This Blog Is Not For Reading

A blog, just like any blog, only more so

  • Subscribe

  • Categories

  • RSS Bob Jonkman’s Microblog

    • New note by bobjonkman 20 November 2017
      And #RemoteHashtag following can be done by selecting the Atom/RSS feed for a tag on the remote server and adding it to "Settings, Mirroring, Feed URL". https://gs.jonkman.ca/attachment/25187
    • New note by bobjonkman 20 November 2017
      #Hashtag following is already built into !GNUsocial, just select the "Subscribe" button on http://yourinstance.example.org/tag/hashtag https://gs.jonkman.ca/attachment/25185
    • New note by bobjonkman 20 November 2017
      Good article! Can you linkify the resources you mention, eg. Tor, Tox, Riot, Briar?
    • Favorite 20 November 2017
      bobjonkman favorited something by bob: The Honey Bee Algorithmhttps://www.youtube.com/watch?v=elTfueXcYaU
    • Favorite 20 November 2017
      bobjonkman favorited something by silverwizard: ♲ @Liam O (liamosaur@twitter.com): If you're a pentester and don't have even a little bit of impostor syndrome, you probably have dunning-kruger syndrome instead
    • Favorite 20 November 2017
      bobjonkman favorited something by lain: @eal @roka first they came for cowsay, but i wasn't an ascii graphic of a cow usually used to view fortune messages...
    • New note by bobjonkman 20 November 2017
      This makes a number of excellent illustrations of why the entire PKI system is broken. 1) Browser vendors wield power out of all proportion to their contribution to PKI. The same SSL certs banned by browsers can also be used for e-mail, XMPP, PBXes, &c. 2) A rogue Certficate Authority can poison the entire PKI […]
    • New note by bobjonkman 20 November 2017
      Justification for cloud storage...
    • Favorite 20 November 2017
      bobjonkman favorited something by rtsn: Tonight I'm going to stockholm for a key signing party. Really looking forward to it. Building the web of trust! #pgp #crypto
    • Favorite 20 November 2017
      bobjonkman favorited something by tq: Dear new Mastodon users, please keep in mind: This is not birdsite! Here we are nice and gentle to each other, overwhelmingly so. This is a place for us to feel comfortable, to chill and talk to each other with respect and kindness.Let us all strive to keep it this […]

Google Spyware considered harmful

Posted by Bob Jonkman on 16th April 2012

Google wordmark in a "No" symbol

No Google

One day I was asked:

Hi IT Peeps,

I was wondering if I would cause major havoc if I downloaded google chrome? Will it mess anything up? Any recommendations?

My answer:

What problem are you trying to solve? What’s the question that gets answered “Install Google Chrome”?

Google the company is becoming ever more pervasive in our Internet lives. Google’s business is not providing a search engine for free; Google’s business is to sell our demographic information to advertisers. They gather that demographic data by luring us in with relevant search results, free e-mail and slick looking browsers.

Google collects personal information, including information that was voluntarily given to Google (for instance, by signing up for GMail or Google Plus; posting a video on YouTube), information that was collected anonymously (eg. when you perform a Google search or watch a YouTube video and Google records the search terms, your IP address, and leaves a cookie on your computer), and information that Google collected as it does its web indexing (comments you’ve left on a newspaper site, Tweets you’ve made, messages you’ve posted to public mailing lists). Google then correlates all this data based on IP address, cookies, e-mail addresses, your name, geo-location (finding out where you are based on your WiFi connection or IP address).

As of 1 March 2012 Google changed its privacy policies to combine data mining from all its holdings – the search engine, YouTube, Picasa, Google Maps, Google Plus, Google Mail, &c. I didn’t think too much of that, since I had thought that Google had always aggregated its data. According to an article I read[1] that’s actually a new development. Google used to keep all its data mining separate, in fact, kept it so separate that it didn’t even correlate its adwords between different messages in GMail. With the new privacy policy that’s all changed, and everything is now aggregated, correlated, and retained to be sold to the highest bidder. Google says we’ll never sell your personal information or share it without your permission, but you grant that permission every time you agree to the Terms of Service and Privacy Policies when you sign up for Google’s services.

