Basic security questions
- Anmelden oder Registrieren um Kommentare zu schreiben
Hello,
I am try to get a safe system step by step but actually I don't know what I can try next.
Actually I have these things:
- a secure E-Mail provider (runbox.com)
- important files I encrypt it with GnuPG (for this I use GPA)
- an secure browser (icecat)
- a secure system (trisquel)
- a good password for my user.
Actually I know what is not secure:
- I use an smartphone with cyanogenmod <- It is possible to use an handy or smartphone which respect my freedom?
Or is the only solution to kill all my devices?
Now is my questions, what can I do further?
Did I forget maybe a big thing?
Thanks
I want to protect my data, so I think I can forget every mobile device or?
Furthermore I want a complete system that doesn't spy me out.
I am a translator!
well if you want to protect yourself from a script-kiddo you are already fine.
Against a nation state? You are not, even if you were a sec expert..
Keep vital info on a harddrive that is never connected to the internet. that is the help I'll get you..
If freedom is your goal and you're willing to make some compromises (like running a proprietary bios) then you can use a smartphone, but you should buy a phone that is supported by replicant.
Cyanogenmod is besides replicant afaik the best choice at the moment; at least your system is rooted. Remove the google play store and install f-droid instead; remove all proprietary apps and run only free ones.
Of course, using replicant is much better and i would recommend that!
Now, if you're really concerned about privacy - if you're a journalist or political activist, for instance - then don't use any cellphone.
I think the only thing you can use under those circumstances is a thinkpad with a free bios, a replaced wifi card which doesn't require any non-free components and tails as an operating system.
Tails ships with proprietary firmware so you really have to watch out that your device won't use it, i.e. that every component works with free firmware.
Still you will be vulnerable to hardware backdoors and a few pieces of proprietary firmware on the device, such as the hard disk firmware.
Considering all that, i actually would advice against using any pc or any technology whatsoever - if you really can't make any compromise when it comes to privacy.
Thanks for the tipp with Replicant.
Maybe in one or two weeks I will be test it.
But actually I think the big security problem is ME.
I fight against me to not install non-free software.... Today I install chrome for one hour and removed it again... Is now my system broken? This example shows me, that I have to learn so many things that a secure system is actually not possible for me, because I am not clever enough to use it.
But at the end I will try very hard to work with Trisquel only with free software.
May I suggest you read these books to strengthen your resolve. I guess the bio would be the lighter reading to get you started. I found both books excellent.
http://shop.fsf.org/product/book_bundle/
(Buy them if you have the money, download if you don't.)
Thanks for the link.
I will buy it next month, but actually I read the free files, so I can today start to learn the history.
Whenever you're tempted by a proprietary application, look for alternatives. For example, you could've installed Chromium, the Free Software version of Chrome. (Although it recommends proprietary plugins. Beware.)
icecat is preferable
Lol if not using computers is the best way for privacy, what technology then can we use? Sorry for my English, but you know what I mean.
I know what you mean, but i'm afraid the answer is: none!
You can meet with people in real life ;)
When it comes to privacy, our technology is spoiled from the very bottom... it's just the way the internet and pc's are designed nowadays.
But i'm talking about no-compromise-whatsoever- kind of privacy.
You can have decent privacy with computers if your friends care about privacy too, at least decent for the average guy.
If you want to exchange really 100% secure messages for instance, you can use the so called "one time pad" encryption; it is mathematically proven to be 100% secure and cannot be cracked, no matter what computational power the evesdropper has got.
However, you have to transmit the key in real life, and the key has to be as long as the message!
and you have to encrypt the message in real life as well... so... it's no fun to use :P
Can you write more about the hard drive firmware issue? How can it compromise security? Can the firmware on a hard drive, or any other hardware firmware initiate fx keylogging and spying on files? If the https://www.crowdsupply.com/purism/librem-laptop gets fsf approval, then it will have to do without a hard drive, because the hard drive may compromise the computer as such?
