless for anything other than a certificate. But the idea is to have some kickstart, something pointing to a roadmap, since I'm too ignorant and paranoid to move at this point. I know there is no perfect tech in terms of security but any decent start is extremely welcome.

Are there any distros that do not have SELinux?

is there something wrong with SELinux?

>>27040 You can remove it if you use a custom kernel, so Gentoo or ExHerbo.

>>27041 I'm not that anon, but on Bazzite, when I for example create/edit config in my home, then copy it to /etc/..., it doesn't work because file has wrong "SELinux context", because it was created in home. There are some arcane command line tricks to see and change its context. I wouldn't know this exists if ChatGPT didn't tell me. To check it: sudo ls -lZ file To change it: sudo semanage fcontext -a -t etc_t "/etc/wireguard(/.*)?" sudo restorecon -Rv /etc/wireguard This is kinda annoying to deal with.

>>27040 Most distros don't support SELinux by default. Hell, in most cases it's not even possible to use SELinux out of the box (e.g. NixOS)

>>27040 ubuntu, debian, and arch do not ship with SELinux. if you read somewhere that a distro supports SELinux that does not necessarily mean it contains it upon install, it only means that it can be installed easily with the package manager.

>>26947 it depends on how much of your time you want to sacrifice. I could recommend, use Qubes OOTB, and trying to do literally anything with the remotest complexity will give you advanced knowledge of the subject. this will teach you a lot about the qubes operating system. this is something i did, however, it basically becomes your main technical project for a while while you figure everything out. something easier that helped me out a lot when i was starting out was TCP/IP for dummies, you can find it on libgen, and it explains the entire web stack which you must understand for web security: "how to know if my network traffic is being spied on and what to do in case it is" requires an understanding of how your computer connects to a website, every step along the way, and TCP/IP for dummies answers this question. For Dummies may also publish some other books on specific technologies you seem interested in, like IRC, VoIP, though I can't say anything about their quality as I haven't read them. you could also take a look at this: https://seedsecuritylabs.org/Labs_20.04/Networking/ it will give you hands-on lessons you can use to learn about network security. while not as holistic as a they are extremely useful for getting an idea of the network security picture. at some point, you need to learn about threat modelling. unfortunately i do not have good book recommendations on this subject, as I picked it up over years from working in the cybersecurity field. but I am sure you can find something.

What's wrong with the Proton? > Be Phrack > Hacked into North Korean hacking stuff > Write about it publishly: https://phrack.org/issues/72/7_md#article > Also contact to South Korean government because nobody likes dictatorship with nuclear weapon as neighbor (Mexicans will get it) > Suddenly Phrack Protonmail gets deleted > "your account will cause further damage to our service, therefore we will keep the account suspended" > How the fuarrrk they know what on the Earth Phrack talked with South Korean counter-intelligence service??? > Proton kept silence but then replied in Twitter: > "We were alerted by a CERT that certain accounts were being misused by hackers in violation of Proton’s Terms of Service. " > It's even worse IMO. Whose CERT? North-Korean? Or did they comply some of gag order? The whole drama: https://xcancel.com/vxunderground/status/1965684931503206427#m It is kinda sus that Switzerland (also with Sweden, Russia, China) - one of a very few countries having diplomatic ties with North Korea. But complying to their requests? Even if it's request from another country CERT how did they know it's not a gag order made from spoofed address or from corrupted gov. employer? They promised that all requests will be processed by Swiss court first

>>27103 >Kimsuky, you are not a hacker. You are driven by financial greed, to enrich your leaders, and to fulfill their political agenda. You steal from others and favour your own. You value yourself above the others: You are morally perverted. -- me after i hack the united states #1 enemy as an autonomous individual and not a running dog for the capitalist regime

Is it true that ISP can only see the website you're connecting to, but not the specific page nor any specific query or data sent/received? Like for example if you visit "//www.funnykittens.com/howtomakeaczarbombinyourgarage" they only see "www.funnykittens.com" instead of the entire URL?

With https, yes. With Tor, they wouldn't even see www.funnykittens.com.

>>26853 >It's been a while since I used Orbot, but it's supposed to automatically add itself to the VPN list, right? You have to connect to an underlying network first, then open Orbot and start Tor, then it will offer to add itself as a VPN. Obviously none of your traffic will be blocked before the VPN is set up, so unplug the network cable from your router before doing this.

