31–40 of 112 posts
Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.
Earlier quoted context omitted.
Hardware ID/MAC address, for example.
And how would you verify the MAC address of the router at the coffeeshop/train station/bus?
Earlier quoted context omitted.
What "other information" is there to verify?
Hardware ID/MAC address, for example.
Are my devices really broadcasting the SSIDs they have been connecting to?
Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.
Earlier quoted context omitted.
If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.
https://hstspreload.appspot.com/ says they don't use HSTS as a preload. They should...
In my browser (FF nightly), I see the HSTS header, with the value: "max-age=15552000; preload"
If I do a request with curl, no header... (which is probably what this app sees).
I don't have a clue why they are doing that, though. Not that curl would do something with the HSTS header anyway, but still...
Earlier quoted context omitted.
If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.
https://hstspreload.appspot.com/ says they don't use HSTS as a preload. They should...
Earlier quoted context omitted.
Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.
What's the point of that? To speed up reconnection?
I thought for sure that name was fake!
Earlier quoted context omitted.
You can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do th…
If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.
This is not entirely correct. HSTS[0] was designed to protect against such attacks.
It's true, however, that not every browser out there supports it yet, and you must visit the website at least once without MITM for the server to successfully communicate HSTS header. (In Chrome certain domains are included in built-in list[1], though.)
[0] https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_s...
[1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...
Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.
I'm not sure how much I'd be willing to trust people selling anonymous VPN services. Many of them are located in untouchable countries and knowingly provide services which violate various laws (e.g. one I used to subscribe to had a specific tab for copyright notices).
If you dig down into who operates many of them you come up quite empty handed. No address, no name, just a few more shell companies and then a dead-end.
HTTPS certainly makes you more secure while using them, however you leak a lot of information in general as a lot of stuff is still HTTP. You trivially build a full picture of someone (name, literal picture, DoB, et al) over a week of watching their insecure web-traffic.
Plus if you're depending on HTTPS then what is even the point of an anonymous VPN? Might have well just use the dumb WiFi and assume that everything HTTP is world-visible.