51–60 of 141 posts
Tangentially related: Users can use Mullvad’s TOR address: http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7k... to generate their account ID and make their payment with Bitcoin seamlessly. I have never experienced such a smooth way to purchase from a provider, this was brilliant. +1 to Mullvad
10 years ago i was working at in a shared office where companies could hire a room. We all had a common lunch place and shared microwaves. There I met two security nerds. They never shutdown their computers and if it happened, they did a full format and reinstalled the os - because if security. They spoke with passion about security fixes they made in the vpn client that no other had. They got many requests regularly…
I would think you'd do the exact opposite. If you leave a computer running anyone (Well "anyone" being a skilled adversary) can simply pull out the RAM and grab encryption keys in clear text. Law enforcement does this so often, it's practically routine. The only "safe" system is one that has been long powered off and is using tried and true cryptography, ideally open-source FDE that's been fully audited.
Leaving aside the leg work "simply" does here, especially in a coffee shop environment: would AMD's "encrypted memory" help against these kinds of attacks?
I have a laptop with an AMD Zen 3 Pro CPU that has this option in the BIOS and was wondering whether it actually did any good, as opposed to being just some marketing shtick.
10 years ago i was working at in a shared office where companies could hire a room. We all had a common lunch place and shared microwaves. There I met two security nerds. They never shutdown their computers and if it happened, they did a full format and reinstalled the os - because if security. They spoke with passion about security fixes they made in the vpn client that no other had. They got many requests regularly…
I would think you'd do the exact opposite. If you leave a computer running anyone (Well "anyone" being a skilled adversary) can simply pull out the RAM and grab encryption keys in clear text. Law enforcement does this so often, it's practically routine. The only "safe" system is one that has been long powered off and is using tried and true cryptography, ideally open-source FDE that's been fully audited.
How to defend against this?
"The entry WireGuard server will be able to see your source IP and which exit server the traffic is headed for, but it can’t see any of the traffic." So server2 terminates the request twice? One for server1 and another time for the client who generated the request? I don't understand how it's possible for server1 to not be exposed to the data.
Earlier quoted context omitted.
I would think you'd do the exact opposite. If you leave a computer running anyone (Well "anyone" being a skilled adversary) can simply pull out the RAM and grab encryption keys in clear text. Law enforcement does this so often, it's practically routine. The only "safe" system is one that has been long powered off and is using tried and true cryptography, ideally open-source FDE that's been fully audited.
> pull out the RAM and grab encryption keys in clear text How to defend against this?
"The entry WireGuard server will be able to see your source IP and which exit server the traffic is headed for, but it can’t see any of the traffic." So server2 terminates the request twice? One for server1 and another time for the client who generated the request? I don't understand how it's possible for server1 to not be exposed to the data.
> It’s a WireGuard tunnel being sent inside another WireGuard tunnel
Edit: replaced with a better diagram (and again, now based on example in [0]):
▼ ▼ ▼ ▼
YOU->NL1 tunnel SE4->NL1 tunnel PLAIN/TLS
YOU ────────────────────► SE4 ───────────────────► NL1 ───────────────► CATPICS.COM
On the wire: YOU->SE4 traffic SE4->NL1 traffic NL1->CATPICS.COM traffic
┌────────────────┐ ┌────────────────┐ ┌──────┐
Inside: │YOU->NL1 traffic│ │YOU->NL1 traffic│ │ DATA │
└────────────────┘ └────────────────┘ └──────┘
Earlier quoted context omitted.
1) To simply make it harder for my ISP to see which websites I visit. 2) SNI sniffing makes some websites unavailable to me, so DoH isn't enough.
I’d never considered SNI sniffing. Great point. I’m quite fortunate in that the ISP I’m with (AAISP) is fairly privacy first and don’t _appear_ to be snooping on me in any meaningful way. That said, I can’t say the same for my phone provider.
Earlier quoted context omitted.
1) To simply make it harder for my ISP to see which websites I visit. 2) SNI sniffing makes some websites unavailable to me, so DoH isn't enough.
I’d never considered SNI sniffing. Great point. I’m quite fortunate in that the ISP I’m with (AAISP) is fairly privacy first and don’t _appear_ to be snooping on me in any meaningful way. That said, I can’t say the same for my phone provider.
SNI is cleartext enough to be passively logged, so you never know. Maybe some government-mandated (or supplied) switch is logging them to some short-lived log file in case they ever need to pull your hostname history.
Note that SNI sniffing protection is in the works by encrypting the client hello[0]. While it's been in draft for some years now, Chrome has a lot of work being put into it[1], so hopefully it'll be done sometime next year with support within Cloudflare and browsers soon after.
0: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/?includ...
1: https://bugs.chromium.org/p/chromium/issues/detail?id=109140... (comment 20 onwards)
This thread seems to be full of people that use a VPN, I personally don’t as I find DoH + HTTPS to be enough. Why do so many of you use VPNs?
10 years ago i was working at in a shared office where companies could hire a room. We all had a common lunch place and shared microwaves. There I met two security nerds. They never shutdown their computers and if it happened, they did a full format and reinstalled the os - because if security. They spoke with passion about security fixes they made in the vpn client that no other had. They got many requests regularly…
I would think you'd do the exact opposite. If you leave a computer running anyone (Well "anyone" being a skilled adversary) can simply pull out the RAM and grab encryption keys in clear text. Law enforcement does this so often, it's practically routine. The only "safe" system is one that has been long powered off and is using tried and true cryptography, ideally open-source FDE that's been fully audited.
...which could be soldered. Plus, there are methods to store keys in RAM in encrypted form and decrypt them only on the cache and CPU registers.