Simple Security Questions

This is the Simple Security Questions thread for simple questions. If with a simple question and without a suitable thread already existing, post it here and someone will probably try to answer it. Remember to do some research before asking questions. No one wants to answer a question that a simple search can already resolve.

Is persistent malware something I should worry about when buying a used computer?

>>27515 Chance that a given pc has persistent malware: low Chance that a given pc has malware that persists outside of the hard drive: very very low

I’m not very familiar with imageboard culture, but ChatGPT told me this is a place to talk about technology and related topics. So, please forgive me if I accidentally offend any minority or break any norms. Hi, I wanted to ask what you would recommend I study to learn more about cybersecurity, like, where should I start? I think I’ve picked up a few things naturally since switching to Linux, but I want to develop more specialized knowledge. I openly admit I’m ignorant on this topic, so please refrain from trolling or insulting me, I genuinely want to learn more about it. Thanks in advance.

>>27519 You have the entire internet to figure out where to get started from. If you can't figure out how to get started on your own you're ngmi. You've probably rotted your brains with chatgpt thinking for you

>>27520 i just thought it would be good to talk to experienced people who can offer a more direct support and guidance

>>27521 Just get started doing what interests you (why do you want to do cybersec? Reverse engineering? Malware dev? Etc?. Just do it). And drop the large language model. It's literally that shrimple

>>27519 search for wargames like this one: https://overthewire.org/wargames/ this is also a good place to visit: https://pwn.college/ the best way to get into it, is by trying hands on

>>27521 You are right that it is useful to discuss things with others when you want to learn something, but it depends on what you want to talk about. If you come here creating a thread for a question to which you can find countless answers already when you put it into a search engine, nobody will be interested in discussing this with you. It's a waste of others time and boring for everyone. Instead, start learning and practicing and when you get stuck and can't find an answer easily, come here and ask. Then it might be fun for more experienced lainons to think about your problem and help you. So, what have you done so far?

Please, someone help me stop worrying and love the IME. It's a nothingburger, right? There have never been any real attacks using it, right?

>ChatGPT told me this is a place to talk about technology and related topics. dear lord, is it doing that. i guess that explains we have insufferable AI bros here. >I’m not very familiar with imageboard culture first piece of advice read the catalog for any other threads that seem to encompass questions or things you want to talk about. every new thread you make bumps the last thread off the the end of the board, so if you make a new thread make sure it is better than the one that will get deleted. this is one of the things people mean when they say "lurk more." a good way to understand the culture of lainchan is to read the zine linked in the top right at lainzine.org . please make sure to read the rules and for an idea of how they get enforced you can look at the ban log. >where should I start? it depends entirely on what you want to do and what your interest in security is. if you're interested in personal security and opsec i would suggest looking into OS and software hardening and reading how to disappear by michael bazzel who has a decent book or two. this should encompass the basics. the Electronic Frontier Foundation has some very good resources on "surveillance self-defense" in regards to what everyday users who are concerned about their right to privacy online, and what they can do to protect theirselves at https://ssd.eff.org/ . if you want "schizo-level security" for yourself as some affectionately call it here, I would recommend reading a book on the TCP/IP stack - I liked TCP/IP For Dummies - and researching notions like public key infrastructure, web-of-trust, understanding DNSCRYPT and DNSSEC, understanding what p2p encryption is (and more broadly, the difference between different cryptosystems and how they are constructed), security auditing, and knowing how VPNs as well as tor and related projects like Whonix and TAILS work. you should also look into the Qubes project, i would say using Qubes has taught me more holistically about OS security than anything else, but it forces you to learn in order to use your own computer and can be annoying to use if you want to use your computer in relatively sophisticated computer ways, including doing other security stuff. If you're more interested in the industry side of things then ive found a decent resource on ways to get certification and training. https://github.com/harisqazi1/Cybersecurity . tl;dr you will need certs, many people will say that most certs are bullshit but the important detail is which certs are bullshit, and it depends on who you're talking to and what job you want. with the exception of entry-level certs like security+ and manager-level certs like CISSP (which you can't even get without industry experience), certifications are going to be domain specific and their reliability in getting you hired is primarily based on who is hiring you, in terms of what certs they have, etc. if you want my personal advice it would be to start out elsewhere in tech or operations to get your feet wet, and then show that you know a thing or two about cybersecurity, to get a transfer into the field. from there you should work on formalizing your qualification with certifications or a degree. as for practical skills, aside from the resources in the git i linked and the ctfs posted in the ctf thread, I would highly recommend SEED labs: https://seedsecuritylabs.org/ . cybersecurity skills can be organized into "blue team" and "red team" where blue team involves defense and red team involves attacking. you will need a decent amount of both, but if you only have red team skills and aren't employed people will think you're a script kiddy which you might not want, and if you prove that you have serious red team skills then they'll think you're a black hat which you might not want either. in general if there is a specific thing you want to study, you could try looking up "(thing) ctf" and look for it on hackthebox, there is also hackthissite and tryhackme. if you are rather than interested in a career in the field wanting to stay abreast of cybersecurity news in terms of things like data breaches and privacy law, NSA declassification, etc i would highly recommend cryptome.org . there are other security newsletters like https://krebsonsecurity.com/ which are all hit or miss, as well as personal blogs of security professionals. there are many newsletters and zines about security and hacking, the most solid hacking magazines you will find in these parts are 2600 and phrack, lainons in the past have been published in both. if you're interested in being a cool hacker, i would recommend NOT bragging about your achievements or asking n00b questions about it and rather doing your own work in private. it won't ruin your life to talk about through say, a VPN and in an style-obfuscated text format (yes really), in fact these conversations are often fun to have.. for the whole family. if you're ever in hot water with the law, the police can and will use anything stated on public (or private) messageboards against you so if you are doing any serious black-or-grey-hat work it is better to only share what information needs to be shared at least until you understand the full legal ramifications of your actions. Now.. what being a "cool hacker" entails varies from person to person - "hacker" didn't always refer to black hats and criminal lifestyles who live outside white picket fence of *"civilized society"*, it first referred to model train hobbyists who would assemble their own tracks by hacking up the pieces and stitching them together. over the years it began to refer to phreakers and other experimental types with a special sort of enthusiasm about technology. but i think what personally impresses me is maintaining security software and systems that have a serious niche in the field. or doing a totally righteous, politically motivated data breach or other disruptive CyberCrime on the NeoFascist Societal Regime that trespasses on our rights on a daily basis and keeps us all in slavery... but you didn't hear that from me. software cracking and warez is pretty cool too. At some point you should watch the 1996 movie Hackers, as well as the 1998 anime serial experiments: lain. And you should read Snow Crash, and also Neuromancer. I can't tell you why this is necessary, let's just say things will begin to make a lot more sense once you do...

