9u2icV1J

1The paranoid #! Security Guide
2
3Table of Contents:
4
5Introduction
6
7Basic Considerations
8
9BIOS-Passwords
10
11Encryption
12Making TrueCrypt Portable
13Hardware Encryption
14Attacks on Full-Disk-Encryption
15Attacks on encrypted Containers
16Debian's encrypted LVM pwned
17Solutions
18eCryptfs
19Encrypting SWAP using eCryptfs
20Tomb
21Advanced Tomb-Sorcery
22
23Keyloggers
24Software Keyloggers
25Defense against Software Keyloggers
26Hardware Keyloggers
27Defense against Hardware Keyloggers
28
29Secure File-Deletion
30BleachBit
31srm [secure rm]
32Other Ways to securely wipe Drives
33
34Your Internet-Connection
35ipkungfu
36Configuring /etc/sysctl.conf
37Modem & Router
38
39Intrusion-Detection, Rootkit-Protection & AntiVirus
40Snort
41RKHunter
42RKHunter-Jedi-Tricks
43chkrootkit
44Tiger
45Lynis
46debsums
47sha256
48ClamAV
49
50DNS-Servers
51Using secure and censor-free DNS
52DNSCrypt
53
54Firefox/Iceweasel
55Firefox-Sandbox: Sandfox
56Firefox-Preferences
57Plugins
58Addons
59SSL-Search-Engines
60Flash-Settings
61about:config
62Prevent Browser-Fingerprinting
63
64TOR [The Onion Router]
65TOR-Warning
66
67I2P
68
69Freenet
70
71Secure Peer-to-Peer-Networks
72
73Mesh-Networks
74
75Proxies
76Proxy-Warning
77
78VPN (Virtual Private Network)
79
80The Web
81RSS-Feeds
82
83Secure Mail-Providers
84
85Disposable Mail-Addresses
86
87Secure Instant-Messaging/VoIP
88TorChat
89OTR [Off-the-Record-Messaging]
90Secure and Encrypted VoIP
91
92Social Networking
93Facebook
94Alternatives to Facebook
95
96Passwords
97pwgen
98KeePass
99
100Live-CDs and VM-Images that focus on security and anonymity
101
102Further Info/Tools
103
104
105Introduction
106
107Hi all!
108
109This is my first attempt to contribute something to the community. Basically you can find everything I write here somewhere else on the web or in some book - but exactly that is the problem. You can literally spend weeks digging up all this stuff. And to save you some trouble I thought: "Heck, let's just put this into a little manual."
110
111You're dealing with a somewhat paranoid security setup for debian-based systems like #!.
112[This is the end-user and not the |-|4xx0|2-version. We are not getting into virtual-virtual-virtual-machine-double-vpn-ssh-proxy-chain-from-your-internet-cafe-type-stuff.]
113
114In this small guide I simply provide several "recipes" for securing both your box and your internet-connection and web-applications. I won't go into the why of all of this in too much detail as I want to provide a simple how-to that people can follow to make their system more secure without having to read through hundreds of pages of explanations. This information can easily be found elsewhere. If you're interested in a certain topic then just fire up a web-search and give it a read.
115
116This guide is not exhaustive of course. As they say, security is a process - and so this guide can only be a place to start which needs to be adjusted to your personal needs.
117
118If you consider to use this information and you find something to be too overcautious for your particular need - just ignore it and move on. One last thing before we begin: I am not a "security-guru" (far from it) - but more appropriately (as my nick suggests) some dude wrapping his head around things...
119Basic considerations
120BIOS-Passwords
121
122For the physical security of your data you should always employ encrypted drives. But before we get to that make sure you set strong passwords in BIOS for both starting up and modifying the BIOS-settings. Also make sure to disable boot for any media other than your harddrive.
123Encryption
124
125With #! this is easy. In the installation you can simply choose to use an encrypted LVM. (For those of you who missed that part on installation and would still like to use an encrypted partition withouth having to reinstall: use these instructions to get the job done.) For other data, e.g. data you store on transportable media you can use TrueCrypt - which is better than e.g. dmcrypt for portable media since it is portable, too. You can put a folder with TrueCrypt for every OS out there on to the unencrypted part of your drive and thus make sure you can access the files everywhere you go.