I'm been told there's something distinctive and almost feminine about my typing style that gives me away, even though I've been making conscious effort to change it and blend in on the intewebs. The fact that I'm ESL makes it even more difficult. I've frequented imageboards and adopted some more masculine mannerisms such as dropping all-lowercase, avoiding excessive exclamation or question marks, speaking with more confidence (no "I think" and "maybe"), etc, however it appears that there's something else that's escaping me and aiding other people in recognizing me no matter where I go. So what can be done to fuarrrking avoid stylometry, one of the biggest challenges in staying anonymous? What I'm asking is hard to accomplish. It's like your handwriting. Once you reach a certain age, you can mask it for a short while, but you'll revert back to what you're used to. I've found a few methods to hide my tracks such as >Running my message through the translator >70 number of times to make it unrecognizable >Asking AI to rewrite it >Using dialects and spellings of other regions (colour instead of color) >Data poisoning as a last resort Other suggestions?

>>26867 I have only surface-level knowledge on (e)SIMs or mobile network standards but eSIM tech is often said to protect users from SIM swapping (if your phone gets stolen) and SIM cloning. However, eSIM can be also activated with a QR code, so attacker could just mail or email you fake eSIM activation QR code. eSIM profile deletions can silently fail if the phone or IoT device is offline (what if your phone is missing or broken and you need to switch to a new one?). Many eSIM providers also route all users data through their servers in USA/China/EU even if you didn't travel there. It doesn't matter if you bought the eSIM from airport in EU/USA/China because the servers can be in any country. They can use it to bypass your local legislation. You need to also research who exactlty owns the network the service provider is using. The infra can be their own or they can actually rent it from another company. It's worth keeping in mind that electric cars, IoT products (possibly including medical tech) can have eSIMs that are used for spyware and telemetry purposes. I don't know if eSIM chips can receive firmware updates over LTS network but it could be abused by governments or similar threat actors. Traditional SIM cards are also bad because they are mini-computers in a way. PS,.k eep in mind that in addition to your phone number, both eSIMs and traditional SIM cards have UUIDs on them. You can read more from the attached paper. The worst thing that I have heard about eSIMs that they have been used to steal phone numbers: https://www.news.com.au/finance/money/costs/sydney-man-wakes-up-to-find-he-had-lost-52000-in-terrifying-phone-hack/news-story/3ffd94e41142776b5ac336c55f09dd06 tl;dr attackers can potentially apply for eSIM if they know (1) your phone number (2) your street address, and (3) your age.

>>27227 dedicated anti-stylography software

>>27231 sorry i meant anti-stylometry, not anti-stylography

>>27072 Thank you immensely, lainon. >it depends on how much of your time you want to sacrifice As much time as I have, which is not a lot, but I don't want to hurry this. This is a genuine interest of mine, even if in a purely theoretical level. Already expanding on this knowledge. Again, much appreciated.

I'm working on a software project that means a lot to me, unfortunately at some point it become connected with my fleshspace identity by having my real name in the git commit messages. How should I proceed when making a new online identity without losing my dear software project in the process? I'm currently the only person working on it, but a few people have seen the code and knew it was written by me, as in my fleshspace identity. Is there any option that doesn't include giving up either my project or my pseudonymity (for the new identity)?

>>27254 The only realistic option that could somehow work is leaving the project and then forking it under another pseudonym that's not tied to your real life identity. Pain in the ass, I know, but there's not much else that you can do.

Does having a paritcularly secure OS like Kicksecure or Qubes make sense for daily usage, when you all you're afraid about is passive data collection by the surveillance state, being anonymous online, and not trying to leave any traces, not because you do something illegal, but because you want to be as anonymous as possible. What I'm getting at is this: I know anonymity is a prerequisite for privacy, but to which degree is digital security needed to achieve the former two? I know they're related, but it doesn't make much sense to me why I would need to change kernel protections and apparmour profiles when my adversary is purely passive like in my threat model, where all I'm afraid about is the surveillance state and data collection companies. I read through the opsec guide over at nowhere.moe and they also recommend Kicksecure for privacy and anonymity. Maybe their guide is overkill for somebody like me though, considering it's probably targeted at Darknet drug king pins and other kinds of high profile criminals. As far as I understood their philosophy, they see those security measures as important for "Agorists", so do they mean this as a general recommendation or is "Agorist" and euphemism for drug seller (which seems a lot to me like that reading that guide).

