On Mon, Sep 09, 2013 at 10:36:09AM +0100, thegeezer wrote: > There's a lot FUD out there and equally there is some truth. the NSA > "we can decrypt everything" statement was really very vague, and can > easily be done if you have a lot of taps (ala PRISM) and start doing > mitm attacks to reduce the level of security to something that is > crackable. > for 'compatibility' very many low powered encryption schemes are > supported and it is these that are the issue. > if you are using ipsec tunnels with aes encryption you can happily > ignore these. > if you are using mpls networks you can almost guarantee your isp and > therefore your network is compromised. > the question really is what do you define as security ? > if someone was to hit you on the head with a hammer, how long til you > willingly gave out your passwords ? [1] > I agree with the lack of faith in certificate CA's and i feel that the > reason that warnings over ssl are so severe is to spoon feed folks into > the owned networks. I far more trust the way mozilla do their web of > trust [2] but equally am aware that trolls live in the crowds. > while ssh authorized_keys are more secure than passwords, i can't (and > am hoping someone can point me to) find how to track failed logins as > folks bruteforce their way in. yes it's orders of magnitude more > difficult but then internet speed is now orders of magnitude faster, and > OTP are looking more sensible every day [3] to me. > i used to use windows live messenger and right near the end found that > if you send someone a web link to a file filled with /dev/random called > passwords.zip you would have some unknown ip connect and download it too. > who then is doing that and i trust skype and it's peer2peer nonsense > even less. > who even knows you can TLS encrypt SIP ? > there are many ways of encrypting email but this is not supported from > one site to another, even TLS support is often lacking, and GPG the > contents means that some folks you send email to cannot read it -- there > is always a trade off between usability and security. > i read in slashdot that there is a question mark over SELinux because it > came from the NSA [4] but this is nonsense, as it is a means of securing > processes not network connections. i find it difficult to believe that > a backdoor in a locked cupboard in your house can somehow give access > through the front door. > how far does trust need to be lost [5] before you start fabricating your > own chips ? the complexity involved in chip fabs is immense and if > bugs can slip through, what else can [6] > ultimately a multi layer security approach is required, and security > itself needs to be defined. > i like privacy so i have net curtains, i don't have a 3 foot thick > titanium door with strengthened hinges. > if someone looks in my windows, i can see them. either through the > window or on cctv. > security itself has to be defined so that risk can be managed. > so many people buy the biggest lock they can find and forget the hinges. > or leave the windows open. > even then it doesn't help in terms of power failure or leaking water or > gas mains exploding next door (i.e. the definition of security in the > sense of safety) > to some security means RAID, to others security means offsite backup > i like techniques such as port knocking [7] for reducing the size of the > scan target > if you have a cheap virtual server on each continent and put asterisk on > each one; linked by aes ipsec tunnels with a local sip provider in each > one then you could probably hide your phone calls quite easily from > snoops. until they saw your bank statement and wondered what all these > VPS providers and SIP accounts were for, and then the authorities if > they were tracking you would go after those. why would you do such a > thing? perhaps because you cannot trust the monopoly provider of a > country to screen its equipment [8] > even things like cookie tracking for advertising purposes - on the > lighter side what if your kids see the ads for the stuff you are buying > them for christmas ? surprise ruined? where does it stop - its one > thing for google to announce governments want your search history, and > another for advertising companies to sell your profile and tracking, > essentially ad companies are doing the governments snooping job for them. > ultimately it's down to risk mitigation. do you care if someone is > snooping on your grocery list? no? using cookie tracking ? yeah > profiling is bad - wouldn't want to end up on a terrorist watchlist > because of my amusement with the zombie apocalypse listmania [9] > encryption is important because you don't know what other folks in the > internet cafe are doing [10] > but where do you draw the line ? > if you go into a shop do you worry that you are on cctv ? > > ok i'll stop ranting now, my main point is always have multi layered > security - and think about what you are protecting and from whom > > [1] http://xkcd.com/538/ > [2] https://addons.mozilla.org/en-US/firefox/addon/wot-safe-browsing-tool/ > [3] http://blog.tremily.us/posts/OTP/ > [4] > http://yro.slashdot.org/story/13/07/02/1241246/nsa-backdoors-in-open-source-and-open-standards-what-are-the-odds > [5] http://cryptome.org/2013/07/intel-bed-nsa.htm > [6] http://www.tomshardware.com/reviews/intel-cpu-history,1986-5.html > [7] > https://wiki.archlinux.org/index.php/Port_Knocking#Port_Knocking_with_iptables_only > [8] > http://www.pcpro.co.uk/news/security/383125/government-admits-slip-ups-in-bt-huawei-deal > [9] > http://www.amazon.co.uk/zombie-apocalypse-essentials/lm/R21TCKA47P0D4E/ref=cm_srch_res_rpli_alt_8 > [10] > http://lifehacker.com/5672313/sniff-out-user-credentials-at-wi+fi-hotspots-with-firesheep > > > On 09/09/2013 02:33 AM, Dale wrote: > > Someone found this and sent it to me. > > > > http://news.yahoo.com/internet-experts-want-security-revamp-nsa-revelations-020838711--sector.html > > > > > > I'm not to concerned about the political aspect of this but do have to > > wonder what this means when we use sites that are supposed to be secure > > and use HTTPS. From reading that, it seems that even URLs with HTTPS > > are not secure. Is it reasonable to expect that even connections > > between say me and my bank are not really secure? > > > > Also, it seems there are people that want to work on fixing this and > > leave out any Government workers. Given my understanding of this, that > > could be a very wise move. From that article, I gather that the tools > > used were compromised before it was even finished. Is there enough > > support, enough geeks and nerds basically, to do this sort of work > > independently? I suspect there are enough Linux geeks out there to > > handle this and then figure out how to make it work on other OSs. I use > > the words geek and nerd in a complimentary way. I consider myself a bit > > of a geek as well. :-D > > > > One of many reasons I use Linux is security. I always felt pretty > > secure but if that article is accurate, then the OS really doesn't > > matter much when just reaching out and grabbing data between two puters > > over the internet. I may be secure at my keyboard but once it hits the > > modem and leaves, it can be grabbed and read if they want to even when > > using HTTPS. Right? > > > > This is not Gentoo specific but as most know, Gentoo is all I use > > anyway. I don't know of any other place to ask that I subscribe too. I > > figure I would get a "no comment" out of the Government types. ROFL > > Plus, there are some folks on here that know a LOT about this sort of > > stuff too. > > > > Again, I don't want a lot of political stuff on this but more of the > > technical side of, is that article accurate, can it be fixed and can we > > be secure regardless of OS. It seems to me that when you break HTTPS, > > you got it beat already. > > > > Am I right on this, wrong or somewhere in the middle? > > > > Dale > > > > :-) :-) > > >
When a top-post is that long did you read it before noticing? Well, if you opened this email, "All ur base r belong to us!" -- Happy Penguin Computers >') 126 Fenco Drive ( \ Tupelo, MS 38801 ^^ supp...@happypenguincomputers.com 662-269-2706 662-205-6424 http://happypenguincomputers.com/ A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing? A: Top-posting. Q: What is the most annoying thing in e-mail? Don't top-post: http://en.wikipedia.org/wiki/Top_post#Top-posting