126
127This is how it is done:
128Making TrueCrypt Portable
129
130    Download yourself some TC copy.
131
132    Extract the tar.gz
133
134    Execute the setup-file
135
136    When prompted choose "Extract .tar Package File"
137
138    go to /tmp
139
140    copy the tar.gz and move it where you want to extract/store it
141
142    extract it
143
144    once it's unpacked go to "usr"->"bin" grab "truecrypt"-binary
145
146    copy it onto your stick
147
148    give it a test-run
149
150There is really not much more in that tarball than the binary. Just execute it and you're ready for some crypto.
151
152I don't recommend using TrueCrypt's hidden container, though. Watch this vid to find out why. If you don't yet know how to use TrueCrypt check out this guide. [TrueCrypt's standard encryption is AES-256. This encryption is really good but there are ways to attack it and you don't know how advanced certain people already got at this. So when prompted during the creation of a TrueCrypt container use: AES-Twofish-Serpent and as hash-algorithm use SHA-512. If you're not using the drive for serious video-editing or such you won't notice a difference in performance. Only the encryption process when creating the drive takes a little longer. But we get an extra scoop of security for that... wink]
153Hardware Encryption
154
155There are three different types of hardware encrypted devices available, which are generally called: SED (Self Encrypting Devices)
156
157- Flash-Drives (Kingston etc.)
158- SSD-Drives (Samsung etc.)
159- HD-Drives (WD, Hitachi, Toshiba etc.)
160
161They all use AES encryption. The key is generated within the device's microprocessor and thus no crucial data - neither password nor key are written to the host system. AES is secure - and thus using these devices can give some extra protection.
162
163But before you think that all you need to do is to get yourself one of these devices and you're safe - I have to warn you: You're not.
164
165So let's get to the reasons behind that.
166Attacks on Full-Disk-Encryption
167
168Below we will have a look at a debian specific attack using a vulnerability common with encrypted LVMs.
169
170But you need to be aware that all disk-encryption is generally vulnerable - be it software- or hardware-based. I won't go into details how each of them work exactly - but I will try to at least provide you with a short explanation.
171
172For software-based disk-encryption there are these known attacks:
173
174- DMA-Attacks (DMA/HDMI-Ports are used to connect to a running, locked machine to unlock it)
175
176- Cold-Boot-Attacks (Keys are extracted from RAM after a cold reboot)
177
178- Freezing of RAM (RAM is frozen and inserted into the attacker's machine to extratct the key)
179
180- Evil-Maid-Attacks (Different methods to boot up a trojanized OS or some kind of software-keylogger)
181
182For hardware-based disk-encryption there are similar attacks:
183
184- DMA-Attacks (same as with SW-based encryption)
185
186- Replug-Attacks (Drive's data cable is disconnected and connected to attacker's machine via SATA-hotplugging)
187
188- Reboot-Attacks (Drive's data cable is disconnected and connected to attacker's machine after enforced reboot. Then the bios-password is circumvented through the repeated pressing of the F2- and enter-key. After the bios integrated SED-password has been disabled the data-cable is plugged into the attacker's machine. This only works on some machines.)
189
190- Networked-Evil-Maid-Attacks (Attacker steals the actual SED and replaces it with another containing a tojanized OS. On bootup victim enters it's password which is subsequently send to the attacker via network/local attacker hot-spot. Different method: Replacing a laptop with a similar model [at e.g. airport/hotel etc.] and the attacker's phone# printed on the bottom of the machine. Victim boots up enters "wrong" password which is send to the attacker via network. Victim discovers that his laptop has been misplaced, calls attacker who now copies the content and gives the "misplaced" laptop back to the owner.)
191
192A full explanation of all these attacks been be found in this presentation. (Unfortunately it has not yet been translated into English.) An English explanation of an evil-maid-attack against TrueCrypt encrypted drives can be found here
193Attacks on encrypted Containers
194
195There are also attacks against encrypted containers. They pretty much work like cold-boot-attacks, without the booting part.
196An attacker can dump the container's password if the computer is either running or is in hibernation mode - either having the container open and even when the container has been opened during that session - using temporary and hibernation files.
197Debian's encrypted LVM pwned
198
199This type of "full" disk encryption can also be fooled by an attack that could be classified as a custom and extended evil-maid-attack. Don't believe me? Read this!