Remember the Google Toolbar? Every search request, every URL, and every local file you opened in a browser with the Google toolbar installed was sent to the Google servers. There was a report of someone who opened confidential company documents with IE and the Google toolbar, only to find those reports cached on Google’s servers. Google Chrome is far more invasive than a mere toolbar.

Google Chrome does not have the same set of security-related add-ons that Firefox offers. For your best privacy protection and security, use Firefox with the NoScript, AdBlock Plus, HTTPS-Everywhere and Force-TLS extensions. See my article on Browser Security for details on installing and configuring them.

–Bob, who will be getting fitted for a new tinfoil hat at lunch…

Footnote 1: I wish I knew what article that was. To my recollection, the author said he wouldn’t trust Google with his data again. He had visited the Googleplex some years earlier, and was told how Google kept the data from its different projects in separate silos, so that profile aggregation was next to impossible. Data silos were so extensive that although one GMail message might trigger certain AdWords, there was no tracking between messages. I read the article in March of 2012; if you can provide me with a link let me know in the comments.

Update 8 Nov 2012: A similar quote about data silos from Google’s Vic Gundotra appears in the CNN article Google exec: We won’t break users’ trust.


Tags: , , , , , , , , , , , , ,
Posted in considered harmful, Google, Google Free, Internet, privacy | 2 Comments »

Browser Security

Posted by Bob Jonkman on 30th November 2011

Browser vulnerabilities are a common contributor to computer malware. Attacks have become so sophisticated that just viewing a Web page with an unsecured browser can infect your computer with malware. Fortunately, there are settings and extensions that will make surfing the Web a safer experience.

Browser selection

This article deals only with securing Mozilla Firefox. Firefox offers an wide selection of extensions that can help secure the browser. Google Chrome, Opera and Safari also offer some extensions, but I have not tested them. Microsoft Internet Explorer appears to support Add-ons, but Version 8 offers none for browsing security.

Internet Explorer is particularly vulnerable. In part, this is because IE is by far the most popular browser, and so it suffers the most attacks. Because it is the most popular browser it is especially targeted for attack by malusers. And compounding the problem, Microsoft has been slow to acknowledge vulnerabilities in its products, never mind fixing them.

Privacy settings

Privacy is not so much about keeping your personal information secret, but about keeping control over your personal information. If I choose to tell Facebook my name, age and browsing habits that’s OK, but my privacy is violated if Facebook finds out about my browsing habits if I don’t tell Facebook myself.

Malware is pretty good at correlating information when you least expect it. For example, you may keep your browsing history confidential, but allow Javascript to change the layout of your screen. To do so Javascript reads elements of the Document Object Model (DOM), including the colour of text. But if a link is coloured purple instead of blue, then Javascript can figure out that you’ve visited that link before, violating your privacy settings for browsing history.

To see your Firefox Privacy settings select Tools, Options and click the Privacy icon.

screenshot of Firefox Privacy dialogue

Settings for Firefox Privacy options

For maximum protection check Tell Web sites I do not want to be tracked and select Firefox will: Never remember history. But having to type in all your passwords and data every time you access the same web sites can be inconvenient, so I actually browse with the setting Firefox will: Use custom settings for history, leaving Always use private browsing mode unchecked. It is usually safe to have Accept cookies from sites turned on, with Accept third-party cookies turned off and Keep until: I close Firefox selected. Custom settings for Clear history when Firefox closes has only Cookies and Active Logins checked:

Screenshot of Clearing History dialoge

Firefox Clearing History

Security settings

To see Firefox Security settings select Tools, Options, then click on the Security icon.

Screenshot of the Security tab in Options

Screenshot - Firefox, Tools, Options, Security

For maximum security, make sure all the checkboxes are checked.

Warn me when sites try to install add-ons will avoid drive-by infections, which is when merely browsing a Web page with Javascript enabled can launch malicious processes. This will at least give you a warning.

