ENCRYPTED E-MAILS @ DARK MAIL ALLIANCE

1.   How often we keep reading so much about privacy and IT security issues across the web and daily surf's!!!....but we only have more to believe that privacy with times to come will be a matter of past...be it your mobile with loads of applications inbuilt already or your exchange on yahoo or gmail etc..every one is trying to vie for your data in some form or the other...your sms..your mms...your contacts..your stored data on the SD card,your browsing history or your location at various times of the day etc etc.....every one wants all this to make your profile and then in the long run use all this to market or even blackmail you(who knows!!!!!)...future will buzz a lot with our past....

2.  In such times it is good to read about "Dark Mail Alliance". Extract from their website is produced below for general direction of purpose :

" To bring the world our unique end-to-end encrypted protocol and architecture that is the 'next-generation' of private and secure email. As founding partners of The , both Silent Circle and Lavabit will work to bring other members into the alliance, assist them in implementing the new protocol and jointly work to proliferate the worlds first end-to-end encrypted 'Email 3.0' throughout the world's email providers. Our goal is to open source the protocol and architecture and help others implement this new technology to address privacy concerns against surveillance and back door threats of any kind."

3.   Silent Circle’s team as mentioned in the extract is a unique and eclectic mix of world-renowned cryptographers, Silicon Valley software engineers, German VoIP engineers, Latvian system analysts and former US Navy SEALs & British Special Air Service (SAS) security experts....while Lavabit was an encrypted email service, founded in 2004, that suspended operations on August 8, 2013 after it was ordered to turn over its Secure Sockets Layer (SSL) private key to the US government.So the combo of these two majors can be a force to reckon with provided the policies and strategies do not bar them again in some manner...till then lets give a "good night" to privacy!!!

4.   More at http://darkmail.info/

Reduce Tracking/Increase Privacy : Start Mozilla in PRIVATE MODE by default

1.   Earlier in one of my posts I had shown on how to start chrome in "INCOGNITO" mode to avoid any cache storing and also at the same time remove cookies at the end of the session....the following steps make way to start the mozilla browser by default in a private mode.

2.   As shown in the screen shot below...go to the Edit drop down menu and select preferences and then go to the privacy tab and select NEVER REMEMBER HISTORY

(Click on the image to enlarge)

(Click on the image to enlarge)

(Click on the image to enlarge)

 3.     The video cast below :

Striking the balance : Privacy & Security

1.   Over the decade, Security and Privacy issues have been striking the key notes often at high decibels and the trend is only increasing in the webosphere.I was just thinking if there will be a day when there will be 100% Privacy as well as 100% IT Security...if privacy becomes 100% ensured then how will anyone's data be monitored or will it be all algorithm based that will have a standing as well as active encryption method.

2.  At a health care event in San Jose, California some time in June 2013, President Obama had said "It's important to recognize that you can't have 100 per cent security and also then have 100 per cent privacy and zero inconvenience."(Source here)

3.  Is it actually possible in lives of the present generation ? I have my doubts!!!!!Our generation is likely to be a turning era of a new kind of civilization ie the digital age.We are part of just the beginning of the IT revolution but it will take another good time to realize a stable IT architecture.

4.  Its a mad race if we see it from top...mad race about leading from the front without realizing that to do so first the need is to plan and move.Short term gains and achievements in such a scenario of unstable internet(i mean unable to handle security and privacy) is not worth a pie.From aka India we have CMS ie the Central Monitoring System that claims to monitor each and every byte(I wonder how would it be done without any known info of set data centers in India......)....then we have PRISM...and actually each country would claim to have a sole application project on similar lines!!!

5.   Confidentiality,Integrity and Availability,the three key corner stones of a security framework....how will these fit in maintaining the privacy issues.The road map is long and lots needs to be done...

Spying your friend at WhatsApp : Cause of concern

1.   In my last post here,I discussed about the growing lure of using WhatsApp and the basic security concerns that comes with it from point of a naive user.Now will take you one step higher to the level of a script kiddie....

2.  How does WhatApp identify you in billions?The answer is the unique MAC address that each digital device on this earth holds. If any one changes his/her device,then automatically the MAC address also changes and the user is requested to re-verify their WhatsApp account. Means he/she cannot access same WhatsApp account from two devices. But is MACSPOOFING not existing ?So,if the Mac is spoofed,then who stops from seeing your friends traffic that includes his/her chats,downloads etc!!!although for a naive user this may be look of some technical nature but for the young gen which has lots of techno enthusiasts there should be no stopping....that would include rooting your phone and installing Busybox. How to get your friends MAC address,here it goes :

For Android phone users simply go to settings—> About phone—> Status—> Wi-Fi MAC address.