200
201The problem basically is that although most of the filesystem and your personal data are indeed encrypted - your boot partition and GRUB aren't. And this allows an attacker with physical access to your box to bring you into real trouble.
202
203To avoid this do the following:
204Micah Lee wrote:
205
206    If you don’t want to reinstall your operating system, you can format your USB stick, copy /boot/* to it, and install grub to it. In order to install grub to it, you’ll need to unmount /boot, remount it as your USB device, modify /etc/fstab, comment out the line that mounts /boot, and then run grub-install /dev/sdb (or wherever your USB stick is). You should then be able to boot from your USB stick.
207
208    An important thing to remember when doing this is that a lot of Ubuntu updates rewrite your initrd.img, most commonly kernel upgrades. Make sure your USB stick is plugged in and mounted as /boot when doing these updates. It’s also a good idea to make regular backups of the files on this USB stick, and burn them to CDs or keep them on the internet. If you ever lose or break your USB stick, you’ll need these backups to boot your computer.
209
210    One computer I tried setting this defense up on couldn’t boot from USB devices. I solved this pretty simply by making a grub boot CD that chainloaded to my USB device. If you google “Making a GRUB bootable CD-ROM,” you’ll find instructions on how to do that. Here’s what the menu.1st file on that CD looks like:
211
212    default 0
213    timeout 2
214    title Boot from USB (hd1)
215    root (hd1)
216    chainloader +1
217
218    I can now boot to this CD with my USB stick in, and the CD will then boot from the USB stick, which will then boot the closely watched initrd.img to load Ubuntu. A little annoying maybe, but it works.
219
220(Big thanks to Micah Lee!)
221
222Note: Apparently there is an issue with installing GRUB onto USB with waldorf/wheezy. As soon as I know how to get that fixed I will update this section.
223Solutions
224
225You might think that mixing soft- and hardware-based encryption will solve these issues. Well, no. They don't. An attacker can simply chain different methods and so we are back at square one. Of course this makes it harder for an attacker to reach his goals - but he/she will not be stopped by it. So the only method that basically remains is to regard full-disk-encryption as a first layer of protection only.
226
227Please don't assume that the scenarios described above are somewhat unrealistic. In the US there are about 5000 laptops being lost or stolen each week on airports alone. European statistics indicate that about 8% of all business-laptops are at least once either lost or stolen.
228
229A similar risk is there if you leave the room/apartment with your machine locked - but running. So the first protection against these methods is to always power down the machine. Always.
230
231The next thing to remind yourself off is: You cannot rely on full-disk-encryption. So you need to employ further layers of encryption. That means that you will have to encrypt folders containing sensitive files again using other methods such as tomb or TrueCrypt. That way - if an attacker manages to get hold of your password he/she will only have access to rather unimportant files. If you have sensitive or confidential data to protect full-disk encryption is not enough!
232
233When using encrypted containers that contain sensitive data you should shutdown your computer after having used them to clear all temporary data stored on your machine that could be used by an attacker to extract passwords.
234
235If you have to rely on data being encrypted and would be in danger if anyone would find the data you were encrypting you should consider only using a power-supply when using a laptop - as opposed to running on power and battery. That way if let's say, you live in a dictatorship or the mafia is out to get you - and they are coming to your home or wherever you are - all you need to do when you sense that something weird is going on is to pull the cable and hope that they still need at least 30 secs to get to your ram. This can help prevent the above mentioned attacks and thus keep your data safely hidden.
236eCryptfs
237
238If for some reason (like performance or not wanting to type in thousands of passwords on boot) you don't want to use an encrypted LVM you can use ecryptfs to encrypt files and folders after installation of the OS.
239
240To find out about all the different features of ecryptfs and how to use them I would like to point you to bodhi.zazen's excellent ecryptfs-tutorial.
241
242But there is one thing that is also important for later steps in this guide and is generally a good idea to do:
243Encrypting swap using ecryptfs
244
245Especially when using older machines with less ram than modern computers it can happen quite frequently that your machine will use swap for different tasks when there's not enough ram available to do the job. Apart from the lack of speed this is isn't very nice from a security standpoint: as the swap-partition is not located within your ram but on your harddrive - writing into this partion will leave traces of your activities on the harddrive itself. If your computer happens to use swap during your use of encryption tools it can happen that the passwords to the keys are written to swap and are thus extractable from there - which is something you really want to avoid.
