Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to use my wifi?

thejh.net

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Want to use my wifi?

#41

Post by mseebach »

malandrew wrote: post #9
IgorPartola wrote: post #4

Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use th…

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.

I've had success with OpenVPN. It can set up a default route so everything in channeled over the encrypted connection and it uses client certificates, so it should be solid against MITM. I always turn on OpenVPN when I'm not on a trusted network.

Re: Want to use my wifi?

#42

Post by ma2rten »

malandrew wrote: post #9
IgorPartola wrote: post #4

Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use th…

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example?

Startup idea! Make a tool that automatically tunnels your connection when you are on a public wifi. Make it open source and offer a hosted service. Also interesting if you are in a country which censors the internet. The dropbox of VPNs. For marketing you offer to write articles like this but less technical for magazines ("on Page 10 learn how easy it is for hackers to steal your facebook account and how you can protect yourself").

Re: Want to use my wifi?

#44

Post by TheJH_ »

andrewaylett wrote: post #40
Lazare wrote: post #35

Earlier quoted context omitted.

The attack mentioned is to change the text when you go to copy it; that will get even people who carefully read every forum post before copying and pasting. How many people review the snippet, copy, paste it into a text editor, re -review it, copy it, and then paste it into their shell?

Ctrl-X Ctrl-E in bash will open an editor for the current command, which is executed when the editor is exited. After the potential for exploit was publicised a few months ago, I use this every time and it's really not much more effort than just pasting into the shell. As a bonus, it means I don't have to worry about embedded newlines stopping me from tweaking the command before running it.

You can embed \x1b (escape) into a webpage. When you copy-and-paste that, it has the same effect as hitting ESC in the editor. So, I'd just have to make you copy "#\x1b:wq\n" to also catch the case that you're using vim instead of directly pasting. However, I can't figure out a way to escape from nano.

(Tested it with the combination chromium+xterm+vim.)

Re: Want to use my wifi?

#45

Post by hnha »

noinsight wrote: post #22
malandrew wrote: post #8

Is it possible to use the browser in https only mode, or at least have it force launch any https sites in a new incognito mode window so that you know it's http-only. Furthermore, it would be nice if you could disable all text inputs on http-only windows. I know that I would be more likely to contact a site owner asking for https if it screamed at me everytime it happened. It's time to ditch http for all but rare use…

Get the "HTTPS Everywhere" addon for Firefox, or, apparently, Chrome now.

that "only" uses a list of known https domains to force the browser to use them. It does not magically enable "https everywhere".

Re: Want to use my wifi?

#46

Post by bradleyland »

ma2rten wrote: post #42
malandrew wrote: post #9

Earlier quoted context omitted.

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? Startup idea! Make a tool that automatically tunnels your connection when you are on a public wifi. Make it open source and offer a hosted service. Also interesting if you are in a country which censors the internet. The dropbox of VPNs. For marketing you offer to write articles like this…

There are a multitude of VPN services in the market already. The generally accepted "best practice" for those with VPN service is to use it everywhere (not just on the road). When you're paying monthly, most people feel incentivized to use the service as much as possible.

I've set up VyprVPN for a couple of ultra-paranoid friends, and the whole process was very smooth and end-user friendly.

Re: Want to use my wifi?

#47

Post by acqq »

lotsofcows wrote: post #38
username42 wrote: post #29

Earlier quoted context omitted.

I do not know for VPN, I use ssh. It is very simple and does not require any system administration right. Install a proxy (squid) on your Amazon EC2. Install putty if you are on windows and launch it with port forward using the option -L: putty -L 3128:127.0.0.1:3128 user@host Add the option --proxy-server=127.0.0.1:3128 on you chrome shortcut and that's it.

That'll tunnel your http traffic which is a good start but it's worth checking out ssh -D for an easy SOCKS proxy.

And even more critical, it doesn't reroute DNS queries, the default is "don't redirect DNS" in Firefox and the change must be done through about:config there's no dialog.

Bad the default isn't different when using socks :(

Re: Want to use my wifi?

#48

Post by ma2rten »

bradleyland wrote: post #46
ma2rten wrote: post #42

Earlier quoted context omitted.

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? Startup idea! Make a tool that automatically tunnels your connection when you are on a public wifi. Make it open source and offer a hosted service. Also interesting if you are in a country which censors the internet. The dropbox of VPNs. For marketing you offer to write articles like this…

There are a multitude of VPN services in the market already. The generally accepted "best practice" for those with VPN service is to use it everywhere (not just on the road). When you're paying monthly, most people feel incentivized to use the service as much as possible. I've set up VyprVPN for a couple of ultra-paranoid friends, and the whole process was very smooth and end-user friendly.

And there were plenty back-up services before dropbox.

Re: Want to use my wifi?

#49

Post by IgorPartola »

jzzskijj wrote: post #18
IgorPartola wrote: post #12

Earlier quoted context omitted.

Heh, well what's the fun in that? Plus their remarks make it seem that it can somehow prevent passwords from being seen which is what got me to comment in the first place.

You're not following: "If you have saved your login data on any plain-HTTP site that the attacker knows of, he can use his JS shell in the news site to load the site with the login form in an iframe, then inject another JS shell into the iframe and use that to read the password that the browser fills in." As far as I know incognito mode wont autofill those saved credentials. I think that was the point how incognito m…

You are right, I wasn't. However, the solution to this is to not use passwords with plain-HTTP sites. Incognito mode will prevent a small surface of drive-by attacks, but the bigger problem if plaintext passwords in cleartext on the wire are also terrible.

Re: Want to use my wifi?

#50

Post by IgorPartola »

tcas wrote: post #13
culturestate wrote: post #10

Earlier quoted context omitted.

If you're on a Mac, it's nearly plug-and-play — I use a small menubar app called sidestep[1] that automatically tunnels over SSH, but there are also a few (Viscosity comes to mind) that work in a similar fashion with OpenVPN. There may be similar bits available for Windows, but I haven't looked into it there in some time. 1. https://github.com/chetan51/sidestep

Haven't used sidestep, but sshuttle [1] is a nice command line utility that does the same, just not automatically. Much easier than setting up a VPN server. [1] https://github.com/apenwarr/sshuttle

Beware: http://serverfault.com/questions/337791/if-i-am-using-ssh-fo...

In short, if I can hijack your DNS queries, I can do evil things to you even if I cannot directly MITM your HTTP/HTTPS traffic.

Post reply on HN