For iPhone users go to Settings—> General—> About—> Wi-Fi address.

For Windows Phone users go to Settings—> About—> More info—> MAC address.

and for BlackBerry users go to options—> Device—> Device and Status info—> WLAN MAC.

3.   And the best part is that your Andorid can be anyone starting from 1.6 on wards till date.

Need of Encryption : Your files - Your Data

1.   In today's times when every spying eye,every hacker on the web is eyeing your info.... apart from hardening your OS and configuring your system securely what else can you do to secure your info after some one gate crashes into your system?.....I mean after someone gets your root privileges via remote access...what are the options to save your self from sharing your critical data with him?The answer is ENCRYPTION...

2.   Encryption is the process of encoding your information) in such a way that hackers cannot read it, but that authorized parties can.So without getting into the nitty gritties of what is Encryption and how it works..i am focusing here of what all opensource and free applications are available for encryption...

3.   First I would mention about TrueCrypt,this is the one I have been using for years...the reliability of this application can be gauged from the fact that in 2008, the FBI attempted to break encryption on hard drives using a program called TrueCrypt, but the equipment was finally returned after a year of failed tries.(Source : http://www.webcitation.org/query?url=g1.globo.com/English/noticia/2010/06/not-even-fbi-can-de-crypt-files-daniel-dantas.html)

4.   The other strong opensource software's available for encryption are :

    - E4M ie ENCRYPTION for MASSES)
    - Free OTFE
    - Scramdisk

5.   TrueCrypt remains the best bet for all present users.The popularity can be gauged from another fact that this is being used by cyber criminals to!!

FACEBOOK : The New Playground @ Dangerous

1.    It does not date back long in the past time corridors when I as a kid used to go to play grounds in the evening to play with my friends...meet them....fight with them...abuse them...get abused and then get back home for studies and prepare for next days school work and the cycle repeated every day...week and months.But what happens today with a typical metro kid....a school child in the bracket age of 10+ goes to Facebook to play with friends...he meets them.....abuses them at times...gets abused on the wall or vide posts.So more or less....things stand at the same place ,only the grounds have changed.First it was the actual play grounds and now it is all getting virtual.....blame it on lack of infrastructure with concrete eating much of space in metro's or lack of parental monitoring owing to their ultra busy lives.....for the new era generation...social networking sites like Facebook is the new PLAYGROUND.....the virtual one for a change!!!!

2.    So the rules remain the same....ie we have our social circle like we used to have in past...we meet vide post and comments...we like each other for something and dislike each other for some thing...here we cannot shake hands and hug each other but yess we can take grudges out of each other via so many means like hacking....cyber bullying...post hatred... cyber stalk...mobbing...sexting,internet trolling etc...the list is actually endless and the related terminology is on a phenomenal increase.So a typical new gen kid for whom Facebook kind social networking sites are the new playground to play....the proneness to the bad elements in the society remains actually higher then in past....for here it is just a matter of few compromised screenshots...hacked passwords and the kid is on way to become a victim...

3.   The recent case of Amanda Todd is indeed beginning of such sad but many in line expected incidents waiting to happen....today we may allow our kids to have a Facebook account or some social networking website account but without effectively monitoring the kid remains as prone as Amanda Todd.For this to happen the parent have to have basic IT IQ quotient to monitor to avoid any such incident.Like past when a child could be left at home assuming safe..it does not remain the same today....he has access to smartphones....he has access to tablets...internet via so many means.Even basic forensic knowledge possessed by the parents is bound to fail if the same is happening in Cloud rather then on the machine at home...

4.   Its time for the parents to equip themselves with the tools and knowledge required to monitor and watch the kids...also realizing that today's kids are more smarter in terms of grabbing the technology then ever....if you have reached reading till here...u must read the complete story here

BIGGEST SPYING CENTRE:NSA@USA

1.  At a time when we all realize the cyber traffic movement monitoring around us via hackers,spies and the government....this will come as a news...a big news....

2.  National Security Agency,where else but United States of America ,is engaged building and ramping up the largest Spy center in the history of the world.Special points that I read about this upcoming centre are enumerated below for ur info :

-  To be completed by September 2013.

-  This will make NSA the largest, most covert, and potentially most intrusive intelligence agency ever.

- Will be able to intercept your private emails, cell phone calls, internet connections and Google/Bing searches, as well as all sorts of personal data trails—parking receipts, travel itineraries, bookstore purchases, and other digital litter 

-  To be located at Bluffdale.

-  Also known named Utah Data Center.

