- cypherpunks - lists.cpunks.org

Re: Webmail?
by Zenaan Harkness 06 Jul '18

06 Jul '18

Snake oil to the rescue... ----- Forwarded message from Zenaan Harkness <zenaan(a)freedbms.net> ----- From: Zenaan Harkness <zenaan(a)freedbms.net> To: debian-user(a)lists.debian.org Date: Mon, 2 Jul 2018 11:11:13 +1000 Subject: Re: Webmail? On Sun, Jul 01, 2018 at 10:40:13PM +1200, Richard Hector wrote: > On 01/07/18 21:57, Zenaan Harkness wrote: > >> Oh, use https:// and make sure any security is activated in conf.pl. > > > And with your self-issued snake oil certs, make sure you check and > > confirm the cert on each device you want to use to access your > > webmail server, from your home network, so that if you eventually > > tunnel in or otherwise access it 'on the road', you have already > > verified your own snake oil cert and a MITM should stand out like > > unicorn balls. > > For any server on the internet, I don't see the point in using > self-signed certs any more, now that letsencrypt gives you real ones for > free. Only a -true- Scotsman would self sign and issue his own SSL certs :) I believe it's degrees of snake oil... > It's a bit more of a pain for a server that's only accessed internally, > but still doable, if you can set up a dummy site for verification (there > are ways to do it without a web server, but I haven't needed that yet) It's actually a bit of an open question, but the real question is "what level of security do you actually need or want?" … of course. Consider e.g.: - how to conduct an MITM? - get a copy of private key, issue additional cert - get private key, issue intermediate cert - get intermediate cert key, issue other intermediate certs - is an MITM of concern to you? - I do/don't care if the govt has open access to my certs, and can/can't MITM my users - I do/don't care if Random J Cracker can MITM my telecommuting co-workers Most of us by now will have read at least one article about the CIA and NSA's cornucopia of network cracking tools, bugs, physical network bugs and "rogue" hosts hosted at every host hoster worth his hosting salt - google, amazon, your local ISP, etc - oh, and "by consent, possibly with $ inducement and implied threat of legal sanction for failure to 'co-operate' with said inducement". But again, what level of security do you need? ∙ If you want minimum pain web servers accessible to the public, providing "basic trust level", then LetsEncrypt is likely your best approach. ∙ If you don't have "general public access" as a requirement, and you are willing to double check each device accessing your local network to ensure they've each pre-loaded your internal-only web server cert, then your own PKI and self signed certs may give you higher security (barring catastrophic mistakes on your part), and certainly more control. In this scenario, if you don't need control over the private keys to your electronic kingdom - by all means, use a commercial or free provider, and LetsEncrypt is perhaps about as good as it gets. For those after a higher level of certainty and control however, there is no substitute to offline master key generation and storage, private PKI and total in-house control over all sub-keys/sub-certs, issuances, revocations and per-device key signature double checking. If you want anything even resembling certainty that is... Here's a true fist hand anecdote: A few years ago, I was setting up a VM and some basic web services for a client with a top tier 'reputable' provider - one of the largest in Australia, at least at the time. When connecting via ssh for the first time, the usual "This is a new host, here's the sig, do you confirm this is the correct signature" type message came up. So I check the time and it's well after peak hour (about 11pm), and quickly dial their 24-hour tech support line, asking for someone to please check the host signature (this was virtual hosting, just before VMs took off), so as to preclude any superficial MITM swankery. The tech says to me "Um, I'm not sure about that, I've never been asked that question before," and promptly bumps it up to a deep tech PoC (person of competency), who double checks the host SSH sig hash from their internal network, confirms it's correct, then he too says "you know, as far as I'm aware, in over 15 years, this is the first time, ever, that any client has ever asked us to confirm their end to end encryption/ signature!" I confirmed that he had in fact worked at the company since it began. And most important - if you intend to configure your own PKI for "increased security" purposes, note that you really need to make sure you use certificate pinning for your own org's certs, or disable the other CAs "by default trusted" by your client OS browsers! - The easy way is use a Firefox profile for your company/ internal websites/ VPN/ telecommuters and make sure only your CA is the trusted root in that profile! (and make sure that your internal web sites can only be accessed from that profile) : Are self-signed certificates actually more secure than CA signed certificates now? https://security.stackexchange.com/questions/42409/are-self-signed-certific… See also: 4 fatal problems with PKI https://www.csoonline.com/article/2942072/security/4-fatal-problems-with-pk… SSL certificate revocation and how it is broken in practice https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broke… When are self-signed certificates acceptable for businesses? https://www.techrepublic.com/article/when-are-self-signed-certificates-acce… Good luck :) ----- End forwarded message -----

2 1

NZ Full Take Spying Everyone, CIA Infiltrates Aadhaar, Zcash Censure, Dotcom to Supreme
by grarpamp 05 Jul '18