246
247You can do this very easily with the help of ecryptfs.
248
249First you need to install it:
250
251$ sudo apt-get install ecryptfs-utils cryptsetup
252
253Then we need to actually encrypt our swap using the following command:
254
255$ sudo ecryptfs-setup-swap
256
257Your swap-partition will be unmounted, encrypted and mounted again.
258
259To make sure that it worked run this command:
260
261$ sudo blkid | grep swap
262
263The output lists your swap partion and should contain "cryptswap".
264
265To avoid error messages on boot you will need to edit your /etc/fstab to fit your new setup:
266
267$ sudo geany /etc/fstab
268
269Copy the content of that file into another file and save it. You will want to use it as back-up in case something gets screwed up.
270
271Now make sure to find the entry of the above listed encrypted swap partition. If you found it go ahead and delete the other swap-entry relating to the unencrypted swap-partition. Save and reboot to check that everything is working as it should be.
272Tomb
273
274Another great crypto-tool is Tomb provided by the dyne-crew.
275
276Tomb uses LUKS AES/SHA-256 and can thus be consider secure. But Tomb isn't just a possible replacement for tools like TrueCrypt.
277
278It has some really neat and easy to use features:
279
2801) Separation of encrypted file and key
2812) Mounting files and folders in predefined places using bind-hooks
2823) Hiding keys in picture-files using steganography
283
284The documentation on Tomb I was able to find, frankly, seems to be scattered all over the place.
285After I played around with it a bit I also came up with some tricks that I did not see being mentioned in any documentation.
286
287And because I like to have everything in one place I wrote a short manual myself:
288
289Installation:
290
291First you will need to import dyne's keys and add them to your gpg-keylist:
292
293$ sudo gpg --fetch-keys http://apt.dyne.org/software.pub
294
295Now verify the key-fingerprint.
296
297$ sudo gpg --fingerprint software@dyne.org | grep fingerprint
298
299The output of the above command should be:
300
301Key fingerprint = 8E1A A01C F209 587D 5706  3A36 E314 AFFA 8A7C 92F1
302
303Now, after checking that you have the right key you can trust add it to apt:
304
305$ sudo gpg --armor --export software@dyne.org > dyne.gpg
306$ sudo apt-key add dyne.gpg
307
308After you did this you want to add dyne's repos to your sources.list:
309
310$ sudo geany /etc/apt/sources.list
311
312Add:
313
314deb http://apt.dyne.org/debian dyne main
315deb-src http://apt.dyne.org/debian dyne main
316
317To sync apt:
318
319$ sudo apt-get update
320
321To install Tomb:
322
323$ sudo apt-get install tomb
324
325Usage:
326
327If you have your swap activated Tomb will urge you to turn it off or encrypt it. If you encrypt it and leave it on you will need to include --ignore-swap into your tomb-commands. To turn off swap for this session you can run
328
329$ swapoff -a
330
331To disable it completely you can comment out the swap in /etc/fstab. So it won't be mounted on reboot. (Please be aware that disabling swap on older computers with not much ram isn't such a good idea. Once your ram is being used fully while having no swap-partition mounted processes and programs will crash.)
332
333Tomb will create the crypto-file in the folder you are currently in - so if you want to create a tomb-file in your documents-folder make sure to
334
335$ cd /home/user/documents
336
337Once you are in the right folder you can create a tomb-file with this command:
338
339$ tomb -s XX create FILE
340
341XX is used to denote the size of the file in MB. So in order to create a file named "test" with the size of 10MB you would type this:
342
343$ tomb -s 10 create test
344
345Please note that if you haven't turned off your swap you will need to modify this command as follows:
346
347$ tomb --ignore-swap -s 10 create test
348
349To unlock and mount that file on /media/test type:
350
351$ tomb open test.tomb 
352
353To unlock and mount to a different location:
354
355$ tomb open test.tomb /different/location
356
357To close that particular file and lock it:
358
359$ tomb close /media/test.tomb
360
361To close all tomb-files:
362
363$ tomb close all
364
365or simply:
366
367$ tomb slam
368
369After these basic operations we come to the fun part:
370Advanced Tomb-Sorcery
371
372Obviously having a file lying around somewhere entitled: "secret.tomb" isn't such a good idea, really.
