3 ms·

I think this type of attack will be useless if you use DNSCrypt + VPN (encrypted OpenVPN/SSH traffic) not to mention TOR. Also, there is a new type of VPN @ htt

by tux 11y ago

I think this type of attack will be useless if you use DNSCrypt + VPN (encrypted OpenVPN/SSH traffic) not to mention TOR. Also, there is a new type of VPN @ https://www.goldenfrog.com/vyprvpn/chameleon https://www.goldenfrog.com/vyprvpn/chameleon

SG- 11y ago
Tunneling is good if they are targeting you locally, but if they see tunnel data going to a server which is easy to see they'll simply target you at the other end.
- tux 11y ago
  Good luck with that when there is thousands of people using the same VPN service, also randomization of IP addresses. However this is only if Evercookie are dealt with. @ http://en.wikipedia.org/wiki/Evercookie http://en.wikipedia.org/wiki/Evercookie Blocking Evercookie blocking is relatively easy now, if you disable JavaScript and use things like NoScript and Random Agent Spoofer. But then also don't forget about the recent VPN's ip leak through WebRTC which can be disabled with setting media.peerconnection.enabled to false If you're paranoid you can also use Qubes or Tails OS.
  - SCHiM 11y ago
    Hmm I'm not sure if a vpn will protect you from this attack. Your traffic will need to cross out of the vpn somewhere/sometime. Unless you're connecting to a hidden service or something. It actually depends more on whether you use https on your first connection or not. Because even if the server is set up to only accept https and it tries to redirect you at the first opportunity you'll be vulnerable. Generally a server configured to use https only will still listen on port 80, and send a 302 to redirect you to it's https version. That redirection can be hijacked by QI.
    - tux 11y ago
      Well if that true then everyone has much bigger problem. Because then any VPN services becomes useless. It would be nice to see if Fox-IT could do similar tests by using VPN/TOR. But I think that VyperVPN still is the most secure VPN if it really does have this; "Chameleon scrambles OpenVPN packet metadata to ensure it’s not recognizable via deep packet inspection (DPI)"
    - SG- 11y ago
      I wouldn't be too surprised if they're already taking steps to place equipment near major VPN providers. It might actually open up people to being exploited by the NSA using these techniques if they're trying to target someone else using the same VPN provider as collateral damage.

by tux 11y ago

SG- 11y ago

Tunneling is good if they are targeting you locally, but if they see tunnel data going to a server which is easy to see they'll simply target you at the other end.

tux 11y ago
Good luck with that when there is thousands of people using the same VPN service, also randomization of IP addresses. However this is only if Evercookie are dealt with. @ http://en.wikipedia.org/wiki/Evercookie http://en.wikipedia.org/wiki/Evercookie Blocking Evercookie blocking is relatively easy now, if you disable JavaScript and use things like NoScript and Random Agent Spoofer. But then also don't forget about the recent VPN's ip leak through WebRTC which can be disabled with setting media.peerconnection.enabled to false If you're paranoid you can also use Qubes or Tails OS.
- SCHiM 11y ago
  Hmm I'm not sure if a vpn will protect you from this attack. Your traffic will need to cross out of the vpn somewhere/sometime. Unless you're connecting to a hidden service or something. It actually depends more on whether you use https on your first connection or not. Because even if the server is set up to only accept https and it tries to redirect you at the first opportunity you'll be vulnerable. Generally a server configured to use https only will still listen on port 80, and send a 302 to redirect you to it's https version. That redirection can be hijacked by QI.
  - tux 11y ago
    Well if that true then everyone has much bigger problem. Because then any VPN services becomes useless. It would be nice to see if Fox-IT could do similar tests by using VPN/TOR. But I think that VyperVPN still is the most secure VPN if it really does have this; "Chameleon scrambles OpenVPN packet metadata to ensure it’s not recognizable via deep packet inspection (DPI)"
  - SG- 11y ago
    I wouldn't be too surprised if they're already taking steps to place equipment near major VPN providers. It might actually open up people to being exploited by the NSA using these techniques if they're trying to target someone else using the same VPN provider as collateral damage.