05 Jul '18

https://www.nzherald.co.nz/index.cfm?objectid=12082945 http://gginews.in/cia-spies-access-aadhaar-database/ https://blog.z.cash/zcash-company-response-to-secret-service-recommendation/ https://www.forbes.com/sites/astanley/2018/06/20/u-s-secret-service-action-… https://issuu.com/statement050718/docs/statement-050718 https://twitter.com/rothken/status/1014648362706952192 https://www.youtube.com/watch?v=rMUKW7ifiBo http://www.kim.com/ https://theintercept.com/bigdatacall/

1 0

Zwiebelfreunde Raided related Riseup, Tor
by grarpamp 04 Jul '18

04 Jul '18

https://blog.torservers.net/20180704/coordinated-raids-of-zwiebelfreunde-at… https://www.ccc.de/en/updates/2018/hausdurchsuchungen-bei-vereinsvorstanden… https://netzpolitik.org/2018/zwiebelfreunde-durchsuchungen-wenn-zeugen-wie-… https://www.spiegel.de/netzwelt/web/hausdurchsuchungen-bei-netzaktivisten-c… https://old.reddit.com/r/de/comments/8w0dya/zwiebelfreundedurchsuchungen_we… https://twitter.com/search?q=zwiebelfreunde

2 1

Southern vs Rose: Open Borders, and Voting Harder at FreedomFest
by grarpamp 04 Jul '18

04 Jul '18

Southern vs Rose: Open Borders https://www.youtube.com/watch?v=eCv1glJx5b4 Voting Harder at FreedomFest https://steemit.com/anarchy/@dollarvigilante/vote-harder-they-say-the-great…

1 0

Interview Jordan Peterson, get wrecked. Damn!
by Zenaan Harkness 04 Jul '18

04 Jul '18

Ouch! Enjoy :D Jordan Peterson repeatedly clashes with WEP leader https://www.youtube.com/watch?v=KhQBkb2zkzo ~2:39

1 0

Satoshi Nakamoto: Thoughts on excerpt from Duality?
by mark M 03 Jul '18

03 Jul '18

http://nakamotofamilyfoundation.org/ http://nakamotofamilyfoundation.org/duality.pdf http://nakamotofamilyfoundation.org/cryptogram.html

4 11

Tim may Cryptonomicon in easily readable epub format
by mark M 03 Jul '18

03 Jul '18

3 2

Because Reasons: Pirate Radio SDR and Anonymity
by grarpamp 02 Jul '18

02 Jul '18

https://www.newyorker.com/magazine/2018/07/09/mapping-brooklyns-diverse-pir… Transmission equipment has only become cheaper and more sophisticated. "the technology has gone beyond what the law has been able to do," Between 87.9 and 92.1 FM, Goren counted eleven illegal stations, whose hosts mainly spoke Creole or accented English. Pirates, he said, "offer a kind of programming that their audiences depend on. Spiritual sustenance, news, immigration information, music created at home or in the new home, here." https://www.theatlantic.com/technology/archive/2018/06/reddit-anonymity-pri… All that's required to create an account and post on any of Reddit's 1.2 million forums is an email address, a username, and a password. You don't need to tell the company your birthday, your gender, or even your real name. As Huffman put it on Thursday at the Aspen Ideas Festival, which is co-hosted by the Aspen Institute and The Atlantic, "Reddit doesn't want the burden of personal information ... and is not selling personal information." Huffman argued that anonymity on Reddit actually makes using the site "more like a conversation one has in real life" than other exchanges on the internet. "When people detach from their real-world identities, they can be more authentic, more true to themselves," he claimed.

1 0

What's a reasonable service for an internet only home connection that's least expensive?...
by don warner saklad 02 Jul '18

02 Jul '18

What's a reasonable service for an internet only home connection that's least expensive?...

1 0

British start-up launches 'new internet'
by Arjun Sachar 02 Jul '18

02 Jul '18

A UK-based blockchain start-up has revealed what it is calling a new version of the Internet. *DADI (Decentralized Architecture for a Democratic Internet) <https://dadi.cloud/en/> *will be faster, cheaper and more secure, but most importantly – the control over the network won't be in the hands of large corporations, but rather in those who use it. The network will be run by its users, who will hook up their devices (gaming consoles, tablets, laptops, etc) to use their spare power to run and co-own the network. Almost all of the revenue (85 per cent) will go back to the users. Explaining this new approach, DADI founder and CEO Joseph Denne said: “A vast amount of computational power currently goes unused in homes and businesses, around the world. Expensive computers, games consoles, set-top boxes, smart televisions and other devices spend large amounts of their life unused or in standby mode. And that’s the power we’ll harness for this new network - drastically reducing reliance on expensive data centres that harm the environment.” “In the same way that homeowners can now install solar panels and sell excess electricity back to the National Grid, the public will be able to connect their devices in the home to the DADI network - earning passive income as a contributor and part-owner of a fairer, faster, safer internet.”

1 0