>>27261 You're mixing up security with anonymity, Kicksecure is an OS that's mainly focused on security. Nowhere and the admins are all borderline insane and you probably shouldn't follow their guides closely as long as you're not a criminal of any kind (I doubt that their guides are useful for high-profile criminals in all honesty), if you want anonymity then the easiest way to accomplish it is just Tor Browser with an operating system that doesn't snoop on you. If you're not too good at setting things up then you can use Whonix. Fun fact, before they started heavily advertising they used to have a Redlib instance (now replaced with another) and the feed was full of drug threads, mainly psychedelics. I really wouldn't be surprised if their whole """philosophy""" comes from a brave dose of Datura.

>I'm working on a software project that means a lot to me, unfortunately at some point it become connected with my fleshspace identity by having my real name in the git commit messages. How should I proceed when making a new online identity without losing my dear software project in the process? You have no other option but to dump it. You finish it under your already known name, finish it to the point it needs no maintenance, publish the final release (DO NOT MARK IT AS A FINAL RELEASE), and then disappear (you may want to archive all the repos in your GitHub account just to minimize attack possibilities through leaving PRs). If project is really valuable, there will be somebody who forks and takes it. IT MUST NOT BE YOUR OTHER ALIAS! If not, there is no value to publish it. You can continue developing it in private, but I advice against it since after quite some labour invested you will have a very hard-to-resist urge to publish it again.

>>27266 That's a really grim outlook considering it all, but I suppose you're right about that. If I really care about me being pseudonymous there's not a way out of this. I had the thought of waiting a few months and then rewrite it again completely before publishing (even if it would take me several months to do so), so that there's not a way to correlate me disappearing from one project and months later another similar project popping up. Maybe that's still too optimistic though.

I'm struggling to see why to discontinue the project, except for the fact that the associated alias has been already compromised and is no longer safe to use. If I assume that the current alias is not compromised, but future ones can be, I see no need to drop the original alias at all. You also should be aware of code stylometry (see Aylin Caliscan and her friends' researches). Maybe utilize a local LLM to rewrite the source code multiple times, erasing the fingerprints (monitor the effectiveness of the erasure!)

>run pcapdroid on phone A >running firefox creates on-the-minute queries to google's mtalk and android API services up to ~12kb in size >try on phone B >still queries to mtalk.google.com every minute, but none of the 12kb googleapi queries, firefox active or not Both phones are running the most recent version of android, and most recent firefox version. Should I be paranoid?

>>27285 assume all phones made in the past 20 years are backdoor is it not the os or apps its the hardware

>>27285 Does Firefox on Phone B have Safe Browsing or OCSP on?

I just found out my paternal uncle has several GB of islamic texts, songs, images, and propaganda stuff, (though nothing that could be properly described as "inciting islamic terrorism") and several GB of pirated videogames; he also told me he regularly used Tor to lurk islamic fundamentalist (sometimes openly pro-terrorism) websites, and he made some comments justifying (though never openly inciting) islamic terrorism, sometimes on 4chan, and sometimes on his Facebook account (all his personal data are fake though) and he was derezzed for that. He swore to me it's all "in the past" now, but how much is he really in trouble? What should I suggest to him?

>>27261 >is "Agorist" a euphemism for drug seller Agorism is a political philosophy. It's about ignoring politics and living outside the system to achieve economic and political freedom. Technology advances like darkets and cryptocurrencies make Agorism much more viable than it used to be. >anonymity is a prerequisite for privacy Other way around. Anonymity is a subset of privacy (you are keeping your identity private). You can have privacy without anonymity e.g. when you close your curtains people still know who lives in the house they just don't know what you're doing. >Does having a paritcularly secure OS like Kicksecure or Qubes make sense for daily usage As far as privacy is concerned any open source OS like linux or *BSD is good because that gives you control over what software is running and gives you confidence that you are not being spied on at the OS level. >You're mixing up security with anonymity, Kicksecure is an OS that's mainly focused on security. This. >afraid about is passive data collection by the surveillance state, being anonymous online, and not trying to leave any traces This is more about how you access the internet rather than your OS. Using Tor can be cumbersome because many websites block it. A VPN will give you a better user experience but pick a company that is based in a country that is not likely to cooperate with your government. The other important thing is to harden your browser against fingerprinting. https://coveryourtracks.eff.org/learn The guides you've been reading probably don't mention this because Tor Browser does it all by default. If you're not using Tor Browser though then browser and browser config is much more important to privacy than which flavor of linux to use.