>>27525 Why would they ever admit to using it?

>>27526 >i guess that explains we have insufferable AI bros here. if it makes you feel better, even though i am fond for AI, i dont depend my life on it and fact check the information gathered from it I'm more into personal security, thanks for the long post, was a very helpful read, i'll probably stick to the book and projects you mentioned so far i have no intentions of being a black hat, i just want to learn more because... computers are everywhere nowadays, and its a weird feeling being ignorant to how these things work i have already watched serial experiments lain and it is one of the things that make me more curious to learn about these topics, thanks for the other recommendations as well for now i'll check the references provided and lurk moar, thanks

>>27529 i like the colors, what anime is this screeny from?

is it worth being cautious about proprietary firmware in memory controllers? say you FDE with good crypto and an incredibly high entropy key, a compromised (ie. backdoored) firmware just conceal the fact that it tampers with the I/O as you're writing to it? i'm not a secret agent or anything so i don't expect to have to worry about it, just curious if i should be aware of that i can't reasonably verify if a drive is compromised without physically rendering it inoperable in the process am i schizo

>>27531 what's more, high level chicanery could manipulate the popularity of particular makes and models of workhorse data center drives, maybe a deep nation-level threat actor could compromise the firmware at a supply chain level, and then they would have a 0day running in hardware that high performance clients like Google and Microsoft require for their data centers. please tell me i'm coming up with a farfetched Hollywood scenario? vendors self-signing their firmware is laughable security theater too

>>27532 this scenario popped into my head when i was considering buying a rugged Samsung drive as a backup and i remembered that veritable israeli spyware is shipped with "some" samsung phones

>>27530 https://www.imdb.com/title/tt0159145/ Cruisin' down the street in my '64 Jockin' the freaks, clockin' the dough Went to the park to get the scoop Knuckleheads out there cold shooting some hoops A car pulls up, who can it be? A fresh El Camino rolling Kilo G He rolls down his window and he started to boast It's all about writing a better post Cause the boys in the hood are always hard Come flooding your posts, we'll just discard Knowing nothing in life, but to comport Don't quote me, boy, 'cause body too short

>>27530 its from an ecchi ova called Golden Boy, very funny and freaky

>>27528 Who are "they"? If there have been enough attacks, so it's actually something worth worrying about, then surely some would have been noticed by security researchers. Or security researchers would have created exploits themselves and published them.

>>27525 So the "good news" is that Intel's consumer chips don't ship with Active Management Technology enabled or installed, which is the module that runs on the IME and allows for remote access. This is like having a server with its ports closed. No one can log in to your CPU over the internet, by default. This doesn't mean you can't get attacked traditionally through your OS and then have that malware go on to attack your CPU and turn on/install AMT. On the other hand, the x86 cores on AMD CPUs (and therefore, any OS-level malware) can't interface with the PSP after boot. Someone correct me if I'm wrong.

>>27519 Is this a real post? Please tell me he's bullshitting

How come the AI derangement is a thing here?

