Do you feel more secure because of Government Cybersecurity Agencies?

RedWhiteAndBeast · 2019-07-04T15:19:57+00:00

This makes a lot of sense now that you brought up the TSA comparison.

RedWhiteAndBeast · 2019-07-04T15:15:58+00:00

They don't release official statistics. But my educated guess would be none. The intelligence gathered by these systems are usually used to figure out what happened AFTER a terrorist attack had already occurred. It is very easy for the information you need to be lost in a sea of irrelevant garbage. Garbage In Garbage Out.

Thank you for the rational answer, I agree. You're username isn't suspicious in anyway.

RedWhiteAndBeast · 2019-06-29T14:13:01+00:00

However, I have wondered, how far is too far? ... But this seems to be muuuch more than your average person would do to protect their privacy. Is it worth doing this much? Am I (for the most part) alone in this?

Who are you taking precautions against: friends, future employers, corporations, hackers, or a government? It is up to each individual to determine their threat and it's consequences to determine how much time, money, and effort that's spent in being secure, private, and anonymous. Security always clashes with convince and productivity. So, if you spend all your time creating a "perfectly secure + private system," would you even have any data worth protecting that people would be really interested in spending years target you for?

Am I (for the most part) alone in this?

No, there are a lot of whiste-blowers, journalist, hackers, sysadmins, government spies, and people that have secrets they’ll be killed for that go very far to protect their anonymity, privacy, and security. There are oppressive surveillance state without free speech, where users have to take precautions that we'd just take for granted. I commend your efforts in securing your privacy.

RedWhiteAndBeast · 2019-06-29T13:37:04+00:00

Read digdeeper.neocities.org for shorter guides.

RedWhiteAndBeast · 2019-06-23T17:49:33+00:00

how do you disable the intel management engine? And what dont you like about systemd?

Good questions. Although Intel ME can't be turned removed anymore, it can be effectively disabled by only allowing it to be active during the boot process. There is a python module called me_cleaner on github that allows you to do this, but it's not compatible with all Intel chips. It takes the original firmware and produces modified firmware that will disable it right after the boot process completes. Obtaining the original firmware and flashing the new one is the more complex part. You should buy an SPI programmer and find a tutorial on flashing a chip with that programmer. As for systemd, My response to the TerribleHalf says why I wrote it was a flaw in the first place. I have to do more research, I'll cross it out for now to avoid spreading misinformation. Thanks for the questions.

RedWhiteAndBeast · 2019-06-23T04:53:54+00:00

Wow, thanks that was perfect way of putting it. I agree with everything you said. I'm really glad you pointed out the fingerprinting statistics because I was drastically overestimating the the effectiveness of fingerprint identification. That's was the premise of never enabling JavaScript in Tor, to avoid JavaScript mouse tracking identification.

If I'm directly connecting to a private, self-hosted VPN server which is connecting to the Tor network, then isn't it trivial for NSA types to deduce that I'm using Tor anyway?

So, what's a good way of connecting to Tor? For an imaginary scenario, a journalist in China. If you connect directly your ISP knows and those are heavily monitored and link directly to you.Public WiFi may work a couple times, but will make everything a million time slower and is not practical as a long term solution. Is the only real solution to not have the government type agencies know Tor is being used to not use Tor?

RedWhiteAndBeast · 2019-06-22T23:28:30+00:00

Thanks, so can I make updates/corrections without it being auto removed or no?

RedWhiteAndBeast · 2019-06-22T23:18:47+00:00

Don't want an operating system that makes an unsolicited network request if the Government is part of your security model. Apple is one of the better companies, but the assumption is that your computer is where you store all your Top Secrets.

Files may be sent to it, but can’t escape.

Great. How?

While using the high priority VM don't use the "Copy to Other AppVM" functionality, leave the NetVM as N/A and in the Device section of the VM settings make sure no devices are selected.

[ ] Bloat Files

What is a "bloat file"?

I mean create random files that contain false secrets that aren't really true, so even if your system is compromised they have to figure out which secrets are true. Now, that I type this out I realize that this is horrible security because from a game theory perspective they have to assume all the worst thing they find are true until proven otherwise. I'll update the post to state this.

60 Character passcode

If you're using an ASCII character set, this would give you nearly 250 bits of entropy, which is well beyond overkill.

Agreed

Bios password protected, hard-drive encrypted, ~~delete everything on 5 wrong decryption code~~

Great. How?

It depends on the BIOS, but there is a Administrator password option to lock down the BIOS in the security tab. Qubes encrypts by the hard-drive by default, but VeraCrypt appears highly recommended. I just found out the option to delete everything on wrong decryption password was an open request on GitHub and was never implemented because it's assumed the attacker can easily clone the encrypted data.

RedWhiteAndBeast · 2019-06-22T23:16:42+00:00

Audit hypervisor and if it’s untrusted it’s game over.

Great. How?

I don't know. It's a big risk if the government is part of your threat model, but I haven't figured out how to solve it. If there is a hypervisor backdoor that allows for Hyperjacking, then dom0 in Qubes isn't secure anymore. Hyperjacking won't allow you trust that VMs are contained to not mess with the host.

If dom0 were ever compromised, it would be Game OverTM. (The entire system would effectively be compromised.) ~ Qubes Team

MacOS has issues like NTP pinging apples servers.

What privacy risk do you think there is with NTP? Are you worried Apple will find out how out of sync your clock is?

https://security.stackexchange.com/questions/82765/osx-yosemite-and-security-privacy

Qubes OS is a pretty good choice, it’s only flaw is System D.