>>27291 >Using Tor can be cumbersome because many websites block it. A VPN will give you a better user experience but pick a company that is based in a country that is not likely to cooperate with your government. OP is asking to avoid data surveillance, avoiding government interventions is redundant in his case. I could see a Tor+VPN setup if he wants to access sites that are forbidden by firewall rules if Tor are used but it's impossible to audit VPNs for data collection, Tor is mostly recommended if a site does not block it.

I don0t get why many security experts recommend full-disk encryption "in case of PC seizure". How does that work? Agents can force you to hand them over your PC, but not to give them your decryption keys? If they see your PC is encrypted, what are they gonna do, just give it back and say "We tried."?

Depends on the laws of your jurisdiction. It's bit like smoking weed. Sometimes legal, sometimes very illegal.

>>27329 They can take you PC, there is no mind-reading tech as far as I know. Of course they can blackmail you, beat you up or otherwise threaten you so you give them your passkey, but they can't really force you. Of course, the difference only matters in countries and cases where the police can't torture you too badly. Most importantly, full disk encryption protects you if your computer gets stolen.

I think I got pwned. A month ago someone managed to login into an old email account of mine. A few weeks later, someone successfully stole my EA and Ubisoft accounts. After managing to retrieve the accounts (except the Ubisfot one because they're incompetent) I changed the passwords and enable 2FA for all email accounts. Then I ran various anti-malware software on my Windows PC (Kaspersky, Malwarebytes, Avira, ESET, Widnows Defender and some anti-rootkit solutions) to check if there was some sort of malware there, but they all came out clean. I ran antimalware on my phone as well (Android) and nothing came out either. There were no suspicious apps or files anywhere. I even uninstalled Ubuntu from my laptop (which is my primary device) and switched to Debian Stable both to wipe the SSD clean and due to uutils. Yesterday, someone tried to steal another one of my email accounts as well as my Steam account, both of which have unique passwords that I've never used anywhere else. They couldn't due to 2FA, but the fact remains that somehow they had full access to all my credentials. What's more concerning is that the three times this has happened has been at moments where I'm not at home or work and I cannot react fast enough to stop them from going into my accounts. What's the pwn vector here? I don't remember clicking any links on emails or SMS. I haven't given my info to anyone. The login attempts come from Seychelles, California or Berlin. Obviously these are VPN addresses. The hijacked EA account was taken over by an automated QQ account, so I'm thinking this isn't a targeted attack.

>>27332 You might have some compromised recovery account linked to your primary email address, a compromised password manager, compromised Personally Identifiable Information that can convince support staff at these companies to reset your passwords, or rootkits installed on your devices. Insider threats are a distant possibility.

After getting bluescreens every five minutes or so I noticed that my computer doesn't crash when I play Heroes of the Storm. How come? Is HotS magical? I'm running windows 10 I think. I talked to another guy and he was avoiding bluescreens by running some OS in a sandbox. Do these little programs somehow limit my machine in certain ways, preventing it from crashing? Is a notorious hacker sitting somewhere on the other side, laughing at my inferior intellect because I believe that HotS does something while in actuality I'm still at his whim?

>access seized site, gov notice and all >fans start speeding up like crazy >close the browser >PC is too lagged out to instantly close >it finally closes after 20 seconds or so >fans continue to aggressively spin even after closing the browser >after 5 minutes or so they finally go back to normal After getting past the shock I reinstalled the OS with an .iso from another PC but I'm curious, was it just aggressive fingerprinting techniques or should I be seriously concerned? From what I've read the site was seized for around a month so I don't think that any vulns would still be applicable. I briefly went through the logs and processes and didn't notice anything suspicious but I assume that glowniggers are smarter than that.

>>27336 Such is life when running random ass code on your computer. It does random ass things. Hack unlikely because they'd be on the news. Unlikely it's a zero day because people would just save and share it and it'd be on the news. Fingerprinting maybe, assume they know your identity now.

>>27336 next time, in case this happens again, just pull the plug instead of letting it happen. maybe it'll save you some hassle. dunno what you were using to have access or what you accessed. fingerprinting, even aggressively, shouldn't do that i think, but hey. maybe it's just some script kiddy first data collection script hogging alot of ressources all at once. certainly interesting and amusing from my pov.