>>27609 It's not derangement, it's rational self-interest in response to a problem. some of us have >read ISAIF >spent a great deal of money on education, only to have our employment prospects limited by AI resume screening tools >have noticed AI lies a lot and will become illogical when discussing certain topics, which is not a desired usecase >read or watched any number of sci-fi series relating to AI, including the Dune series and The Matrix

>>27609 "AI derangement" is the new carbon footprint. It shifts the blame from corporations back to the people.

pls rate my 1-pic complete guide to safe Internet browsing

>>27625 i would change "use umatrix" to "use a privacy-hardened browser config" (which may include tools like umatrix, but probably not umatrix itself), if only because it's a discontinued project which hasn't seen an update in 5 years. firefox and its derivatives have upstreamed a lot of the torbrowser hardening which makes much of what you can do with umatrix at best redundant and at worst a vector for fingerprinting. saying this as someone who used to use umatrix extensively. ublock's adaptive content blocking/rewriting plus better cross-site sandboxing on the browser level also arguably makes a lot of "noscript"-like tools unnecessary if you're mainly doing it to avoid running beacon scripts and malware. there are still other reasons to have a well-configured script blocker though. honestly i think you could replace this entire chart with "use torbrowser and be sure to anonymize anything you upload".

>>27627 >use torbrowser and be sure to anonymize anything you upload Basically this. It's also important to note that windows or macos will spy on anything you do even if you use tor browser. These operating systems report every program you open back to the mothership in real time under the guise of malware protection. Using tor browser by itself on proprietary operating systems gives people a false sense of security and it should never be recommended without also recommending a beginner linux distro.

> it's a discontinued project which hasn't seen an update in 5 years. It still works though. I like umatrix because the interface is much simpler than ublock. noScript is like kicking dead whales down the beach balls and doesn't work properly (at least the Tor Browser version).

How would you rank the following actions from the least to the most risky: - browsing - posting (on forums/imageboards) - messaging (emailing/chatting) - uploading - downloading - buying online - selling online - hacking - attacking someone online

>>27625 >pls rate my 1-pic complete guide to safe Internet browsing Don't make "guies to safe internet browsing" if you don't know what you're doing/10 >ISP Spies on you "Spies on you" is too vague but they can still see the sites you're accessing if you're under HTTPS, they just can't see anything after the TLD. VPNs and Tor exits can also spy on you, in fact, the majority of VPNs have intense techniques for such things. >Browser spies on you Librewolf self-admittedly mentions not blocking certain data-mining requests done by the browser and ungoogled-chromium still has proprietary blobs. >mitms mitms "spying on you" is the least of your concerns if you're actually under a mitm attack. VPNs, Tor exits and ISPs can also perform a MiTM. Also, "avoid using compromised sites" is way too fuarrrking vague, at least drop some tools for checking certs. >websites spy on you uBlock has almost nothing to do with privacy/security, it's made purely for annoyances like ads. uMatrix also does practically nothing on default settings so just saying "use uMatrix" means nothing. >files you upload leak data Literally the only thing you've done half good, but most current devices wipe the metadata automatically

>>27632 It depends on all of it >How would you rank the following actions from the least to the most risky: - browsing (child porn forums or your grandma's recipe site? What browser?) - posting (on forums/imageboards) (seized forum under investigation or forum for your grandma's recipe site? What browser?) - messaging (emailing/chatting) (messaging your grandma for recipes or making a plan with ISIS? What protocol? What messaging platform?) - uploading (uploading government-only docs or a cat picture? How would you upload it?) - downloading (downloading government-only docs or a cat picture? How would you download it?) - buying online (buying a Smith & Wesson from Iran or cat food? What would you pay with? How would you buy it?) - selling online (selling nerve agent or your middle-school calculator? What currency would you receive? How would you sell it?) - hacking (kek) - attacking someone online (kek x2) Don't bother answering as your reply was stupid in the first place and I'm only pointing out how open-ended and low-effort it is. If you couldn't answer any of those yourself then don't even bother picking up "hacking"

Hi everyone, I'm from the Russian segment and work in information security, and I'm really curious about your community's thoughts on Kali Linux/BlackArch/ParrotOS. Our community values ​​Kali as a full-fledged distribution, while BlackArch is just a toolkit.

>>27638 They're Linux distros with things installed on them. I guess saves some time if you can't be bothered setting things up manually. QubesOS is pretty fun though.

>>27638 Kali is a toolkit as well. Or rather, a Kali Linux (or similarly functioning) flash drive should be part of your toolkit, it shouldn't be your daily driver for a number of reasons but the most obvious one is the use of promiscuous mode wherein the (W)NIC sends all network traffic to the CPU. This allows the device to be owned more easily as the (W)NIC offer a line of defense. There's other reasons why you shouldn't put sensitive documents on your Kali Linux or use it as a daily driver as well.

Is there any known ways of getting past the password guess limit or the password lockscreen on an iPad 7th gen with home.button running iPadOS 13.1.1 and no Apple ID logged in? It is near running out of attempts before a full lockdown and possible data erasure maybe two left since last attempt had a 15 minute timer. Password is alphanumeric not number pad. It came from my recently deceased mom and do not want to loss data on it. Wasnt sure if this needed it's own thread or not due to how specific this request is. I have a rough idea of the password but the keyboard layout on special characters possibly got changed somehow I think which makes it more difficult to guess. restart by holding power and home button does not reset the limit, it restarts the timer till next try is allowed.

>>27644 Can't Apple's support unlock devices? Maybe they would if you can prove the tablet was your mother's.

