aborsy

28 ms·

481.
by aborsy 3y ago
If outgoing udp is blocked, Wireguard can not connect.
482.
by aborsy 3y ago
Ease of installation, SSO, peer to peer tunnels (whereas in VPN access server, the server sees inside of the tunnel), no open ports, DNS, private dns server, switching easily between different exit nodes (or no exit node), subnet router, AC
483.
by aborsy 3y ago
VPN traffic is decrypted at VPS. TLS encryption may also be terminated by the reverse proxy. A mesh VPN will give you point to point tunnel. Even http will be secure.
484.
by aborsy 3y ago
Wouldn’t a VPN help protect against a targeted attack? Like an attacker could push bad JavaScript or app update to the user of a particular IP address. On DNS, it’s plaintext by default, and almost always not signed via DNSSEC. Such user co
485.
by aborsy 3y ago
You can set mullvad (which offers VPN service) as your DNS over https server. Traffic is also mostly encrypted by https. Your ISP still gets the destination IP addresses, though they are harder to track. Wouldn’t that address your concern?
486.
by aborsy 3y ago
Self hosting might work up to the level of a prebuilt NAS box, like a Synology. Beyond that, it’s a time sink, with configurations, broken updates, patching, security, networking, troubleshooting etc.
487.
by aborsy 3y ago
Correct, I misread. Still the question remains: what technology could be implemented to mitigate this type of attack (beyond sshd)? For example, Linux sandboxing is poor, and SeLinux is not usually enforced.
488.
by aborsy 3y ago
A back door in the same library is not likely. It drew attention and many looked into it. What could be done to prevent supply chain attacks more broadly?
489.
by aborsy 3y ago
Tailscale funnel does that, except the DNS uses the tailscale domain.
490.
by aborsy 3y ago
The current email protocols can’t be easily encrypted. There are multiple providers and clients that are not compatible, you often have to put people in copy that don’t have public keys, or get replies in plaintext, you may want the conten
491.
by aborsy 3y ago
There is a key for encryption, signing, authentication and certification in OpenPGP. The flags are C, E, S, A. The use cases are separate. Perhaps another flag for automatic vs non automatic would help.
492.
by aborsy 3y ago
You could do so syncing a Restic repository in a shared Synchting folder. An issue is, you will allow external traffic to your network which may cause security and bandwidth issues, and you might be responsible if illegal data is stored, ev
493.
by aborsy 3y ago
You don’t properly phrase things. Yes, phone operating systems are more modern, and implement: sandboxing, hardware security, MAC, app permissions, etc. That’s why they do less. In this category, I would use iPadOS in lockdown mode. But a p
494.
by aborsy 3y ago
S3 is wicked fast, much faster than iCloud or Dropbox. Also the person you are responding to is obviously wrong. S3 is the most durable of all. iCloud and Dropbox were using S3 at some point.
495.
by aborsy 3y ago
I don’t follow. Phones and desktops obviously are very different endpoints.
496.
by aborsy 3y ago
Rolling your own crypto is obviously a bad idea. It turned out the cryptography implemented by developers not expert in cryptography sometimes was merely obfuscation. If you want to roll your crypto, become a cryptographer first. That sound
497.
by aborsy 3y ago
One way would be to install a zero-click Pegasus-like software on their phones. Better yet, ask Apple to activate code on their iPhone. It’s a criticism of the platform, not applications running on it.
498.
by aborsy 3y ago
WhatsApp is a phone app for messaging. PGP is a protocol for email and file encryption in any operating system. It’s unclear why you are comparing them. PGP could have a phone app that will do easy encryption, such as protonmail.
499.
by aborsy 3y ago
1.8B isn’t much, given that it can cost 100M to train one large model. Also the more significant issues are the housing crisis, low wages, and poor high tech economy.
500.
by aborsy 3y ago
Gmail is not private, but is probably the most secure and functional email service.
501.
by aborsy 3y ago
Dropbox speed is low. Even in Dropbox plus, ordinary features are behind paywall. Not interesting. Also, it’s not a good idea to store TBs of personal information on someone else’s computer or potentially the internet.
502.
by aborsy 3y ago
Synology DSM and apps are closed source. It’s a Taiwanese company, and I wonder to what extent it can be trusted? Anyone has information on the security of DSM? Like, is it compliant for use in sensitive departments?
503.
by aborsy 3y ago
In Qubes, the networking can be disabled in the hypervisor. This will turn the VM into an air gapped machine. There is also split GPG, to transfer encrypted data to a VM containing Gpg keys. But the ease of use could also mean that the use
504.
Cloud Backups in Signal(signalupdateinfo.com)
3 points by aborsy 3y ago|2 comments
505.
by aborsy 3y ago
It appears that Signal is currently working on end to end encrypted cloud backups for iOS and Android. It looks like there could be both free and paid plans. The free plan could provide full message text backups but only media backups from
506.
by aborsy 3y ago
With those VPNs, there are no open ports, but the agents run on devices as root and still interact with the internet via browsers. There are and have been RCE vulnerabilities.
507.
by aborsy 3y ago
Dropbox has a lot of bizarre, and for me useless, features: Dropbox Capture, Paper, Vault, Comments, To-do lists, Document scanner, Task manager, folders for turning images to PDF, and now a fax machine. eSignature is useful but I don’t get
508.
by aborsy 3y ago
Why ED448? It’s almost never recommended, in favor of curve 25519.
509.
by aborsy 3y ago
These have to be distributed in the operating system by default. Ubuntu ships some, but they sandbox limited set of applications. I installed some of these anpparmo profiles in Ubuntu, and had to spend a lot of time profiling and fixing per
510.
by aborsy 3y ago
and users, who could pay a monthly fee to GitHub that will distribute among maintainers. The donation system doesn’t work well. There ought to be streams of input funds.

More ›