151–160 of 205 posts
Earlier quoted context omitted.
Germany has very strong privacy laws which is one of the reasons Amazon dropped an AWS region there. Customers are paying a premium for the jurisdiction.
If customers are paying a premium why would Amazon drop the region? Were the privacy laws too complex for them?
Earlier quoted context omitted.
it might be time for space satellite hosting companies... or maybe once SpaceX reduces the cost of used rockets.
>it might be time for space satellite hosting companies. Uhm that would probably backfire and make you an open target for every security service on the planet. German BND did bulk-collection on satellite communications, even tho German law does not allow for something like that. So BND reasoned "Satellites are in space, German Grundgesetz does not apply in space!", dubbing it the "Weltraumtheorie" (Spacetheory) Germa…
Earlier quoted context omitted.
Some kind of crypto-haven like The Isle of Man or Liberland
I guess that it's even easier to sniff upstream traffic (to/from VPN endpoints) to such small internet outposts than, let's say AWS, Akamai or any other large infrastructure provider out there.
Using public commercial VPN providers for serious security/privacy is a very bad idea. Get someone to set up Trail of Bits "Algo" for you (or do it yourself, if you're comfortable with Ansible).
Algo's pretty easy, but if you want to use a cheap service like Vultr, which isn't yet supported by Algo, I wrote a post on the necessary steps recently: http://modulolotus.net/posts/2017-03-28-setting-up-algo
By the way, is it possible to have all hosts connected to reach each other, as in a lan?
Earlier quoted context omitted.
I don't know anyone working in the field who believes Wireguard is likely to be less secure than StrongSwan or OpenVPN, and Wireguard is something that gets talked about a lot . It's early days for Wireguard, to be sure, but it's one of the most promising security projects there is right now.
I work in the field and anybody that says that a piece of software is secure before it has even had a security evaluation by a third party does not know what they are talking about. I think what you have seen is security people saying that the design of Wireguard seems to be equal or better than other, current, options, that doesn't mean that the implementation is just yet.
Earlier quoted context omitted.
>ProtonMail fought the referendum, but hasn't updated this "Why Switzerland?" page: https://protonmail.com/blog/switzerland/" Agreed, and that referendum was back in September of 2016. That's almost 9 months ago. This seems really disingenuous. And the referendum didn't just eek by but it passed by 65%. So if the Swiss domicile doesn't offer the protections it once did, why would I choose this provider over any of th…
Because they still can't read your email, nobody can, even thought it is on their servers and crossing Swiss borders.
Earlier quoted context omitted.
Because they still can't read your email, nobody can, even thought it is on their servers and crossing Swiss borders.
See now, this is the part I don't get. Assuming that you don't encrypt your email with pgp (reasonable, if you're emailing someone who isn't very techy) and aren't emailing someone else who also uses protonmail, there's nothing stopping them from making an unencrypted copy of every email they receive.
I'm at a loss. What a mess.
Earlier quoted context omitted.
Algo's pretty easy, but if you want to use a cheap service like Vultr, which isn't yet supported by Algo, I wrote a post on the necessary steps recently: http://modulolotus.net/posts/2017-03-28-setting-up-algo
I installed algo a couple of weeks ago on a server behind an external firewall. I managed to make it work by opening ports 500 and 4500. Maybe that works for you, too. By the way, is it possible to have all hosts connected to reach each other, as in a lan?
Yes! Change this variable to N, then deploy your server:
https://github.com/trailofbits/algo/blob/master/config.cfg#L...
Earlier quoted context omitted.
I don't know anyone working in the field who believes Wireguard is likely to be less secure than StrongSwan or OpenVPN, and Wireguard is something that gets talked about a lot . It's early days for Wireguard, to be sure, but it's one of the most promising security projects there is right now.
I work in the field and anybody that says that a piece of software is secure before it has even had a security evaluation by a third party does not know what they are talking about. I think what you have seen is security people saying that the design of Wireguard seems to be equal or better than other, current, options, that doesn't mean that the implementation is just yet.
Earlier quoted context omitted.
I've spent my career doing third-party software security evaluations --- among other things, I founded the NCC Cryptography Services practice --- and I will tell you right now that the Wireguard security story is far more compelling than any third-party audit. It's not simply the protocol design, which is superior in pretty much every conceivable way to IKE or TLS, but also the code, which is carefully written to min…
Could you unpack your statement about the careful code writing, or link to an explanation? We would usually expect a formal third-party audit to substantiate such a claim, but if there is other good evidence for their code's secure implementation I'd love to see it.
You can watch any talk about WireGuard to see what I mean about the way WireGuard's code is written, but the short answer is that the thing was designed from the bottom up to be simple. WireGuard's feature selection was influenced strongly by what would keep the codebase smaller and easier to review. It was also designed to simplify the object lifecycle inside the code itself. All its state is preallocated at initialization.
WireGuard's cryptography is essentially an instantiation of Trevor Perrin's Noise framework. It's modern and, again, simple. Every other VPN option is a mess of negotiation and handshaking and complicated state machines. WireGuard is like the Signal/Axolotl of VPNs, except it's much simpler and easier to reason about (cryptographically, in this case) than double ratchet messaging protocols.
It is basically the qmail of VPN software.
And it's ~4000 lines of code. It is plural orders of magnitude smaller than its competitors.
WireGuard isn't a panacea. In particular: clientside support for it isn't there yet! But it's pretty clear to me at least that WireGuard should imminently be replacing OpenVPN and IPSEC.