>>27529 >even though i am fond for AI I agree that AI is pretty cool, we got things like Neuro sama. >RANT WARNING RANT WARNING >WALL OF TEXT INCOMING, BEWARE >https://www.gnu.org/philosophy/words-to-avoid.html#ArtificialIntelligence LLMs like ChatGPT and Grok aren't AI (Artificial Intelligence) because they don't possess knowledge or understanding, they're "bullshit generators". The term "hallucination" implies that the "normal" behaviour of the LLM is to say true things, but in reality its nature is to bullshit with no regards for reality at all. Then why can it be correct and be coherent most times?, nobody knows, its a blackbox with "emergent behaviours", which means it manages to act certain ways after the neural network is big and trained enough, but in no moment is any sort of semantical structure teached to the LLM, or even knowledge. If the internet didn't exist LLMs would be much, much less powerful given that they would not have easy access to great amounts of training data. Humans need to do it first, then neural networks can imitate it in a pitiful manner, they are a downgrade from human skill in every way, except for one: cost, the reason why corpos are so wet about AI and push their propaganda disguised as "tech news". Every single creation has been done by humans, every single advancement has been done by humans; the whole of human civilization and human history was built by men and women; and in the year of our Lord 2026, in the early post-AI 21st century, 3 years after the creation of ChatGPT, this is still the case. Even if AI could automatically generate things for me, and do everything I ever wanted, perfectly and with no downsides, I would reject it, because what the fuarrrk else do I live for? I wonder how many LLM and generator users could have become writers, artists, thinkers, etc, but never will because of the misuse of these "tools". A tool for writing is a pen, for drawing a ruler and for thinking a good stroll; were I to pay an artist to make a painting and I described what I wanted it to be, would I be an artist and the other guy a tool? No; were I to tell a musician to use a few notes I scribbled on a sheet randomly, to use a certain style and let him come up with something, and then to come up with lyrics as well, and even to perform it, would I be a musician song writer and the other guy my tool, his voice my instrument? No; were I to do any of this but instead of asking a person I asked an LLM or generator, would I be a painter or a song composer, and the LLM/generator simply my tool? No. If you use these machines you're basically an incompetent rich kid with servants that do everything for him, except that you're not rich; you're a 30 years old AI tech bro, not precisely a kid; your "servants"/"tools" in reality are an ARPA project mega fuarrrking surveillance malware to which you disclose incredibly personal details you wouldn' tell anyone else at worst and, at best, what a calculator is to the kind of person that does not remenber how to do long division in pen and paper, unnecessary and harmful. >But bro, counterintuitive AI quantum-entangled 4th-dimensional chiral-fermion-flavored 6G-spin strange-double-virtual-complementary-ominous-exotic matter GMOs are the future! They will ascend humanity to the understanding of the multiverse and finally unify all the branches of knowledge and finally reach the perfect mathematical/geometrical description of reality (with no explanation for the why of anything, because the answer is "it is what it is", and "don't tell god what games to play" even dou god does not exist)! AND YOU WILL LIKE IT.

I'm trying to get rid of the LUKS header and it turns out that cryptsetup-luksErase(8) only gets rid of the keyslots, not the header itself. Would deleting the first 16777216 bytes be alright, according to the luksDump information for my device? I'll paste it just in case Version: 2 Epoch: 3 Metadata area: 16384 [bytes] Keyslots area: 16744448 [bytes] UUID: removed-on-purpose Label: (no label) Subsystem: (no subsystem) Flags: (no flags) Data segments: 0: crypt offset: 16777216 [bytes] length: (whole device) cipher: aes-xts-plain64 sector: 512 [bytes]

>>27648 Oops, pasted the wrong bytes, I meant the first 16384 according to "Metadata area", hexdump shows that the metadata is in the very first N bytes

I need to use my neighbours wifi for a couple of weeks until I get a router that I have in another city. Most of the inhabitants of the building are old people, so I don't think they will even notice and I am sure at least one of them will have a stupid password like their nieces birthday or smth like that. I was thinking to do a good old dictionary attack like 10 years ago, but it's been a long time and I remember almost nothing, I almost stopped messing with cybersecurity whenI finished high school. Do you have a good guide to reccomend for cracking wifi passwords? Are people still doing dictionary attacks or are there new fancy methods out there?

>>27645 >Can't Apple's support unlock devices? Maybe they would if you can prove the tablet was your mother's Id prefer not to to that route since I do not know if they snoop through stuff as they help but if I had to I could try. I think they don't have a master password or any way in without data erasing since version 11 on but Im not sure.

>>27651 I tried this before and sent deauth packets to my neighbor's wifi with his permission but couldn't capture the handshake because I think I was too far away. If you can capture the handshake by using something aircrack then yeah try to crack it using a wordlist.

>>27651 I think the easiest way is still capturing the handshake then hashcat. The first step would be to ask nicely though. It's a good excuse to meet your neighbors.