- Main purpose to tap, decipher, decrypt, analyze, and store Brobdingnagian Yotta bytes of the world’s communications as they take place across international,foreign and domestic networks.

-  Approx investment@$2 billion.

-  Realization of the “total information awareness” program initiated by Bush administration.

-  Also critical for breaking and decrypting codes to decipher encrypted financial information, stock transactions, business deals, foreign military and diplomatic secrets, legal document etc.

-  This will consist of 100,000-square-foot halls filled with servers, complete with raised floor space for cables and storage excluding more than 900,000 square feet for technical support and administration.

THE TOR PROJECT

1.  Privacy is really becoming a big and serious issue and no one knows what all is all set to come ahead.For now I came across and even started using TOR.For the bigger details you need to visit the site at https://www.torproject.org/.I got aware of this at the ANKIT FADIA WORKSHOP@INDORE

2.  For the in brief , point wise detail that just scroll down to get a brief overview :

KEY FEATURES

- Tor is free software made under www.torproject.org/

- Helps defend against network surveillance that threaten personal freedom and privacy.

- Protects by bouncing your communications around a distributed network of relays run by volunteers all around the world.

- Prevents somebody watching your Internet connection from learning what sites you visit

- Prevents sites you visit from learning your physical location.

- Works with web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol.

- Individuals can use Tor to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers.

- A branch of the U.S. Navy uses Tor for open source intelligence gathering, and one of its teams used Tor while deployed in the Middle East recently.

HOW/WHAT IT DOES?

- Actually a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet.

- Based on "Onion routing" that simply refers to original data being encrypted and re-encrypted multiple times.

- It is then sent through successive Tor relays, each one of which decrypts a "layer" of encryption before passing the data on to the next relay and, ultimately, its destination.

- This reduces the possibility of the original data being unscrambled or understood in transit

- Enables to create new communication tools with built-in privacy features.

- Provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy.

3.  Thanks https://www.torproject.org and Ankit Fadia

HIDEMYASS saves its own!!!

1.  The month of September 2011 went so full of embarassment for HMA(Hidemyass) that it would probably like October  to  follow  August  ( September  may just  vanish in the smoke....) All  its  claims  of  telling  being anonymous  and safe, maintaining privacy,being completely hidden etc etc hit a serious setback....the story goes like this...

 2.   The case pertains to Lulz Security aka LulzSec,a computer hacker group that claims responsibility for several high profile attacks including SONY,CIA etc.So in the month of September this year an alleged Lulzsec member who had carried out attacks on various organizations including Sony and the UK’s Serious Organised Crime Agency, had used this ‘anonymous’ VPN service supplied by HideMyAss.But his plan failed in the biggest way imaginable. HideMyAss (HMA) keeps all yourlogs and as a UK company when given a court order to cough up information, they did so. After matching timestamps to IP addresses, in the blink of an eye Luzlsec member ‘Recursion’ became 23-year-old Cody Kretsinger from Phoenix. The FBI got their man.....so whats the use.....!!!!

3.   But I feel that anything to do with some serious crime should always be contained....like this way...but what about you and me....our surfing habits will always be known....our info will always be under cloud....:-(

4.   This is what HMA had to say :

“Our VPN service and VPN services in general are not designed to be used to commit illegal activity,” said Hide My Ass. “It is very naive to think that by paying a subscription fee to a VPN service you are free to break the law without any consequences.”

5.  Thanks vpn-reviews.net and  Torrentfreak

PROXY SERVER : ARE THEY LEGAL TO BE USED IN INDIA?

1.   Few days back I was surfing  few sites via proxy server at HIDEMYASS. Just like a that,a thought came to mind that if the Indian Government on one hand is trying all ways out to monitor nefarious activities on net...and in the name of this monitoring they are monitoring u and me as well....what would they be able to do for those actual ones who use proxy servers?.....

2.   Though it is understood that not all proxy server sites are as safe as they claim...most of them have actually a life of not more then 4-5 days...they actually are born to steal and vanish...we call that 9 2 11....But sites like those have been existing for more than 4-5 years like hidemyass,proxy.org etc are actually doing the work they are supposed to do ie PRIVACY!!!

3.   If any of the readers have some idea or can guide to some link w.r.t legality issues of using proxy servers in India...i would be grateful....and lastly if anyone has some disagreements on the comment earlier that INDIAN GOVERMENT IS MONITORING YOU...just check the ANONYMITY CHECKER at https://xerobank.com/.

"LIKE" Button in Facebook : Tracks u!!!

1.   Internet users tap Facebook Inc.'s "Like" and Twitter Inc.'s "Tweet" buttons to share content with friends. But these tools also let their makers collect data about the websites people are visiting.