373
374A better idea is to make it harder for an attacker to even find the encrypted files you are using. To do this we will simply move its content to another file.
375
376Example:
377
378$ touch true-story.txt true-story.txt.key
379$ mv secret.tomb true-story.txt
380$ mv secret.tomb.key true-story.txt.key
381
382Now you have changed the filename of the encrypted file in such a way that it can't easily be detected.
383
384When doing this you have to make sure that the filename syntax tomb uses is conserved:
385
386filename.suffix 
387filename.suffix.key
388
389Otherwise you will have trouble opening the file.
390
391After having hidden your file you might also want to move the key to another medium.
392
393$ mv true-story.txt.key /medium/of/your/choice
394
395Now we have produced quite a bit of obfuscation. Now let's take this even further:
396
397After we have renamed our tomb-file and separated key and file we now want to make sure our key can't be found either.
398
399To do this we will hide it within a jpeg-file.
400
401$ tomb bury true-story.txt.key invisible-bike.jpg
402
403You will need to enter a steganography-password in the process.
404
405Now rename the original keyfile to something like "true-story.txt.key-backup" and check if everything worked:
406
407$ tomb exhume true-story.txt.key invisible-bike.jpg
408
409Your key should have reappeared now. After making sure that everything works you can safely bury the key again and delete the residual key that usually stays in the key's original folder.
410
411By default Tomb's encrypted file and key need to be in one folder. If you have separated the two you will have to modify your opening-command:
412
413$ tomb -k /medium/of/your/choice/true-story.txt.key open true-story.txt
414
415To change the key-files password:
416
417$ tomb passwd true-story.txt.key
418
419If, let's say, you want to use Tomb to encrypt your icedove mail-folders you can easily do that. Usually it would be a pain in the butt to do this kind of stuff with e.g. truecrypt because you would need to setup a container, move the folder to the container and when using the folder you would have to move back to its original place again.
420
421Tomb does this with ease:
422
423Simply move the folders you want to encrypt into the root of the tomb-file you created.
424
425Example:
426
427You want to encrypt your entire .icedove folder. Then you make a tomb-file for it and move the .icedove folder into that tomb. The next thing you do is create a file named "bind-hooks" and place it in the same dir. This file will contain a simple table like this:
428
429.icedove .icedove
430.folder-x .folder-x
431.folder-y .folder-y
432.folder-z .folder-z
433
434The fist column denotes the path relative to the tomb's root. The second column represents the path relative to the user's home folder.
435
436So if you simply wanted to encrypt your .icedove folder - which resides in /home/user/ the above notation is fine. If you want the folder to be mounted elsewhere in the your /home you need to adjust the lines accordingly.
437
438One thing you need to do after you moved the original folder into the tomb is to create a dummy-folder into which the original's folders content can be mounted. So you simply go into /home/user and create a folder named ".icedove" and leave it empty.
439
440The next time you open and mount that tomb-file your .icedove folder will be where it should be and will disappear as soon as you close the tomb. Pretty nice, hu?
441
442I advise to test this out before you actually move all your mails and prefs into the tomb. Or simply make a backup. But use some kind of safety-net in order not to screw up your settings.
443Keyloggers
444
445Keyloggers can pose a great thread to your general security - but especially the security of your encrypted drives and containers. If someone manages to get a keylogger onto your system he/she will be able to collect all the keystrokes you make on your machine. Some of them even make screenshots.
446
447So what kind of keyloggers are there?
448Software Keyloggers
449
450For linux there are several software-keyloggers available. Examples are lkl, uberkey, THC-vlogger, PyKeylogger, logkeys.
451Defense against Software Keyloggers
452
4531) Never use your system-passwords outside of your system
454
455Generally everything that is to be installed under linux needs root access or some priveliges provided through /etc/sudoers. But an attacker could have obtained your password if he/she was using a browser-exploitation framework such as beef - which also can be used as a keylogger on the browser level. So if you have been using your sudo or root password anywhere on the internet it might have leaked and could thus be used to install all kinds of evil sh*t on your machine. Keyloggers are also often part of rootkits. So do regular system-checks and use intrusion-detection-systems.
