Browsing Security

[silverwolf1]

6 hours ago, x86 said:




No no, I'm not talking about all public VPN's I'm just talking about ones that give you the service for free. Though I'm not really sure what they could do with it, there's probably some way they could sell it or something. So if you're paying for it you can be a bit more assured that they are not doing anything shady with your data.

If you're paying for it, they've got a lot more on you that they can now sell to someone else..




sw

[heavyhorse]

1 hour ago, silverwolf1 said:




If you're paying for it, they've got a lot more on you that they can now sell to someone else..




sw

This is absolutely true.  Since '01 the world financial system is specifically designed to be trackable and traceable.




And no, bitcoin is not a solution to anything.... [img]<fileStore.core_Emoticons>/emoticons/rolleyes.gif[/img]/emoticons/[email protected] 2x" title="9_9" width="20" />



 




And I'm a bit mystified by your contention that the exchange of money guarantees moral and ethical behavior.  Most of the evidence I've seen would seem to indicate otherwise.




 

[caikgoch]

1 hour ago, heavyhorse said:




And I'm a bit mystified by your contention that the exchange of money guarantees moral and ethical behavior.  Most of the evidence I've seen would seem to indicate otherwise.

It's a dead certainty that someone is paying for the bandwidth.   If you are sending money there's at least a chance that they're satisfied with it.   If you aren't sending money, someone else is.

[WinterGreenWolf]

17 hours ago, threelegs said:




I don't store my passwords in ANY electronic format.

There's a way you could do this if desired, it's called 'Air Gapping', a computer with zero internet connections: no Wi-Fi, or Ethernet connections.




Some tools I'd recommend for those looking to store a message / password would be PGP (No, not just for sending Emails). Unless someone gets your PGP Keypair it's very hard / impossible to get the contents of an encrypted file / message.There was, however, an exploit in Thunderbird (and a few other mail clients) that would allow HTML injection, causing the client to spit out the private key.




Now, as for VPNs: I actually don't use one, and there's only a few cases I would. Some of those include living in a state like Washington / Oregon (their little 'animal protection laws' bullshit, that even makes talking about the subject risky), or if you're sharing / downloading Beast Porn / pirated 'stuff'. There's this 'mass IP panic' going around on the internet, which, is partly true and partly bullshit.




The truth to the IP Address Panic is that it CAN give away your ISP, and a nearby city: however, it cannot give away your exact physical location unless the ISP is taken to court / releases your information, in that case, a VPN isn't going to help you anyways.  I'm not telling you to be careless however. I for example, still use things like HTTPS Everywhere, and have switched to FireFox, I have it's strictest 'no tracking' options on, and I also don't really do anything 'Zoo' on my Phone.




Make sure if you're on a mobile network you DO try to use more protection like Tor, as mobile networks often can gather and use GPS Data, which is more surefire. If you keep your 'mobile data Zoo' stuff limited, then you likely will not have issues.




 

[heavyhorse]

I'm not sure what WA/OR have going for them; most places confinement, losing your animals and having them killed, being ostracized by family, friends and employer, losing home/ farm because you can no longer support it, permanent placement on a national sex offender registry, are reasons enough to hide where you go and what you do on the web.  And even if it's not an issue today, that may change during your next legislative session, and your past on the web will haunt you forever. 




And apparently your unique machine ID is sent to wherever you go.  Not your IP address, your machine digital serial number.  That's why you get "We don't recognize the device you are using" message when you log on with a different machine, or replace a motherboard.  Reason enough to use a VPN half way across a continent and encrypt your traffic to that VPN so your service provider and anyone else who is watching can't see where your machine goes and what you say, all they see is that your machine ID is connected to a VPN server farm, and all the other end (site) can see is the location of the VPN server farm that your machine is connected to.  Along with a million other users. 




 




 

[x86]

8 hours ago, silverwolf1 said:




If you're paying for it, they've got a lot more on you that they can now sell to someone else..




sw

This is also true, but as i said it sort of gives them incentive not to do anything bad with customer data. As someone else in this thread there has to be a way they are paying for the bandwidth.




I'm not really sure what the best solution is but what i currently do is just use tor + a paid for vpn as that's what feels the most safe to me.

[heavyhorse]

TOR is very secure.  It's slow, awkward, uploads/downloads may not complete, some sites won't allow users.  But it's the most secure.  It is NOT infallible however; it can be intercepted at a node midway and re-transmitted with a tracker inserted.  (I don't know the technical term for it).  This is mostly an issue with "high-moral-issue" super-dodgy sites.    Don't go there and you're likely good.... 




 

[WinterGreenWolf]

So,. not going to quote / directly respond to anyone here: but I do see some things I myself, as a former 'cracker' / hacker / 'breacher' that are somewhat-true, and some that are not. My point for making this post is to tell you all this, NOTHING is truly 'secure' or 'stable' in the sense of online presence. Why do you think there are companies spending millions on Cyber Sec., I also have a friend who's going for a masters in IS / Cyber security..




Now, here's the big player, social engineering. It doesn't matter HOW good your 'setup' is, or how 'encrypted' your shit is, if someone wants you, and you slip up: they'll have you (yes, big companies included). This is why keeping account names separate (Zoo v. 'Normal' online) and some basic encryption plugins (think HTTPS Everywhere) are usually enough IF you are careful.




This means keeping 'face pics' and identifying animal photos (tags, etc) offline, stripping Meta-data (EXIF, etc...) out of your files you upload, strong passwords, etc... Also, IP Addresses, MACs, and even MachineIDs can be spoofed: on most Linux OSes you can outright change your MachineID.




However, if I can trick you in to downloading a Keylogger, a kernel-level 'payload' (something you won't see, but that can inject / run code, backdoors...) then I'm in regardless. Remember, big companies (Google, Apple, Microsoft, et-el...) ALL do these sorts of things in the name of 'statistics' and 'improving service'. Luckily you can disable a lot of this crap by force or a setting that looks a little obscure. I for instance, don't use Windows anymore, I have my browser locked down well enough, and whilst I have a Google / Discord account, my Google account sees NO Z activity, no photos, videos, etc...




Not going to go in to Legislation here, because whilst that's important, this isn't the place for it: I can tell you though, you SHOULD be a little more careful with your traffic in the Pacific NW states.




Going to un-follow this thread with these words folks...




Your TOR, your proxies, your VPN, your 'no-script' in browser, they aren't going to protect you if you're reckless or using compromised software (think Microsoft products, especially 'Edge' for browsing, for example).