2.   These so-called social widgets, which appear atop stories on news sites or alongside products on retail sites, notify Facebook and Twitter that a person visited those sites even when users don't click on the buttons, according to a study done for The Wall Street Journal.Few things about these widgets :

- Prolific widgets

- Already added to millions of web pages in the past year. 

- The widgets, which were created to make it easy to share content with friends and to help websites attract visitors, are a potentially powerful way to track Internet users. 

- They could link users browsing habits to their social-networking profile.

- For example, Facebook or Twitter know when one of their members reads an article about filing for bankruptcy on MSNBC.com or goes to a blog about depression called Fighting the Darkness, even if the user doesn't click the "Like" or "Tweet" buttons on those sites.

- A person only needs to log into Facebook or Twitter once in the past month. The sites will continue to collect browsing data, even if the person closes their browser or turns off their computers, until that person explicitly logs out of their Facebook or Twitter accounts.

- Facebook places a cookie on the computer of anyone who visits the Facebook.com home page, even if the user isn't a member. 

3.   Thanks http://online.wsj.com

Cookienator : Option to control cookie menace

1.   Cookienator is a tool that will helps us remain anonymous from search engines such as Google and other web-usage trackers such as Doubleclick or Omniture.This a simple program that will leave most of cookies alone but will remove the ones that put your privacy at risk. The best part about this is the size and ease of installation.....It is lightweight; it's a single executable, when run, it will tell you how many cookies it would like to remove. It is available for free to download and is available in two forms : msi windows executable and a zip file

2.   More at http://codefromthe70s.org/cookienator.aspx

CONTROL COOKIES TAKING CONTROL FROM UR BROWSERS

1.  In my earlier post here about cookies and types,I had mentioned about types and some relevant details.Now this one mentions about the steers and control available in prominent browsers to disable cookies digging into ur privacy !!!

Google Chrome

Go to 'Tools Menu'

Click on 'Options'

Click on 'Under the Hood'

'Cookie Setting' should be selected. Once done select 'Block all Cookies'

Now all cookies should be blocked on your Google Chrome

To clear existing cookies:

Go to 'Tools Menu'

Click on 'Options'

Click on 'Under the Hood'

Under 'Privacy' section select "Show Cookies'

A new window should open called 'Cookies' In here you can see all the cookies within your Google Chrome Browser.

Click on "Remove All" to remove all traces of cookies

If you wish to only remove a certain cookie, simply highlight and click "Remove"

Firefox

Go to 'Tools' in the menu bar

Click on 'Options'

Click on 'Privacy Tab'

Disable the box that says 'Accept Cookies From sites'

To clear existing cookies:

Go to 'Tools' in the menu bar

Click on 'Options'

Click on 'Privacy Tab'

Click on "Clear Now"

Select "Cookies"

Click on "Clear Private Data Now"

Internet Explorer (IE) 9.0+

Go to 'Tools' in the menu bar which should drop down then click on 'Internet Options'

Click on 'Privacy' Tab on top

Move the slider up to the 'Block all Cookies' button

Important Notice: Blocking all cookies may prevent you from entering alot of sites.

The next two Internet Explorer privacy levels, High and Medium High, may be more suitable.

To delete existing cookies:

Go to 'Tools' in the menu bar which should drop down then click on 'Internet Options'

Click on 'General' tab which should be under 'Browsing History' and click 'Delete'

2.  Thanks http://www.allaboutcookies.org

COOKIES & TYPES ?

1. How often we blame it on cookies for tracking,invading our privacy.......but whats these cookies all about?How many types exist?Are all of them dangerous?What can I do to avoid them? All answers ahead in my posts ahead....

2. A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site.The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents,or anything else that can be accomplished through storing text data.Cookies are not software.They cannot be programmed, cannot carry viruses, and cannot install malware on the host computer .

SESSION COOKIE

A session cookie only lasts for the duration of users using the website. A web browser normally deletes session cookies when it quits. A session cookie is created when no Expires directive is provided when the cookie is created.

PERSISTENT COOKIE

A persistent cookie will outlast user sessions. If a persistent cookie has its Max-Age set to 1 year, then, within the year, the initial value set in that cookie would be sent back to the server every time the user visited the server. This could be used to record a vital piece of information such as how the user initially came to this website. For this reason, persistent cookies are also called tracking cookies or in-memory cookies.

SECURE COOKIE

A secure cookie is only used when a browser is visiting a server via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via

eavesdropping.

HTTP ONLY COOKIE

The Http Only session cookie is supported by most modern browsers.On a supported browser, an Http Only session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript). 