I believe this presentation will answer some of your questions and shock you https://www.blackhat.com/html/bh-us-12/bh-us-12-briefings.html#Brossard
Here's some more https://spritesmods.com/?art=hddhack
> Can the firmware on a hard drive, or any other hardware firmware initiate fx keylogging and spying on files?
Yes.
> If the https://www.crowdsupply.com/purism/librem-laptop gets fsf approval, then it will have to do without a hard drive, because the hard drive may compromise the computer as such?
No. There is already one laptop with fsf recommendation and it comes with a hard disk. https://www.fsf.org/resources/hw/endorsement/respects-your-freedom
Of course having free firmware for the hard disk would be ideal. I don't think such a thing exists now.
If I may, I'd like to mention that any sort of spyware is completely useless unless some attacker is able to collect the data somehow. So for example, while every keyboard has some sort of proprietary firmware and could potentially be keylogging, that doesn't do much good for spying on you because the keyboard doesn't have a place to send data to. The only way it could theoretically work is if the keyboard comes with some flash memory it stores keylogging data on, and then an attacker could get the information via physical access to the keyboard; but I don't think any keyboards typically have this capability.
But the firmware gets executed, doesn't it?
I have to say, i don't have any knowledge about where firmware is stored exactly, how it gets executed and what it can basically do.
But sure it has to be loaded onto the device and get executed... why shouldn't it be capable to access the internet connection?
The firmware on keyboards and hard drives isn't loaded into them, it sits on a ROM somewhere. The point is, keyboards are typically only connected to a plug that allows the key input to be read by the system. With this setup, maybe the keyboard is keylogging, but it can only send the data where it's supposed to send it, so spyware functionality on that level isn't physically possible. Something with direct control over the wireless card and would have to do it.
is there anyway of telling if a device has direct control over a wireless card or Ethernet card?
Not always, but usually you can get a pretty good idea unless the computer uses an SoC design. Think of it this way: if you have a keyboard connected to a PS/2 port, and you've verified that the keyboard doesn't have any sort of wireless card built into it, you know that it's only sending its data through that port. (I use PS/2 as an example because USB is more complicated, and it's possible to trick the OS into sending data it shouldn't by pretending to be a device that should be getting that data.)
thanks for the advice i will find a usb keyboard and mouse soon!
Almost all keyboards and pointing devices built-in in laptops use an USB interface, the only difference (I think) is that they don't use the usual connectors, and neither the wires not the connectors are exposed externally. You can check whether your keyboard and pointing device are USB with “lsusb”. There are also X11-specific commands that I don't remember, but you can use a web search to find them. However, USB devices are a possible source of stacks since they can claim that they're something they're not (A USB flash drive can claim it's a keyboard and enter arbitrary commands, for instance. There's a device that does that but I can't find the link, again you would have to search for yourself). You can never be sure that a keyboard and pointing device won't ignore your input and attempt to execute malicious commands unless you designed and supervised the manufacturing of its controller integrated circuit, even if the firmware was free software or if it used no firmware (With all the logic hardwired in CMOS); the same goes for *all* the hardware, with its respective functionality. Hardware by nature is impossible in practice to audit.
.
I am a translator!
I once asked Schneier how much of a threat is the proprietary bios and the firmware in our laptops.
His answer was: Against a State? Considerable!
i wonder how practical is it to make a completely libre computer firmware and everything
is this something that you need lots of money for or is this something you need lots and lots of money for?
