Internet security or something

[somethingsomethingprivacy]

Security and Privacy Tools (PT 1)

A Good VPN. I like to use vpnbook as its free and relatively fast. Now any free vpn is going to be less secure than a paid VPN generally but its still better than nothing. At least if someone does go through the trouble of trying to find out your browsing history they will have to go to that server and find the logs (if they still have them) rather than just asking your ISP. It is also useful while used in conjunction with our next tool.

Tor. If you're reading this you probably already about Tor. While it is useful for general browsing, it does have its drawbacks. I would try to limit my use of it with anything that requires a log in, unless you only use it with Tor. Also, while your traffic is generally hidden your ISP can see that you are using Tor, so using it in conjunction with a free VPN may be the best free private browsing experience. While there is still a possiblity of data leaks, it should hide the fact that you are using Tor from your ISP but it may depend on how its configured.

Lastpass. This isn't so much a security tool to keep the NSA and other 3 letter agencies from prying but just a good security measure in general. Too many people use the same password for everything and using an encrypted password manager can help a lot. Lastpass free works just fine if you mostly need it for your PC's but you can pay $1 a month if you need mobile access. If you don't want to pay or are more paranoid or opensource minded, Keepass is a great alternative. While the browser integration isn't as smooth it works great in conjunction with cloud storage. Just keep your encrypted database in your sync folder and you can use your passwords on any of your synced devices.

Bleachbit/CCleaner. Both of these tools I use on a daily basis. Clean out cache files, securely wipe the free space on your hard drive and just keep your computer running smoothly. I use ccleaner on windows and bleachbit in linux but I believe the latter is available on both.

Spideroak. Dropbox is great, as is Google drive but with most cloud storage providers when you give them your data, you're giving them your data. Now many times that is no problem. Chances are your vacation photos aren't that important to anyone but you, but you may have important documents that you can't really let anyone else see. Maybe you're a doctor or lawyer and your job is at stake. Maybe you have company secrets backed up to the cloud but you're afraid of them being leaked. One solution is encrypting the files first. This can work great just for a backup but if you're constantly editing the files this can be an issue. Spideroak is a great solution to this. All of your data is encrypted locally so only you can see your data. They literally have no way of seeing your data normally (according to them, always take that with a grain of salt). In addition to working like dropbox, it can automatically back up many of your more used folders like my documents rather than having to relocate those folders to within the sync folder like you need to do with most cloud storage. Use the like I provided to get an extra gig for free and use the code "freedom4" to upgrade your plan to 6 gigs. Its not a lot of space but it should be enough for your most important documents and other files.

Truecrypt/Encfs. While truecrypt has gotten under some hot water lately due to its strange lack of development its still one of the best encryption tools out there. While they may find security flaws in the future (just like any other software) we don't know of any today and there will likely be a fork in the future. Encfs is another great encryption tool. The interface is pretty similar if you use the Cryptkeeper GUI for it in linux (not sure about the windows version yet) but the main difference is in how it works. While Truecrypt generally encrypts everything in one big volume, either as a file or as an actual drive, encfs just encrypts a folder. When the folder is not mounted it is still visible but the files are all gibberish and inaccessable. This does add the benefit of making it easier to back up any sync rather than having to deal with one big file every time but being able to see the folder tree, even if it is garbled, may be a security issue for you. If you're extra paranoid you can use a combination of the two.

[descentintotyranny-blog]

XKeyscore exposed: How NSA tracks all German Tor users as ‘extremists’

July 3 2014

The NSA has been revealed to mark and consider potential “extremists” all users of the internet anonymizer service Tor. Among those are hundreds of thousands of privacy concerned people like journalists, lawyers and rights activists.

Searching for encryption software like the Linux-based operating system Tails also places you on the NSA grid, as Lena Kampf, Jacob Appelbaum and John Goetz revealed on the German site Tagesschau. The report is based on analysis of the source code of the software used by NSA’s electronic surveillance program XKeyscore.

Tor is a system of servers, which routes user requests through a layer of secured connections to make it impossible to identify a user’s IP from the addresses of the websites he/she visits. The network of some 5,000 is operated by enthusiasts and used by hundreds of thousands of privacy-concerned people worldwide. Some of them live in countries with oppressive regimes, which punish citizens for visiting websites they deem inappropriate.

If you have ever considered supporting #Tor, now is an excellent time to start. Privacy matters, even yours

— Sebastian Hahn (@sebastianhahn) July 3, 2014

But merely visiting Tor project’s website puts you on the NSA’s red list, the report says. But more importantly it monitors connections to so-called Directory Authorities, the eight servers, which act as gateways for the entire system.

The NSA was particularly surveilling German-based Tor Directory Authorities. One is operated by the Germany-based hacker group Chaos Computer Club, the other by computer science student Sebastian Hahn, who told journalists that the revelation is “shocking.”

We have published several new #NSA stories today: http://t.co/oBxR0lDWjY http://t.co/WVeaqMeoCe More information coming soon. #germany#usa

— Jacob Appelbaum (@ioerror) July 3, 2014

The system itself doesn’t appear to be compromised however, but the NSA gets data like IP addresses of those using it, enough to cross-reference them with other databases the agency has access to.

READ MORE: Tor anonymizer network among NSA’s targets, Snowden leaks reveal

There are indications that NSA may be collecting not only the metadata of the people on the list, but also read their email exchanges with Tor.

An interest in Tor is not the only way to make it to NSA’s watch list. Even web searches for other encryption software makes you a target as well, the report said.

How the #NSA's XKeyScore tags Tor users as “extremist” http://t.co/GNBLPJCojG more: https://t.co/PKQAZljALj

— Free Snowden (@couragesnowden) July 3, 2014

Disturbingly, NSA programmer comments in the source code label those picked up by the American system “extremists.”