Block reported attack sites and Block reported web forgeries do add some additional protection from malware sites, but potentially at some expense of your privacy. Every 30 minutes Firefox downloads a list of malware sites. If you browse to such a site then Firefox will check for that particular site immediately before blocking it. It uses Google’s malware list to do so, and will send Google’s cookies when checking.

You can test for phishing protection at the phishing test site and for malware protection at the malware test site.

Use a master password will encrypt the list of passwords stored on your computer. This is mostly useful if your computer should get stolen or left on the bus, but without the Master Password it might be possible for a malware site to retrieve your list of passwords through some (as yet unknown) vulnerability.

Security Extensions

Firefox’s extensive collection of extensions (Add-ons) make it my preferred browser.

NoScript

NoScript prevents Javascript from executing on specific web sites.

Javascript determines the fourth characteristic of a web page (Content, Semantics, Presentation, Behaviour). A well-designed web site will degrade gracefully — if the browser cannot manage the page layout (Presentation), it should still be able to identify the components of a page such as paragraphs and headers (Semantics), and still show the Content. Even if the browser can’t identify a paragraph from a heading (Semantics), it should always show the content. Javascript is responsible for the behaviour of a page. This is what makes Google Maps’ slippy map work when you drag the mouse cursor across the page. That behaviour degrades gracefully, so that when you view Google Maps with Javascript disabled you can still see a static map. Sadly, many web sites today are designed so that Javascript is required to show the content. NoScript addresses this problem by selectively allowing you to enable Javascript for those sites that you trust.

NoScript has expanded its scope so that it now also checks for Cross-Site Scripting vulnerabilities, Application Boundary violations, and other esoteric security concerns.

Adblock Plus

Adblock Plus removes ads. That’s wonderful all by itself, but there’s more! When ads are blocked, you don’t waste any bandwidth downloading them. But there’s more! The hits from Web Bugs aren’t recorded and tracked. And blocked ads from third-party sites can no longer query third-party cookies, or enable cross-site scripting attacks.

When you install Adblock Plus you’ll be asked to subscribe to one of the pre-defined block lists. I usually choose EasyList or Adblock.org.

ForceTLS

ForceTLS requests an encrypted page (https) when the server supports it. The functionality is now built into Firefox directly, but ForceTLS still provides a handy dialogue box to add Web sites for servers that don’t automatically switch to https.

HTTPS Everywhere

HTTPS Everywhere forces a Web pages to use https, and can change the URL for those sites that use different URL paths for their secure content. HTTPS Everywhere only works for Web sites in its Preferences list:

Screenshot of HTTPS-Everywhere preferences

HTTPS-Everywhere preferences

HTTPS Everywhere is not maintained on the Mozilla Add-ons web site, so you have to download it from the EFF directly. Firefox will ask you to verify that you want to install an add-on from an unknown site. Click on the Allow button to install the HTTPS Everywhere add-on.

Installing the HTTPS-Everywhere extension in Firefox

Keeping Updated

Security is not a single solution to a single problem. It is a constantly evolving process that tries to keep up with constantly evolving attacks. It is important to keep everything up-to-date.

Updating the Browser

To ensure that the browser and all its extensions stay up-to-date check all the boxes on the Tools, Options, Advanced, Update screen:

Screenshot of the Firefox Update screen

Updating Firefox

Updating Extensions

To update the Firefox extensions select Tools, Add-ons, click on the Tools for all add-ons button, and make sure there is a check mark beside Update Add-ons Automatically. If there is no check mark then click on Update Add-ons Automatically, and you should also perform updates manually by selecting Check for Updates. If there are any updates a View all updates link will be displayed, click on it, then click on the Update now button for each add-on in the list.

Screenshot of the Firefox Add-ons Update button

Screenshot showing the 'Update' menu

Updating the Operating System

Finally, no amount of browser security will keep you safe if your operating system is not safe. Be sure to activate Windows Updates (or Linux Updates, or AppleMac Updates), and keep your Anti-virus software, firewall, spam filters and other security software up-to-date.

–Bob.

Tags: , , , , , , , , , , , , , , , , , , , , , , , ,
Posted in Internet, security | 3 Comments »

 
Better Tag Cloud