[quote=Martago]Actually I know what is not secure:
- I use an smartphone with cyanogenmod <- It is possible to use an handy or smartphone which respect my freedom?[/quote]
Replicant is great unfortunately not all devices are supported
the easiest way to install is with a SD card after installing
https://www.clockworkmod.com/ recovery
http://redmine.replicant.us/projects/replicant/wiki
http://forums.blagblagblag.org/viewtopic.php?f=6&t=5680
if your device is not supported:
remove Google analytics from Cyanogenmod as suggested
http://forum.xda-developers.com/showthr ... ?t=2550769
install F-droid(Libre Repositary)
https://f-droid.org/
install
Orbot/orweb/polipo/orwall/AFWall+
http://pix.toile-libre.org/upload/original/1414239156.png
https://en.wikipedia.org/wiki/F-Droid
https://guardianproject.info/2012/03/15 ... epository/
https://guardianproject.info/apps/orbot/
Reality is, for most people computers are necessary, cell phones as well, however, smart phones are not. For the average person, try to keep technology as "dumb" as possible. Older computers also put off less radiation and magnetic waves, save toxic waste from the dump etc...
On the flip side, keep in mind that Germany's intelligence agency has recently switched to using standard typewriters for all internal communication. I believe Russia has done the same.
http://r.duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fwww.bbc.com%2Fnews%2Fworld-europe-23282308
Best practice is to strike a balance between the two, unless you are willing to go off the grid.
There's also the Neo900 project, which is about making a free hardware smartphone.
As much as the law allows it. A free modem firmware is illegal/costs huge amounts of money.
Plus this phone might cost between 500 and 850€. For a comparatively crappy smartphone.
It's still an interesting project, meant to also be compatible with Replicant.
It's all about taking as much privacy and freedom as legally allowed, as far as I understand it.
I personally would love to control the modem's suspicious activity, and to isolate it from my data thanks to the hardware setup.
From a security standpoint, any machine and OS would be OK, I suppose.
Privacy is another matter.
You can encrypt your communications, knowing that they still can be read (encrypted), and potentially cracked.
I like the idea of an external hard drive never used when connected.
Though I would ensure it would leave no trace.
There's also the good old paper communications, which is used by the german and russian secret services for internal communications.
A paper pad, a pen, and a trapped safe with ink or some weird Looney Tunes trap to destroy the data :)
Artago wrote:
Actually I have these things:
- a secure E-Mail provider (runbox.com)
- important files I encrypt it with GnuPG (for this I use GPA)
- an secure browser (icecat)
- a secure system (trisquel)
- a good password for my user.
You don't mention a VPN which i would recommend as a 1st step in avoiding your ISP or others collecting data.
https://en.wikipedia.org/wiki/Deep_packet_inspection
http://www.ranum.com/security/computer_security/editorials/deepinspect/
https://security.stackexchange.com/questions/20814/does-using-https-tls-s-mime-ssl-e-t-c-protect-you-from-deep-packet-inspection
DNS is also very important to keep in mind:
https://www.dnsleaktest.com/img/what-is-a-dns-leak.png
Email depends on a 3rd party:servers can be compromised.
IMAP should be avoided,POP3 will retrieve all your mails on your computer.
Most people do not encrypt or cannot encrypt.
a simple but not fail safe solution is to share the same email box and send only to the same email box
the mails will never leave those servers.
uTox,TorChat,are safer than a 3rd party mail provider,
https://tox.im/
https://wiki.tox.im/Binaries
command line install
decompressed zip
http://utox.org/
after generate a small url address at:
https://toxme.se/
bitmessage email gateway
https://bitmessage.ch/
Mail box's within the Tor Network
nevertheless encryption is recommended
http://bitmailendavkbec.onion/
http://torbox3uiot6wchz.onion/
Use HTTPS versions of websites
Tor will encrypt your traffic to and within the Tor network, but the encryption of your traffic to the final destination website depends upon on that website
https://www.torproject.org/download/download.html.en#Warning
http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498876762
https://trisquel.info/en/wiki/full-disk-encryption-install
This manual describes the steps to install Trisquel GNU/Linux onto an encrypted LVM. The goal is to enhance user security and protect your data from prying eyes.
https://www.grc.com/haystack.htm
http://www.passwordmeter.com/
- Anmelden oder Registrieren um Kommentare zu schreiben