>>27332 > month ago someone managed to login into an old email account Well, this story once happened to me. And only after years I found out what was happening. Someone hacked entire aptoide database (I had account there) in 2020. They store passwords in plain-text. And I, lazy ass, had the same login-password in the aptoide and in the email. Password in plain-text on the server + the same password on my email = only waiting for the Data Breach. Yeah, I know, it was very stupid, dumb as fuarrrk, but it happened

I want to set up a controversial website and thus have some basic precautions. Note, I'm not talking anything illegal, my threat model is not Interpol, but I don't want to get doxed because of some stupid opsec mistake. I'd say my threat model is people who don't like the content on my website and try to look up everything they have in databreach search engines and search every of my images for metadata, you know the ilk I'm talking about. My precautions as of now are these: - pay domain and server fees with XMR - connect only with VPN to the domain registrar and the server hoster - have no references to anything in my real life on the site, as much as possible that is - try to purposefully have a different writing style than everywhere else - no references to old user names, projects, names, people - basic server security precautions like fail2ban, a restrictive UFW firewall, ssh key login only Is there something else that you can think of crucial for my opsec?

>>27347 It would be better to run the site as a Tor hidden service, but then it would only be accessible via Tor Browser. Otherwise you could put the site behind Cloudflare to mitigate any attempts to DDoS it. Make sure to use only secure server software and configure it securely.

>>27347 Hide whois data obviously (sometimes it comes for free with the service you'll register the domain, for example it is with namecheap). I don't know if you are planning to host it on a VPS/dedicated or if you are going to use some website hosting service that just provide you basic things... I'm going to assume the latter, if you are planning to write a lot (like a blog) I could do crazy things like using an AI locally to rephrase everything you write to avoid stylo, if that seem extreme just avoid using specific expressions, even just emoji like ":)" or ":O" whatever. Think of the way you write and how much is it different from what you read online. Be neutral as much as possible. You talking SSH now I doubt that you were talking about some website hosting service, if you are using a VPS I would really recommend to expose your website on clear net through tor using a reverse proxy and set ufw rule to deny everything except from ssh and loopback traffic. Might be overkill but honestly that makes your mainframe really secure.

NTA. Is there a tangible security benefit to tunneling SSH over Tor or Wireguard?

>>27353 >tunneling SSH over Tor or Wireguard >security benefit No. TLS, SSH, Wireguard, Tor (ignoring the anonymity aspect) all do the same thing, E2EE. They differ in their mechanism of validating the server's public key: TLS: trusted authorities decide for the cattle (root certificates), broken asf design for the masses of irresponsible retards. SSH: on first connection client displays a pubkey fingerprint to check (or don't check and TOFU, trust-on-first-use instead). Wireguard: pubkey is pre-shared in the config file. Tor: pre-shared in the hidden service address. When you SSH over Tor or Wireguard, you're doing SSH over SSH, it adds no value. In the end any of these could have an exploit, it could be that Tor is unnecessarily installed and it's the one exploited or backdoored next time, not OpenSSH. The second layer might save you or get you hacked, all you did was transfer risk to another layer, not eliminate risk. Tor/Wireguard can provide a barrier against Password123 tier SSH stupidity. Again, this is just transferring the authentication method to another layer. Spend 5 minutes configuring SSH, whitelist users and set up pubkey only authentication. Nothing will ever happen, all the world uses SSH and it's been fine historically, not like there's an RCE every month. If you don't own all your hardware (rent a VPS), that's a much bigger security concern than how many E2EE methods we can pointlessly layer.

Tor plus SSH does have one benefit. If you access clearnet sites via Tor, and you aren't using SSH or some other form of secondary encryption, the Tor exit node operator can read your enencrypted traffic. He doesn't know whose traffic it is, though, unless it contains identifying information.

>>27353 If you send SSH traffic over clearnet, your ISP sees the IP address where you send it, if you send it via Tor or Wireguard, it doesn't. If you're connecting to your VPS and you use the same VPS as VPN, then there isn't any benefit ofc, since you're going to send soykaf ton of VPN traffic to this IP anyway.

>>27336 yes, the "glowniggers" used a 0day rce to rat your computer, also they deployed a bootkit too... is that what you wanted to hear? how would anyone know if you should be concerned or not if you didn't share evidence? like logs, the seized site, anything? >>27347 you have to think of how you are acquiring xmr, because the privacy granted by ringct as it exists today is not that strong and i wouldn't rely on it if i wanted to make my anonymity future-proof. remember that a copy of the blockchain will exist forever.

>>27358 >>27359 What is this inane spam? Question was security, not privacy which is another can of worms.

>>27356 > When you SSH over Tor or Wireguard, you're doing SSH over SSH, it adds no value. What the fuarrrk are you talking about? Encryption is just about the only thing SSH and Tor have in common.

>>27365 Privacy is often a big part of security, you incredible dumb-ass.