The report says XKeyscore marks all people that hit the red light on its grid, with the exception of those connecting from members of the Five Eyes, a group of countries cooperating in intelligence gathering, namely the US, UK, Canada, Australia and New Zealand.

It was not immediately clear how the authors of the publication obtained the source code of XKeyscore software, but the existence of the system was revealed in 2013 through documents leaked by whistleblower Edward Snowden.

Ironically, Tor was originally created for the US Navy and still receives a major part of its funding from the US government - the same government that considers its users “extremists”.

Anonymous experts told Boing Boing that the new leak may come from a second source, not Edward Snowden as nothing of the kind had ever been seen this in the original Snowden documents or intended publications.

[wearehidden]

Dear NSA, Privacy is a Fundamental Right, Not Reasonable Suspicion

[somethingsomethingprivacy]

Learning about Linux is not a crime—but don’t tell the NSA that. A story published in German on Tagesschau, and followed up by an article in English on DasErste.de today, has revealed that the NSA is scrutinizing people who visit websites such as the Tor Project’s home page and even Linux Journal.

[stopprism]

7 Things You Should Know About Tor

1. Tor Still Works

One of the many things that we learned from the NSA leaks is that Tor still works. According to the NSA "Tor Stinks" slides revealed by the Guardian last year, the NSA is still not able to completely circumvent the anonymity provided by Tor. They have been able to compromise certain Tor users in specific situations. Historically this has been done by finding an exploit for the Tor Browser Bundle or by exploiting a user that has misconfigured Tor. The FBI—possibly in conjunction with the NSA—was able to find one serious exploit for Firefox that lead to the takedown of Freedom Hosting and exploit of its users. Firefox was patched quickly, and no major exploits for Firefox affecting Tor users appear to have been found since. As the Tor developers noted in 2004, if someone is actively monitoring both your network traffic and the network traffic of the Internet service you’re communicating with, Tor can’t prevent them from deducing that you’re talking to that service. Its design does assume that at least one side of the connection isn’t being monitored by whomever you’re trying to stay private from.

We can conclude from this that Tor has probably not been broken at a cryptographic level. The best attacks on Tor are side-channel attacks on browser bugs or user misconfiguration and traffic correlation attacks.

2. Tor is Not Only Used by Criminals

One of the most common misconceptions we hear is that Tor is only used by criminals and pedophiles. This is simply not true! There are many types of people that use Tor. Activists use it to circumvent censorship and provide anonymity. The military uses it for secure communications and planning. Families use Tor to protect their children and preserve their privacy. Journalists use it to do research on stories and communicate securely with sources. The Tor Project website has an excellent explanation of why Tor doesn’t help criminals very much. To paraphrase: Criminals can already do bad things since they will break laws they have much better tools at their disposal than what Tor offers, such as botnets made with malware, stolen devices, identity theft, etc. In fact using Tor may help you protect yourself against some of these tactics that criminals use such as identity theft or online stalking.

You are not helping criminals by using Tor any more than you are helping criminals by using the Internet.

3. Tor Does Not Have a Military Backdoor

Another common opinion that we hear is that Tor was created by the military and so it must have a military backdoor. There is no backdoor in the Tor software. It is true that initial development of Tor was funded by the US Navy. However, it has been audited by several very smart cryptographers and security professionals who have confirmed that there is no backdoor. Tor is open source, so any programmer can take a look at the code and verify that there is nothing fishy going on. It is worked on by a team of activists who are extremely dedicated to privacy and anonymity.

4. No One in the US Has Been Prosecuted For Running a Tor Relay

As far as EFF is aware, no one in the US has been sued or prosecuted for running a Tor relay. Furthermore we do not believe that running a Tor relay is illegal under US law. This is, of course, no guarantee that you won’t be contacted by law enforcement, especially if you are running an exit relay. However EFF believes this fact so strongly that we are running our own Tor relay. You can find out more about the legalities of running a Tor relay at the Tor Challenge Legal FAQ. However, if you are going to use Tor for criminal activity (which the Tor project asks that you not do) you can create more problems for yourself if you get prosecuted. Criminal activity also brings more scrutiny on to Tor making it worse for the public as a whole.

5. Tor is Easy to Use

You might think that because it is privacy software Tor must be hard to use. This is simply not true. The easiest way to get started with Tor is to download the Tor Browser Bundle. This is a browser that comes pre-configured to use Tor in a secure manner. It is easy to use and is all you need to start browsing with Tor. Another easy way to use Tor is with Tails. Tails is a live operating system that runs on a DVD or thumb drive. Tails routes your entire Internet connection through Tor. And when you shut it down, Tails “forgets” everything that was done while it was running.

6. Tor is Not as Slow as You Think

It is true that Tor is slower than a regular Internet connection. However, the Tor developers have been doing a lot of hard work to make the Tor network faster. And it is faster today than ever before. One of the best things that can be done to speed up the Tor network is to create more relays. If you would like to contribute to making the Tor network faster, you can check out our Tor Challenge

7. Tor is Not Foolproof

Tor is not perfect; you can destroy your own anonymity with Tor if you use it incorrectly. That’s why it is important to always use Tor Browser Bundle or Tails and make sure that you keep your software up to date. It is also important to remember that if you log into services like Google and Facebook over Tor, those services will still be able to see your communications within their systems. Additionally Tor users should be mindful of the fact that an adversary who can see both sides of there connection may be able to perform a statistical analysis to confirm that the traffic belongs to you.

Tor is some of the strongest anonymity software that exists. We think that it is important to dispel misconceptions about it so that the public can be more informed and confident in its usefulness. There are many great reasons to use Tor and very few reasons not to. So get started with Tor, and take back your privacy online.