456
4572) Make sure your browser is safe
458
459Often people think of keyloggers only as either a software tool or a piece of hardware equipment installed on their machine. But there is another threat that is actually much more dangerous for linux users: a compromised browser. You will find a lot of info on how to secure your browser further down. So make sure you use it.
460
461Compromising browsers isn't rocket science. And since all the stuff that is actually dangerous in the browser is cross-plattform - you as a linux-user aren't safe from that. No matter what short-sighted linux-enthusiasts might tell you. A java-script exploit will pwn you - if you don't secure your browser. No matter if you are on OSX, Win or debian.
462
4633) Check running processes
464
465If your attacker isn't really skilled or determined he/she might not think about hiding the process of the running keylogger. You can take a look at the output of
466
467$ ps -aux
468
469or
470
471$ htop
472
473or
474
475$ pstree
476
477and inspect the running processes. Of course the attacker could have renamed it. So have a look for suspicious processes you have never heard of before. If in doubt do a search on the process or ask in a security-related forum about it.
478
479Since a lot of keyloggers come as the functionality of a rootkit it would be much more likely that you would have one of these.
480
4814) Do daily scans for rootkits
482
483I will describe tools for doing that further below. RKHunter and chkrootkit should definitely be used. The other IDS-tools described give better results and are much more detailed - but you actually need to know a little about linux-architecture and processes to get a lot out of them. So they're optional.
484
4855) Don't rely on virtual keyboards
486
487The idea to defeat a keylogger by using a virtual keyboard is nice. But is also dangerous. There are some keyloggers out there that will also capture your screen activity. So using a virtual keyboard is pretty useless and will only result in the false feeling of security.
488Hardware Keyloggers
489
490There is also an ever growing number of hardware keyloggers. Some of which use wifi. And some of them can be planted inside your keyboard so you wouldn't even notice them if you inspected your hardware from the outside.
491Defense against Hardware Keyloggers
492
4931) Inspect your Hardware
494
495This one's obvious.
496
4972) Check which devices are connected to your machine
498
499There is a neat little tool called USBView which you can use to check what kind of usb-devices are connected to your machine. Some - but not all - keyloggers that employ usb will be listed there. It is available through the debian-repos.
500
501$ sudo apt-get install usbview
502
503Apart from that there's not much you can do about them. If a physical attack is part of your thread-model you might want to think about getting a laptop safe in which you put the machine when not in use or if you're not around. Also, don't leave your laptop unattended at work, in airports, hotels and on conferences.
504Secure File-Deletion
505
506Additional to encrypted drives you may also want to securely delete old data or certain files. For those who do not know it: regular "file deletion" does not erase the "deleted" data. It only unlinks the file's inodes thus making it possible to recover that "deleted" data with forensic software.
507
508There are several ways to securely delete files - depending on the filesystem you use. The easiest is:
509BleachBit
510
511With this little tool you can not only erase free disc space - but also clean your system from various temporary files you don't need any longer and that would give an intruder unnecessary information about your activities.
512
513To install:
514
515$ sudo apt-get install bleachbit
516
517to run:
518
519$ bleachbit
520
521Just select what you need shredding. Remember that certain functions are experimental and may cause problems on your system. But no need to worry: BleachBit is so kind to inform you about that and give you the chance to cancel your selection.
522
523Another great [and much more secure] tool for file deletion is:
524srm [secure remove]
525
526$ sudo apt-get install secure-delete
527
528Usage:
529
530Syntax: srm [-dflrvz] file1 file2 etc.
531
532Options:
533    -d  ignore the two dot special files "." and "..".
534    -f  fast (and insecure mode): no /dev/urandom, no synchronize mode.
535    -l  lessens the security (use twice for total insecure mode).
536    -r  recursive mode, deletes all subdirectories.
537    -v  is verbose mode.
538    -z  last wipe writes zeros instead of random data.
539
540Other ways to securely wipe drives
541
542To overrite data with zeros:
543
544# dd if=/dev/zero of=/dev/sdX
545
546or:
547
548$ sudo dd if=/dev/zero of=/dev/sdX
549
550To overwrite data with random data (makes it less obvious that data has been erased):
551
552# dd if=/dev/urandom of=/dev/sdX
553
554or:
555
556$ sudo dd if=/dev/urandom of=/dev/sdX
557
558Note: shred doesn't work reliably with ext3.