>>27652 They don't snoop, but apple inherently scans everything on the device anyway even if you don't get it unlocked. t. same situation Also there used to be an exploit to get unlimited tries no reset, but I think it's been patched. >>27651 Just bring them a bottle of wine or something, say "hi im the new neighbor and want to meet my neighbors" get to know them, and then casually mention you don't have WIFI. You will also increase the security of you house.

I torrent the movies and shows I watch from strangers and it's been fine for now, but I realized I'm trusting this internet strangers a bit too much, so I thought that maybe I just should move to buying them in Blu-ray, my player would be my Xbox One without internet. However, is this even worth it? I run Linux so even if the files were infected they would be for Windows, not Linux I guess.

>>27668 It's very improbable to get pwned that way unless you're a person of interest, there's never a problem with the format itself, it's the media player that can be exploited, and it's still really unlikely that you'd be targeted (iirc the gov paid 500k for a vuln of that a while back, but I don't remember threat assessment). Even if you somehow land on an "infected" torrent it's very unlikely that the vuln would be made specifically for your media player (though it could exploit a specific library that it uses which might coincidentally be the one also used by a more common media player, such as whatever Windows uses)

>>27498 Why many people say it's a bad idea to use VPN + Tor together? How is using 2 layers of protection worse than using 1?

>>27673 It's not worse, but it's useless. And it depends on how you use it: >You -> VPN -> Tor -> Destination Your ISP doesn't know you use Tor, but that's the only added protection. >You -> Tor -> VPN -> Destination Useless since the VPN already knows who you are. Slightly useful if you got a VPN account anonymously.

>>27651 I'd first check if WPS is enabled and try the Pixie-Dust attack (idk if a 10 yo router would even support it lol) or if you have a spare raspberry pi you can set up an evil twin hotspot

Best forum for hiring telegram hacks?

>>27679 Not this one, skiddie.

>>27526 what do you mean by AI bros? Just kids that post AI slop or actual people who study/work with AI models because they are interested?, if it's the second one i'm fuarrrked, sorry

>>27682 "AI bros" is a deragotary term to refer to those people that seem convinced that current AI are or will soon be better than specialists and preach it everywhere. They don't just "study/work with AI", they submit hallucinated patches to bug bounty program, they create a public encyclopedia "with no biases" or they bring independant websites to their knees while scraping training data, for example.

>>27683 I understand now, basically jerks who put AI above everything, everytime, despite any argument or opinion. No one likes maxis. I don't know if it's one of those cases when people talk too much of something (or too confident about it) and knows very little about it. Is it?, I don't know any "AI Bro" so I can't give a proper answer on this.

Where do you get data breaches to parse through American logs? Since the last site went down and just got mass leaked.

I am trying to make a chat webpage with the following features: - Nobody is allowed to post unless they physically reside at less than 150 Km of distance from the server where the webpage is hosted. - Nobody is allowed to have more than 1 nickname, nor to change it. How can I achieve something like this while also making sure all data stays 100% anonymous and private?

>>27686 You don't. You will have to compromise on at least one of these, probably more.

>>27687

>>27686 >ok, so I want to know everyone's location and tag them with a unique identity >but it also has to be anonymous Those are conflicting requirements. Even a ping time check wouldn't give you reliable information on actual physical distance. If this is about creating a local forum where you only (or mostly) meet people you could actually meet irl, you'd be better off either somehow hosting on a local mesh network, which might leave you with almost no users, or a softer barrier of interest, like picking the topic of your forum to be something relevant only/mostly to your particular region.

>>27697 You know how it is and you know how we do

>>27686 >>27698 Can't the data be stored in the server and encrypted in such a way that nobody (other than the software itself) can read it?

with how sketchy the tor project has been the last couple years, would it be a better idea to use tor with w3m instead of the tor browser these days?

Is it true that there's a US law that forces *every* producer (from big corpos to random amateurs) of *every* program that features cryptography to insert some kind of "backdoor" into it that allows them to decrypt and read any message at CIA's request, with jail in case they refuse to comply? If yes, what's its degree of enforcement?

>>27731 Not that I know. However, every company that operates in the US has to comply with request from the government for data, even if the data is stored outside the US and concerns non-US citizens. If what you are saying was true, nobody would use things like Tor or SSL

>>27686 >>27687 >>27698 >>27718 How 'bout this: - the site itself is open source - the server is collectively owned by the users and locked away in a place that only be accessed through X keys, where X is half the number of users - Each post requires to be signed with a fingerprint. - If there is no match, the user will be able to choose a nickname. - If there is a match, the nickname will be automatically set to match the previously chosen one. - All data is encrypted in a way that also requires X keys to be decrypted. Dunno about geolocations, but could this work, at least for the nickname issue?

>>27731 no, that's completely false. >>27730 probably not because of fingerprinting, w3m's sandboxing is nonexistent, and you'd be missing out on the tor browser's circuit logic. when your proxy a tor unaware program through tor it will either send all of its traffic on the same circuit which is bad because it makes it trivial for your destinations to tie your activity at one destination with that at another, or it will route each site's traffic through a different circuit which is bad because the more circuits you construct, the more likely you are to construct one made up of enough malicious nodes to deanonymize you, and it's trivial to force a web browser using the naive one-circuit-per-site approach to construct infinitely many circuits. the tor browser doesn't have these problems since it's smarter about what requests go to which circuit.