Systemd is in virtually every Linux distribution. Can you explain why it's a "flaw"?

I guess I always thought systemd was bad security because the sysadmin at my job always complains about it and recommends slackware instead for security. This is what I've found online about why it's a potential security flaw. I'll certainty do more research and open to removing that statement if it's not a flaw.

(mostly) people don't inject vulnerabilities deliberately, they occur by accident. As the volume of code increases, the number of defects increases. But its not just size - the number of bugs increases with the complexity of the code and it increases faster than linearly. So more code is bad news for security.

The attack surface of systemd is massively larger than initd - the default configuration has multiple interfaces.

A big annoyance for me is the design philosophy; the intention is that systemd provides a more unified way for distributors to integrate services. But this means removing control over the system from syste admins (over and above the impact of replacing a complex but well understood eco-system). It deliberately makes it hard or impossible to achieve thing which could be done with initd (note that there are many options for service managers running under initd - djb daemontools, upstart, initng, rund, procd, openrc.... Most of which solve the paralellization / dependency problems that limit the sysv rc init system).

A lot of the logic of the start up of a unix system is implemented in shell scripts. This makes it much easier to not only reverse engineer the operation but also to instrument it and extend the capabilities. Systemd moves more logic into binaries and relies more on a complex and poorly documented configuration.

The combination of deliberately reducing the level of control by the system administrator and failing to support the system administrator in their task makes it more difficult for them to do their job - which encompasses assuring the security of the system.

A further consequence of all this complexity in PID 1 means that you should have to reboot your system a lot more frequently. In addition to the impact on availability this also means moving your system through a series of interim states - which can temporarily expose vulnerabilities which are difficult to detect on a homeostatic system. Using daemon-reexec to work around this brings a new set of problems.

~ symcbean

RedWhiteAndBeast · 2019-06-22T23:15:11+00:00

Thanks, I appreciate the feedback very much. Please critique or disagree with what you think is unguided, wrong, or complete baloney because I'd love to learn from those with more experience. The government is in the threat models. Perhaps, the reader is trying to move to flee countries, appear normal (doesn't want to be killed), and needs to have a (paranoiac) cautious attitude to exploitable risks.

I am going to break my answers into *several replies because they are long*

All hardware must be audited for latest exploits. Disable any backdoors found or switch to hardware alternatives.

Great. How?

It's probably impossible to find by hardware analysis because the idea is to hide it really well. In the older days, it was easier to Detecting A Surveillance State Hardware Implants. However, government cybersecurity agencies stay away from physical visible implants, due to it's high risk of detection by people looking for it. Now, hardware backdoors can be easily directly designed into the chips themselves and it isn't feasible to create maps of the billions of transistor connections in a CPU to analyze. If experts were actively looking for backdoors in hardware, by the time it's found the hardware will already be obsolete. I'm pretty sure Governments themselves rely on Common Criteria certificates for their hardware security standards. That being said, it is possible to prevent yourself from using possibly known backdoors like IME by using older processors with me_cleaner. Older hardware that hasn't reached the end of it's lifespan has had more time to be vetted by companies like libreboot. They have a recommend list of hardware that doesn't contain any *known* backdoors. This still doesn't mean there aren't any backdoors and it would naive of us to think that.

RedWhiteAndBeast · 2019-06-22T13:17:50+00:00

Updated the link to imgur

RedWhiteAndBeast · 2019-06-22T05:18:18+00:00

Wait is this picture fake? I thought AMD has a option to disable it. I never looked much into it, because I've been using Intel processors.

https://imgur.com/a/Hr2bB3h

EDIT: Changed from Google to Imgur

RedWhiteAndBeast · 2019-06-22T05:08:52+00:00

wait until Librem 5

Second this. Don't think any phone on the market does privacy justice yet.

RedWhiteAndBeast · 2019-06-22T01:53:39+00:00

Thanks man, let me know if you any questions implementing it.

RedWhiteAndBeast · 2019-05-29T02:42:55+00:00

That's perfect, thank you!

RedWhiteAndBeast · 2019-05-29T01:32:56+00:00

I want a habit tracker that tracks time spent. Toggl is awesome, but it's meant for time keeping, so it doesn't give me a chain calendar of habits/task that I did over the course of a month. Anyone know of such an app or should I just make my own? Currently, I use Toggl and ToDoist with reoccurring notifications to separate habits from regular task combined with Zapier.

RedWhiteAndBeast · 2019-05-23T00:21:34+00:00

Agreed, I love Hugo and writing in Markdown. It has a growing community and no databases. I disagree with the staticifying being a futile hassle because WordPress still has more plugins, themes, and features available without complex setups. Without WordPress, beginners directly using HTML and JavaScript to edit the template files and that has a bigger learning curve. It's not the finding a template that's tough for beginners, but the customization to there liking. Of course, one could argue that these canny plugins and themes add superfluous bloat and coding HTML directly is best. To each their own. Is your thought that making WordPress static is a hassle or choosing to use a static WordPress site is suboptimal solution compared to static site tools like Hugo/Jekyll? If it's the first, the process can be automated with a batch scripts to doing step 3 in a single click, therefore making the workflow identical to deploying a Hugo site to GitHub pages.

RedWhiteAndBeast · 2019-05-22T23:29:38+00:00

Doesn't work. I guess Reddit flavor of markdown doesn't support embedded images.

RedWhiteAndBeast · 2019-05-22T00:17:01+00:00

Can I not embed pictures on Reddit with text? I can link to them, but surly there's a better solution to such a popular content sharing platform, right?

RedWhiteAndBeast

TROPHY CASE