559Your Internet-Connection
560
561Generally it is advised to use a wired LAN-connection - as opposed to wireless LAN (WLAN).
562For further useful information in regards to wireless security read this. If you must use WLAN please use WPA2 encryption. Everything else can be h4xx0red by a 12-year-old using android-apps such as anti.
563
564Another thing is: Try only to run services on your machine that you really use and have configured properly. If e.g. you don't use SSH - deinstall the respective client to make sure to save yourself some trouble. Please note that IRC also is not considered to be that secure. Use it with caution or simply use a virtual machine for stuff like that.
565
566If you do use SSH please consider using Denyhosts or SSHGuard. (If you want to find out what might happen if you don't use such protection see foozer's post.)
567
568So, let's begin with your firewall. For debian-like systems there are several possible firewall-setups and different guis to do the job. However, I found ipkungfu [an iptables-script] to do the best job while being easy to set up. This is how you set it up:
569ipkungfu [basic configuration]
570
571download and install:
572
573$ sudo apt-get install ipkungfu
574
575configure:
576
577$ sudo geany /etc/ipkungfu/ipkungfu.conf
578
579uncomment (and adjust):
580
581# IP Range of your internal network. Use "127.0.0.1"
582# for a standalone machine. Default is a reasonable
583# guess.
584LOCAL_NET="192.168.1.0/255.255.255.0"
585
586---
587
588# Set this to 0 for a standalone machine, or 1 for
589# a gateway device to share an Internet connection.
590# Default is 1.
591GATEWAY=0
592
593---
594
595# Temporarily block future connection attempts from an
596# IP that hits these ports (If module is present)
597FORBIDDEN_PORTS="135 137 139"
598
599---
600
601# Drop all ping packets?
602# Set to 1 for yes, 0 for no. Default is no.
603BLOCK_PINGS=1
604
605---
606
607# What to do with 'probably malicious' packets
608#SUSPECT="REJECT"
609SUSPECT="DROP"
610
611---
612
613# What to do with obviously invalid traffic
614# This is also the action for FORBIDDEN_PORTS
615#KNOWN_BAD="REJECT"
616KNOWN_BAD="DROP"
617
618---
619
620# What to do with port scans
621#PORT_SCAN="REJECT"
622PORT_SCAN="DROP"
623
624enable ipkungfu to start with the system:
625
626$ sudo geany /etc/default/ipkungfu
627
628change: "IPKFSTART = 0" ---> "IPKFSTART=1"
629
630start ipkungfu:
631
632$ sudo ipkungfu
633
634fire up GRC's Shields Up! and check out the awesomeness.
635
636(special thanks to the ubuntu-community)
637Configuring /etc/sysctl.conf
638
639Here you set different ways how to deal with ICMP-packets and other stuff:
640
641$ sudo geany /etc/sysctl.conf
642
643# Do not accept ICMP redirects (prevent MITM attacks)
644net.ipv4.conf.all.accept_redirects=0
645net.ipv6.conf.all.accept_redirects=0
646net.ipv4.tcp_syncookies=1
647#lynis recommendations
648#net.ipv6.conf.default.accept_redirects=0
649net.ipv4.tcp_timestamps=0
650net.ipv4.conf.default.log_martians=1
651# TCP Hardening - [url]http://www.cromwell-intl.com/security/security-stack-hardening.html[/url]
652net.ipv4.icmp_echo_ignore_broadcasts=1
653net.ipv4.conf.all.forwarding=0
654net.ipv4.conf.all.rp_filter=1 
655net.ipv4.tcp_max_syn_backlog=1280
656kernel.core_uses_pid=1
657kernel.sysrq=0
658#ignore all ping
659net.ipv4.icmp_echo_ignore_all=1
660# Do not send ICMP redirects (we are not a router)
661net.ipv4.conf.all.send_redirects = 0
662# Do not accept IP source route packets (we are not a router)
663net.ipv4.conf.all.accept_source_route = 0
664net.ipv6.conf.all.accept_source_route = 0
665# Log Martian Packets
666net.ipv4.conf.all.log_martians = 1
667
668After editing do the following to make the changes permanent:
669
670sudo sysctl -p
671
672(thanks to tradetaxfree for these settings)
673Modem & Router
674
675Please don't forget to enable the firewall features of your modem (and router), disable UPnP and change the usernames and admin-passwords. Also try to keep up with the latest security info and updates on your firmware to prevent using equipment such as this. You might also want to consider setting up your own firewall using smoothwall.