I wonder if tor + proxychains is enough to hide my IP address when I connect to some IRC server or chat. If it isn't, I would appreciate recommendations of how do it.

>>27795 yeah its enough if you know how to do it properly. ive been using proton vpn as my main vpn because it's free. is it worth it to pay for mullvad or should i stick with proton?

Alright lads, I might beable to talk some basic theatre but I need an entry into steganography - tool names, depositories or whatever. I don't even know how to use github at this point, but I'm picking up fast(er than usual). Also, are burn after compromise devices OTT if you're just doing regular soykaf? I browse & post on the net but my machine has started acting odd since I spun across the Lain Webring. Cheers o/

>>27764 why aren't there any real alternatives to the tor browser anyway you would think some schizo that doesnt trust the tor project wouldve forked it by now

>>27816 >why aren't there any real alternatives to the tor browser Because the real value of anonymity networks lie in the size of the anonymity sets. A schizo can set up his own anonymity network, but if only a dozen people are using it at any given time, then it doesn't really work as an anonymity network; users can be easily de-anonymized.

>>27805 I start the tor daemon then I test if the proxychain is working with curl + the torproject API. And that's it. If I recieve a "isTor: true", it's fine. Should I have more caution?

I've been posting from my home network with no proxy, VPN, or Tor, on some imageboard, and they flagged my IP as having used such a service. Should I be worried that somebody hijacked my home server or router or whatnot to be used as an illegal, "residential" proxy, or am I just paranoid? What is the most logical explanation for that imageboard just randomly blocking my home IP as using a proxy?

Are these CVE-2026-34980, CVE-2026-34990 AI-slop? I looked at description of CVE-2026-34980: > In a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication Then looked at piece of code: > def require_root() -> None: > if os.geteuid() != 0: > raise SystemExit("run as root: sudo python3 F001-repro.py") Then looked where script connects - to the same machine: > conn = http.client.HTTPConnection("127.0.0.1", 631, timeout=10) https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf So, I am a fuarrrking ROOT without auth who connects to myself to launch vim. All python code of PoC looks kinda gibberish, wtf is reverse shell launching making in launching vim? I also read post about "finding" this CVE: no human participated, only AI agents made all the job: find the "bug" and write the exploit. https://heyitsas.im/posts/cups/ But really what the fuarrrk? This is "unauth" RCE. And you must be fuarrrking ROOT. To fuarrrking launch vim on your own machine through cups. Why is this even a vulnerability?

Thoughts on Protonmail vs Tutanota? Yes, I know neither of them are "actually secure", but do they fingerprint you or harvest data? And are there limitations or requirements to each service?

>>27884 >Protonmail They have handed over payment data and recovery emails to LE and turned on IP logging for specific accounts when asked to >Tutanota A while back an RCMP guy testified its a 5 eyes honeypot but nothing came of that afaik. Worth noting germany is 14 eyes, not 5 eyes, so he might just be bullshitting

>>27886 Proton is a public corpo so obviously they will bend down for authorities for big investigations. Just use proton with .onion. Encrypt with P.G.P, no idea if keys are stored safely or key disclosure laws can force them to leak.

>>27890 >just use onion >js webapp im sure that this doesn't create real problems for most users, but its honestly disappointing that more webmail hosts don't use a js-free client like squirrelmail.

>>27884 Protonmail blocks account confirmation emails from other services, so they must scan headers at least, if not entire messages. >>27886 >bullshitting That does seem like something he wouldn't have been allowed to say if it were true. How would someone at his level get that kind of information, anyway?

Listening to the darknet diaries episode on the superbox. I always assumed there was some government agency somewhere that checked that consumer devices weren't just pure malware. How many IOT devices are just botnet straight from the manufacturer?

So, I just installed OpenSnitch to know whether any program is trying to connect behind my back and, as expected, I started getting several warnings. But how do I know which ones are malicious and which ones aren't? Some of them are fairly obvious and I've already dealt with. But some others I just have no clue, like pic related for example (they pop up some minute after every session); can someone help me understand what they're about and whether I should be concerned or not?

>>27916 >avahi It's trying to connect to network printers, disks, and the likes. It shouldn't get out of your LAN, I think. I assume the hidden part is a local address. It doesn't glow, as far as I know, but you can uninstall it if you don't use network printers. >systemd-resolved It's your browser doing that. Either because you searched something, or just to get the icon. >snapd >apt/http You have enabled automatic updates (I guess it's enabled by default on ubuntu). You can disable it if you want, just run apt update && apt upgrade as root once in a while, and whatever the equivalent is for snap. >cups-browsed It's trying to get a name for a local printer it found, I guess. The hidden part before .in-addr.arpa is a local address. It probably doesn't go farther than your router, or your ISP's DNS. It isn't anything sensitive anyway. >fwupdmgr Autoupdating firmware. I wouldn't install it on my computer, but it doesn't glow too much, I think. That's what you get for using ubuntu. >python Wtf is it doing, leaking your username like that? Find where the config is to disable autoupdates.