FIRST PARTY COOKIES 

A first-party cookie either originates on or is sent to the Web site you are currently viewing. These cookies are commonly used to store information, such as your preferences when visiting that site.

THIRD PARTY COOKIES

Third-party cookies are cookies being set with different domains than the one shown on the address bar.For example: Suppose a user visits www.example1.com, which sets a cookie with the domain ad.foxytracking.com. When the user later visits www.example2.com, another cookie is set with the domain ad.foxytracking.com. Eventually, both of these cookies will be sent to the advertiser when loading their ads or visiting their website. The advertiser can then use these cookies to build up a browsing history of the user across all the websites this advertiser has footprints on.

ZOMBIE COOKIE

A zombie cookie is any cookie that is automatically recreated after a user has deleted it. 

TEMPORARY / SESSION COOKIES

A temporary or session cookie is stored only for your current browsing session, and is deleted from your computer when you close your browser.

UNSATISFACTORY COOKIES

Unsatisfactory cookies are cookies that might allow access to personally identifiable information that could be used for a secondary purpose without your consent.

3.   Thanks www.allaboutcookies.org and http://www.f-secure.com

Our Browsing History Is Leaking into the Cloud!!!!

1. You do it on INCOGNITO mode or the PRIVACY mode or keep removing cookies to ensure that you are not being tracked or u think like your browsing history does not exist....this is going to shock you.....watch this video "DEFCON 19: Tracking the Trackers: How Our Browsing History Is Leaking into the Cloud"....click down to see....

2.  The summary goes like this....

 - 350 services get at least 1 % of your browsing activity

 - 33 services get at least 5% of your browsing activity

 - 16 services get at least 10% of your browsing activity

3.  Any solutions for avoiding......yes...the video itself gives you the solution ....and as on date millions have already adopted it...now that includes me tooo.....download the plugin for your respective browser from http://www.disconnect.me/

MAKE incognito YOUR DEFAULT SETTING

1.    We all know how to browse hidden ie Pages you view in this window won't appear in your browser history or search history, and they won't leave other traces, like cookies, on your computer after you close the incognito window. Commonly it is known as "incognito" or "privacy browsing".......an avid user of chrome ....I always had to open the browser and then select "New Incognito Window" to work...but not till today....a simple amendment in the target setting of properties of chrome shortcut will always make you open the incognito window......simply append "--incognito" at the end of the link address as shown below : 

C:\Users\???????\AppData\Local\Google\Chrome\Application\chrome.exe --incognito

2.    More clearly ...right click on the chrome shortcut on the task bar or on the desk top and click properties.In the target text box append "--incognito" to what is already there defining the location of the chrome browser....

3.     Thats it......

"GOOGLE STREET VIEW" - FIGHTING PRIVACY ISSUES

1. Ever heard of google's street view application...m sure many of you must have...for those who have not heard of it...in brief it refers to a technology featured in Google Maps and Google Earth that provisions isometric views from various positions along many streets in the world. Launched on May 25, 2007 the application displays images taken from a fleet of specially adapted cars. Areas not accessible by car are sometimes covered by Google tricycles. On each of these vehicles there are nine directional cameras for 360° views at a height of about 2.5 meters, GPS units for positioning and three laser range scanners for the measuring of up to 50 meters 180° in the front of the vehicle. There are also 3G/GSM/Wi-Fi antennas for scanning 3G/GSM and Wi-Fi hotspots.

2. No about the fighting issue that i have reffered in the subject topic.Now whether it is a facility for the world base users to utilize viewing live views of streets world vide or it is an attempt to log in to the private data of the users across.....yess...I repeat it is the private data of the users avaiable from the open WiFi signals from their home computers and laptops.The intresting thing is that Google has accepted this collection of data from unencrypted wireless networks....and they have put the blame on a masoom software engineer.Google says the massive furore over Wifi snooping by Street View cars was all the fault of one software engineer.In an interview ,CEO Eric Schmidt said the whole affair came about because a software engineer inserted unauthorised code into the Street View system software. The man is now under investigation internally by the company as per posts on google blog.

3. Now what ever answer that google may come up with in form a mistake or simply putting the blame on that software engineer(...where was the Software Testing deptt and QC then otherwise?),the point that I intend putting accross is that just take care of envryting your WiFi router.Google has at least accepted the fact and mistake and they are taking measures to rectify it...but it will not be always like that.....there are so many mis adventurists present all around that looking around that unencrypted wireless networks for misuse.....just read this post again to avoid becoming a target like others.

4. Thanks http://tech.blorge.com & http://en.wikipedia.org/