xrorre

Here's an old XSS exploit for Roundcube from 2013:

https://www.intelligentexploit.com/view-details.html?id=1696...

I still use RC despite the long history of XSS attacks against it. Luckily RC uses progressive enhancement, so it still works with JS turned off. I just assume emails can still execute JS in 2016? Perhaps it's wrong of me to use RC with JS turned off as a preventative measure, but you have to adore that user interface! It's the only reason I choose RC over other self-hosted email web apps (and there are few to choose from in this space). I like the simplicity of Squirrel-mail, but Roundcube looks and feels too good not to use.

I appreciate the intention of this article. Written for people only starting to change their surfing habits in light of Snowden. But the example of the tools they should use are not thought out very well.

First: Freedome by F-Secure is closed source and there is no OpenVPN alternative. Always choose a VPN that has OpenVPN so that users can configure the connection to their needs. No need for this bloated mess.

Second: Whilst disposable Google accounts might seem like a good idea, there are any number of ways for Google to cross-correlate a disposable identity with your actual identity using fingerprinting captchas or even your screen resolution. Google does this to spot serial re-registrations and to stop people gaming Google Plus voting rings and spammers in general.

Third: Be careful of online websites offering fake-name services. Most of this data is generated server-side and logged for the purposes of cross-correlation with your IP address and useragent string. Quite possibly the vast majority of fake-identity sites are run by LEA

- I like to write some quick and dirty ruby gems to generate fake identities because then it can't be correlated. (The names are pulled in from disparate sources and I always ensure true-randomness).

- In terms of email, use things like Riseup which use TLS at every hop so that passive dragnets cant sniff the password. 99% of all IMAP and SMTP services can be passively sniffed because they use weak STARTTLS.

- Use 'honeywords' in an email to correlate different emails with different activities. For example:

    john.doe+shopping@riseup.net
    john.doe+gaming@riseup.net
    john.doe+correspondant@riseup.net

This way you can whitelist those addresses for the purposes of filtering out spam and phishing attempts.

asdf

In terms of a threat model, it includes any machine which acts as a hypervisor and as the old saying goes: If you don't trust the hypervisor, how can you trust any machine running in that hypervisor?

Antilogging is but one tiny component of defense in depth and worth investigating if you're doing anything interesting with a computer. 'Doing something interesting' although is not to be misconstrued as 'doing something bad'. It just means how can any meaningful work get done if low hanging fruit like keystrokes can (and are) being siphoned off?

It helps to see how machines are actually being compromised like this...I've seen it on my machine and sometimes entire office building are being siphoned like this. I typically report this, but I would much rather get to the root as to how it's possible in the first place :(

Typically we don't want the userspace to be compromised at all. An antilogger works by effectively substituting letters as they are typed. So when I type 'A', it is read as A in the kernel, but backspaced, replaced by a random letter, and then the real `A` appears on screen by means of hijacking the input form.

For the pedants:

Some more advanced antiloggers are minus ring-0 and physically remap the keys so that `A` doesn't mean A at all. Infact if I typed this, a load of garbage would be displayed on the screen. The only reason we see valid output is because of a software abstraction layer translating the 'garbage' back to it original symbolic meaning. This is how we thwart such a kernel logger as described in this thread.

You can counter this by creating a hook to scramble keys as they are typed. There are countless antiloggers out there and they're the first thing I install on any fresh distro. Why this antilogging technique is not the default in most so called 'hardened' systems is beyond me. Really low hanging fruit like the ability to log keys should be looked after first and not addressed at some future date when you realize 20+ years of keystrokes were siphoned off your machine.

Qubes is exponetially superior to this distro. Open that PDF in a disposable Fedora sandbox, and physically disable the network plz

JPGs are also a lot safer as PDFs can ping remote resources using carefully hidden beacon images.

Although that said, I sometimes use this to see who opened my files. I once left hundreds of these on a very popular cloud hosting provider (not naming names), and somebody working there was stupid to open the PDF on a machine connected to the internet, thereby proving abuse by employees and proving any random stranger can access 'your' files in the so called 'cloud'.

Look up 'honeydocs'. Some interesting articles about this technique

Zemana Antilogger is pretty sufficient for these threats, and also blacklisted by the NSA, so I suppose it works then? I wrote some custom apps that use 'key-interleaving' so that as I type, the key is backspaced, replaced by another letter, and then substituted several times. It's trivial to write such an app, and takes about two-days. The hardware keyloggers are much more insidious though and that keyboard advertised on the site looks awesome :)

The Apple situation annoys me because it's no longer about the web. It's about breaking crypto on a device which is vendor-locked. The same thing as breaking homegrown crypto, or DVD crypto; easy and trivial. The fact that Apple doesn't use ephemeral keys and can't simply throw away the key in the event of an incident is worrisome enough.

Real crypto needs to be more compartmented than that. A bank is not secure because of the massive door - it's safe because it would take a thief weeks to empty every safety deposit box.

It's also made even safer when the key is (more or less) thrown away for periods of time and nobody can get it. Even with manual over-ride. Literally somebody could be dying inside the safe and nobody could save them.

In properly implemented crypto nobody should hear you scream.

> Well the security they engender is mostly physical security i.e. not getting blown up by terrorists while the security they want to breach is information security.

This is exactly my point. They use the terrorist strawman to frame their agenda; which is to hack all the internets without anyone batting an eyelid.

Information technology is but one facet of reality, and a reflection. It is not the whole thing. It's for this reason it is more suitable to get to the core of why anyone would want to commit an act such as blowing oneself up in the first place.

It's like going all guns blazing on the symptoms of flu. Unless a cure is invented it will haunt us and we only have symptomatic relief.

I can understand the motivations for going after anyone doing something technically interesting with a computer (actually a rare thing unless you are supremely skilled and have chosen a life of learning systems and divulging technical manuals). Also see: homebrew crypto

Better wording of a back door is donwgraded security. For an institution whose sole purpose is to engender security, they do the opposite. It's like saying they have better, more expensive guns than the rest of us.

Which collectively if you think about it, and round up all the PCs in each home, and all the security that goes into them, it's (collectively) the most militarized group of computers there is, and they obviously don't feel outgunned.

The second occurrence is not only inevitable, it refutes the notion of a door in the first place, which is supposed to be fully opened at some stage for long periods, not temporarily opened in-case-of-emergency, or half-shut just-in-case.