>>27916 >>27917 jfc you two, its not your username its the hostname, and pythons not spying on you lol its trying to resolve the FQDN, please dont larp and dick around with your system without understanding basic networking, if you dont trust your os then dont fuarrrking use that os

>its trying to resolve the FQDN Unless you're running a complex enterprise network, there is no reason to do that. Your laptop isn't going to have a stable IP address. >then dont fuarrrking use that os I couldn't have said it better

>>27919 critiquing debian for bloated network connections are we now? ironic that people only get critical thinking skills when they think its a chance to soykaf on a distro they dont like https://github.com/mvo5/unattended-upgrades/blob/master/unattended-upgrade#L1574 block the request with your firewall if you dont care about getting notified and stop huffing your own farts over nothing

>>27920 You're being weirdly defensive >critiquing debian for bloated network connections are we now? Who did that? Lain isn't even using debian.

>>27921 what do you think ubuntu is based on, genius? https://wiki.debian.org/PeriodicUpdates you donkeys are spreading fud about a basic debian package maintained by a longtime developer because you lack the reading comprehension to understand the difference between a username and hostname and are too lazy to do a single internet search

>>29722 it's a natural and entirely obvious consequence of this site trying so hard to be "inclusive" towards lazy and incompetent people, the posts are now also lazy and incompetent

>>27923 typo, swapped 7 and 9 >>27922

>>27917 >>27918 >>27919 >>27920 >>27921 >>27922 >>27923 >>27924 nobody said the particular username is not the same as the particular hostname.

>>27810 Look at this archived thread https://archive.is/tqLhC And then this website https://exo.substack.com/p/the-exo-guide-to-data-cloaking

Is using a service through a web browser always better for anti-fingerprinting than using the app? Browsers can have different configurations, but the app is always the same, isn't it?

>>27930 yes, but not for the reasons you give. Browsers give you more ability to restrict/control what information a web app sees. Most of the time, apps are just web sites running in a custom browser that gives them the ability to harvest more data. Use the browser whenever you can. Treat apps as hostile.

>>27930 >Is using a service through a web browser always better for anti-fingerprinting than using the app? I am going to assume you are talking about apps on smartphones? If you are using Android then you can check for embedded trackers inside the app you are going to install from Google Play or F-droid on Exodus Privacy (https://exodus-privacy.eu.org). For third partie apps outside the Google Play store and F-droid you can use TrackerControl (https://f-droid.org/packages/net.kollnig.missioncontrol.fdroid). Beware that this is badness enumeration and hidden trackers can still slip by.

I have an old Samsung Galaxy phone which I don't use anymore but to run a specific app. I picked up recently, and it was like a running a script where it disconnected itself from the wifi and turned ou the hotspot. Then it went through my SMS messages very quickly. It kept trying to open a home security app repeatedly. I think this was not an AI program because it failed to recognize that it would have had to agree to the ToS of the app. It did try to open other apps, and do more stuff. I don't remember the details. I tried to turn off the phone, but tit didn't work. It also ignored all my input. There was no way of getting the battery out, so as a final resort I put it into a metal box that has some faraday cage functionality and left it there. I would prefer to use this phone once in a while. Besides running updates, is there anything I can do to prevent whatever person/entity that was doing that from spying on me?

>>27949 Depending on how deep the trojan inserted itself, you can try a factory reset, and install a free ROM to get a more secure OS (and remove manufacturer / google spyware). LineageOS is made explicitely to provide updates for phones whose support was dropped by the manufacturer. There is also postmarketOS, which works more like a normal Linux. There is no garanty this will work though, because the attacker could have inserted a trojan into the bootloader and this is much harder to wipe (as in, for most phone, no one did it and you're on your own).

>>27950 Thats one thing I never heard anyone talk about. How do you even clean a bootloader on android? Is there other flash chips you have clear out?

Does disabling uBlock on Tails' Tor Browser increase anonymity by blending in with normal Tor Browser users, or decrease anonymity by looking different from Tails users?

>>28034 depends on whether you use javascript

>>28034 "Anonymity" is proportional to size of the anonymity set. Stats: https://metrics.torproject.org/webstats-tb.html https://distrowatch.com/table.php?distribution=tails Probably other differences between the two, which would make disabling uBlock stand out more. Same if an adversary could detect uBlock is installed but disabled. Dunno if possible.

Man, I Don't know where else to ask this, so, here goes: I installed yggdrasil but unbeknownst to me yggdrasil network doesn't focus on security, which, is whatever, but, I still want to access some yggdrasil nodes with out compromising my security. Apparently you can set it up to run with tor, or, i2p, but, the instructions for this are vague and confusing and not very helpful. Can anyone help me with this?

>Kali is a toolkit as well. Or rather, a Kali Linux (or similarly functioning) flash drive >flash drive DVD on a USB-powered DVD-drive > usb flash < SD card with that funny little lever on it

>>28053 you got it mixed up DVD on a USB-powered DVD-drive < SD card with that funny little lever on it < usb flash

Is it really impossible to secure Bluetooth connections or spoof hardware identifiers? If so, are there any workarounds?

