dguido

22 ms·

181.
by dguido 10y ago
Really glad they're thinking about osquery support in the future. Of the data sources they support, osquery would be the most functional free and open-source one which might help get Stethoscope more widely deployed.
182.
by dguido 10y ago
Bash is not idempotent, using a public CA has downsides, and MSCHAP has known weaknesses that make the crypto easier to bruteforce.
183.
by dguido 10y ago
For an easier way, try Algo. Algo is a set of Ansible scripts that helps you deploy a fully functional StrongSwan IPSEC server with the most secure settings available: https://github.com/trailofbits/algo It even genera
184.
by dguido 10y ago
Absolutely, and I've outlined cases where I have technical disagreements with them in my original post and elsewhere in this thread. I was merely responding to the accusation that I should blindly listen to them because they wrote a bo
185.
by dguido 10y ago
This was not the case when I looked at the code years ago. I would not trust any statements to the contrary without reviewing it again for changes.
186.
by dguido 10y ago
Neither of these people are technologists with any experience in the ad industry or data science. They're lawyers and artists. Why would I trust that they know what they're talking about in this domain?
187.
by dguido 10y ago
Even without explicit cookies, many ad networks use cookieless fingerprinting (e.g., https://amiunique.org/ ) to uniquely identify you or, at minimum, your IP address. You give up a considerable amount of your own privacy an
188.
by dguido 10y ago
This extension made no sense anyway! Clicking every single ad is bound to get you so many tracking cookies and give up so much metadata about your browsing that you're working against your own privacy by using it (see also "cookie
189.
by dguido 10y ago
The entire point of Algo is to avoid using a hosted VPN because they're awesomely insecure. More here: https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa https://gist.github.com/joepie91/5
190.
by dguido 10y ago
I'll add WireGuard when it gets better client support. I'm not tied to IPSEC. The core values of Algo are making self-hosting and initial setup easy and reliable.
191.
by dguido 10y ago
I generally make an exception for HTTPS Everywhere and Google Password Alert when I wrote things like this, but I agree that maybe it's worth it to cut them and simplify the guide. https://chrome.google.com/webstore&#x2
192.
by dguido 10y ago
> Not a good advice for any public place (airports, cafes, etc). Very easy to listen to BT and intercept passwords as user types them in. It's worth the risk to get people to use a iPhone or iPad more routinely. Also, the risk of th
193.
by dguido 10y ago
> Use your fingerprint to lock/unlock devices. Fingerprints have a different and weaker legal standard than passwords to protect them > Use an Android phone. It may be possible to get a secure Android phone, however, it is unli
194.
by dguido 10y ago
If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo
195.
by dguido 10y ago
Yes, and you also have to trust your home ISPs upstream, and the routers upstream from that, and so on and so forth. Are you trying to say that using a VPN is useless?
196.
by dguido 10y ago
It won't work. Algo is not for censorship avoidance. It's right up top in the readme. Sorry!
197.
by dguido 10y ago
I already did. Here is how to createa a self-hosted VPN server at a cloud provider of your choice. Don't trust your network traffic to anyone but yourself: https://blog.trailofbits.com/2016/12/12/meet-alg
198.
by dguido 10y ago
There's a reply in the thread that directly refutes all these claims about IPSEC: http://www.mail-archive.com/cryptography@metzdowd.com/msg124... another one: http://www.mail-archive.com/cryptogr
199.
by dguido 10y ago
I want this for email! As far as I can tell, there is no great open-source tool for processing my mail archive and giving me similar stats. Everyone wants me to hand over a fully-privileged OAUTH token to some random person's website,
200.
Doorman: an osquery fleet manager(github.com)
9 points by dguido 10y ago|1 comments
201.
by dguido 10y ago
Why are you giving the talk in public if you don't even want to communicate the findings to the people most affected by it?
202.
by dguido 10y ago
The motivation is pretty weak. If people found a way to make money by doing this, it would be massively exploited. But the reward for breaking a bunch of phones is... self satisfaction? ok.
203.
by dguido 10y ago
I have been waiting for years for attacks that operate entirely within the sandbox and steal cookies from memory, for example. What is more valuable that your Google cookies in a modern browser session? Who cares about machine access?
204.
by dguido 10y ago
lol this is totally wrong. One browser exploit coupled with one kernel exploit, as per standard, still takes over the whole machine. Does this make the kernel step any harder? What attacks are they even mitigating?
205.
by dguido 10y ago
If you want to enable Control Flow Integrity (CFI) on your own projects, check out these tutorials for Clang and Visual Studio: https://blog.trailofbits.com/2016/12/27/lets-talk-about-cfi-... https:/&#x
206.
by dguido 10y ago
Except it uses L2TP (not IKEv2), 3DES, SHA1, and probably has more issues.
207.
by dguido 10y ago
There's an FAQ entry in the Algo readme about OpenVPN. The biggest tradeoff is that OpenVPN is a little bit easier to setup at the detriment of inheriting all the insecurities of SSL and the requirement to maintain 3rd party software (
208.
by dguido 10y ago
Algo VPN supports DigitalOcean, EC2, Google Cloud Engine, Azure, and your own local server. We'll add support for LightSail soon too: https://github.com/trailofbits/algo Once the project stabilizes, we want to mak
209.
by dguido 10y ago
Would you trust an entirely custom AMI from someone else, or a script with instructions you can read and follow?
210.
by dguido 10y ago
Fair. At least in my own experience, I have succeeded in making myself sick more frequently from stupid decisions in the kitchen. I think this was part of the appeal of Soylent to me :-P.

More ›