41–50 of 59 posts
While reading advice like those in the article, they seem to always leave out the most central aspect of security - the threat model. Doing some guessing, the following threats are mitigated by the article: • An attacker has access to zero-day vulnerabilities to the software running on your device¹. • You are storing non-Tor files on your device that can be used to build a profile against you. That or you are running…
"1. don't use windows"...I realize how unpopular it is to question the groupthink on this site but this strikes me as simplistic. The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick. If you are using tor and you are using a web browser as your primary means of communication AND YOU REQUIRE SAFTEY you have already made…
>"1. don't use windows"...I realize how unpopular it is to question the groupthink on this site but this strikes me as simplistic. The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick. The OS provides a number of security mechanisms which make exploitation harder, Windows' reputation for security (or lack thereof) is s…
There are configuration issues that affect security that should be taken into account if you have high security needs. Its not a capabilities issue.
Earlier quoted context omitted.
I love that "Microsoft has backdoors"...no one credible has said that they have proof of that. They give the US Government early access to vulnerability data...they give those updates to several governments and large corporations early as the result of agreements they have made with big customers. They also let these same entities audit the source code for windows. Look it up. If you have the money and its important…
Microsoft employee, pls leave.
The accusations of being a shill are also pretty annoying...but hey...
Earlier quoted context omitted.
>"1. don't use windows"...I realize how unpopular it is to question the groupthink on this site but this strikes me as simplistic. The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick. The OS provides a number of security mechanisms which make exploitation harder, Windows' reputation for security (or lack thereof) is s…
Windows has DEP and ASLR. They are actually pretty much on par with each other from a TLA standpoint. There are configuration issues that affect security that should be taken into account if you have high security needs. Its not a capabilities issue.
Earlier quoted context omitted.
"using your internet on Tor" and "doing online activities (on Tor)" sound like the same thing to me. But this whole article sounds to me like the author's expecting people to only ever use Tor when they want to hide something. What we should be doing is encouraging everyone to use Tor all the time for everything, delays be damned. That totally obliterates any correlative analysis.
Ya the anonymity sometimes isn't because I'm doing anything illegal. I've been considering setting up Tor on my firewall/router and starting to funnel connections to google, bing, facebook and things like that through it. Probably eventually funnel all http and https through it.
Earlier quoted context omitted.
Microsoft employee, pls leave.
I'm not a MS employee or even a stockholder. I just get tired of the group think around here. It doesn't do anybody any good to let some of these "everybody knows" style truisms pass unquestioned. The accusations of being a shill are also pretty annoying...but hey...
While reading advice like those in the article, they seem to always leave out the most central aspect of security - the threat model. Doing some guessing, the following threats are mitigated by the article: • An attacker has access to zero-day vulnerabilities to the software running on your device¹. • You are storing non-Tor files on your device that can be used to build a profile against you. That or you are running…
Reminder: the same goes for all your favorite hosted-because-we're-too-lazy-or-inept-to-run-it-ourselves services too.
It still amazes me thousands of high profile companies just give all their communications to Google for free.
Earlier quoted context omitted.
I'm not a MS employee or even a stockholder. I just get tired of the group think around here. It doesn't do anybody any good to let some of these "everybody knows" style truisms pass unquestioned. The accusations of being a shill are also pretty annoying...but hey...
What do you need Windows for anyway? Especially in a "secure computing" context, modern distros are cheaper, easier and quicker to install than Windows, and yes, often more secure. Plus, learning GNU/Linux will make you a better programmer and a more capable team player. What do you have to lose?
Earlier quoted context omitted.
Windows has DEP and ASLR. They are actually pretty much on par with each other from a TLA standpoint. There are configuration issues that affect security that should be taken into account if you have high security needs. Its not a capabilities issue.
Does Windows enforce ASLR on every process now? You only need one non-ASLR library to leverage with ROP. Though, you could say this falls under configuration (and I'm pretty sure the vsyscall table on x86_64 linux is still non-ASLR and that seems like a pretty trivial source of ROP gadgets), but I guess my point is its not as simple as supporting ASLR, not all implementations are created equal.
And you're right, I would call that configuration.