>>28121 Is there a single server out there vulnerable like that? Just POST to it I guess

lain, can you suggest me a CVE RSS feed or a CVE website that does not require javascript?

>>28167 tonyharris.io, I guess But beware, some links to PoC's are actually links to neuroslops.

>>28167 how about this? https://github.com/CVEProject/cvelistV5

g:6755467234350028 what is it? Is Microsoft knowing every single thing I'm doing over Internet?

Anyone has an archive of https://algorithmic-sabotage.github.io/asrg/posts/sabot-in-the-age-of-ai/ ? It's a list of tools for AI poisoning by the Algorithmic Sabotage Research Group (ASRG), they gave a talk last year at defcon31, looks like everything about them got wiped out of the web, including this github link which was excluded by the wayback machine.

>>28188 I'll second this in case anyone has anything on it. I found some discussions on this, but nothing about the actual content/document in full. Some of the links below quote all of the ten statements though. Is there more related to it aside from that? https://monroelab.com/2024/04/02/manifesto-on-algorithmic-sabotage-a-review/ https://www.are.na/block/34122127 https://reincantamentox.substack.com/p/drop-17-manifesto-on-algorithmic

>>28189 i found the link on jwz's website (www jwz org/blog/2025/08/algorithmic-sabotage-research-group/), it looks like there was a list of strategies and tools (possibly made by them and hosted on the repo is my guess, given the effort to wipe it out of existence. what a great idea using github by the way)

What's Lain's opinion on hyperbola GNU/Linux-Libre? I am using it and so far i like it but i was wondering about security. It's one of the few distribution endorsed by the FSF.

Why is musl more secure than using regular glibc ( I don't think this is specific to void linux but that's the only time I have ever used a musl distro )

>>28215 >musl is heavily focused on minimality, which results in very small attack surface, whereas other C libraries such as glibc are overly complex and prone to vulnerabilities. For example, over a hundred vulnerabilities in glibc have been publicly disclosed, compared to the very few in musl. While counting CVEs by itself is often an inaccurate statistic, in this case, it represents an overarching issue and is symptomatic of underlying security issues. musl also has invested in decent exploit mitigations, particularly its hardened memory allocator, heavily inspired by GrapheneOS' hardened_malloc. https://madaidans-insecurities.github.io/guides/linux-hardening.html#choosing-the-right-distro The CVE argument could also be reversed and said that since glibc has more scrutiny it has more bugs and exploits found and thus more CVE's than musl. If you would like to know more look at the sources the guide links. Not to be rude, but this can be found using basic web searches lainon

At a pathetic moment of my life I confirmed my age on X and OnlyFans. On X with a selfie and Onlyfans with a pic of my passport. On both sites I used different gmails, that are not my main gmail. But I have used them alongside my main gmail in the same browser session so they are basically connected. I have since realized my foolishness and come to be interested in online privacy. How fuarrrked am I? How trustful are those age confirmation services? How easily could someone connect my alternative gmails with my picture/passport/main/phone number (linked to my main gmail) / main gmail? Is there something I should do to prevent further damage?

>>28227 >How trustful are those age confirmation services? basically not at all. >How easily could someone connect my alternative gmails with my picture/passport/main/phone number (linked to my main gmail) / main gmail? Fairly easily, although it really all depends on how much effort they are willing to go through to get it. They'd have to either be cops or be very rich, and they'd have to jump through lots of hoops. >Is there something I should do to prevent further damage? delete all of those accounts. This doesn't make that information go away, but it probably makes it harder to find. >>28217 the main reason people (correctly) trust musl over glibc is because it has a design philosophy that prioritizes correctness over performance. If glibc were also developed this way, then your CVE argument would make more sense. However we'd still need to quantify how much more scrutiny glibc gets than musl.

>>27498 is Damagelib forum still alive?

>>28227 > How easily could someone connect my alternative gmails with my picture/passport/main/phone number (linked to my main gmail) / main gmail? Easy, and not only with alt emails, but potentially even with browser fingerprint. > Is there something I should do to prevent further damage? If you want to erase that link, clear all cookies and use different emails and new accounts. Also make sure your fingerprint is at least different, best if untrackable practically. Read about that online.

>>28254 No, the main person with site backups "disappeared" (possibly detained, arrested and never will come back). The others mods want forum to reborn but the time is needed.

Can someone expalin how mullvad's no kyc payment method somehow eliminates the trust issue? The proponents say that because you pay anonymously without an email or banking info, there is no way to associate the account with you. Despite the fact that if mullvad logs your activity it can be cross-referenced with your ISP logs to idetify you. So you still have to trust that they don't log any info.

Anyone have thoughts on passkeys as an end user experience? How do you set yours up if you use them? In an ideal world how would you have authentication work?

>>28284 >eliminates the trust issue It doesn't. But it's better than having an actual credit card with your name on it associated to your account. With other services you have an e-mail a card and your full name stored somewhere possibly permanently, if you pay with crypto or cash you have less to worry about. If you're paranoid you could use a VM + tor since mullvad require javascript to open an account and only connect to it through a proxy/tor.