676
677Here you can run a short test to see if your router is vulnerable to UPnP-exploits.
678
679The best thing to do is to use after-market-open-source-firmware for your router such as dd-wrt, openwrt or tomato. Using these you can turn your router into an enterprise grade device capable of some real Kungfu. Of course they come with heavy artillery - dd-wrt e.g. uses an IP-tables firewall which you can configure with custom scripts.
680Intrusion-Detection, Rootkit-Protection & AntiVirus
681snort [basic configuration]
682
683The next thing you might want to do is to take a critical look at who's knocking at your doors.
684
685For this we use snort. The setup is straight forward and simple:
686
687$ sudo apt-get install snort 
688
689run it:
690
691$ snort -D (to run as deamon)
692
693to check out packages live type:
694
695$ sudo snort
696
697Snort should automatically start on reboot.
698
699If you want to check out snort's rules take a look at: /etc/snort/rules
700
701To take a look at snorts warnings:
702
703$ sudo geany /var/log/snort/alert
704
705Snort will historically list all the events it logged.
706
707There you will find nice entries like this...
708
709[**] [1:2329:6] MS-SQL probe response overflow attempt [**]
710[Classification: Attempted User Privilege Gain] [Priority: 1] 
711[Xref => [url]http://www.securityfocus.com/bid/9407][/url]
712
713...and will thank the flying teapot that you happen to use #! wink
714RKHunter
715
716The next thing to do is to set up RKHunter - which is short for [R]oot[K]itHunter.
717
718What does it do? You guessed it: It hunts down rootkits.
719
720Installation again is simple:
721
722$ sudo apt-get install rkhunter
723
724The best is to run rkhunter on a clean installation - just to make sure nothing has been tampered with already.
725
726One very important thing about rkhunter is that you need to give it some feedback: everytime you e.g. make an upgrade to your sytem and some of your binaries change rkhunter will weep and tell you you've been compromised. Why? Because it can only detect suspicious files and file-changes. So, if you go about and e.g. upgrade the coreutils package a lot of change will be happening in /usr/bin - and when you subsequently ask rkhunter to check your system's integrity your log file will be all red with warnings. It will tell you that the file-properties of your binaries changed and you start freaking out. To avoid this simply run the command rkhunter --propupd on a system which you trust to not have been compromised.
727
728In short: directly after commands like apt-get update && apt-get upgrade run:
729
730$ sudo rkhunter --propupd 
731
732This tells rkhunter: 'sall good. wink
733
734To run rkhunter:
735
736$ sudo rkhunter -c --sk
737
738You find rkhunter's logfile in /var/log/rkhunter.log. So when you get a warning you can in detail check out what caused it.
739
740To set up a cronjob for RKHunter:
741
742$ sudo geany /etc/cron.daily/rkhunter.sh
743
744insert and change the mail-address:
745
746#!/bin/bash
747/usr/local/bin/rkhunter -c --cronjob 2>&1 | mail -s "RKhunter Scan Details" your@email-address.com
748
749make the script executable:
750
751$ sudo chmod +x /etc/cron.daily/rkhunter.sh
752
753update RKHunter:
754
755$ sudo rkhunter --update
756
757and check if it functions the way it's supposed to do:
758
759$ sudo rkhunter -c --sk
760
761Of course you can leave out the email-part of the cronjob if you don't want to make the impression on someone shoulder-surfing
762your email-client that the only one who's sending you emails is your computer... wink
763
764Generally, using snort and rkhunter is a good way to become paranoid - if you're not already. So please take the time to investigate the alerts and warnings you get. A lot of them are false positives and the listings of your system settings. Often enough nothing to worry about. But if you want to use them as security tools you will have to invest the time to learn to interpret their logs. Otherwise just skip them.
765RKHunter-Jedi-Tricks
766
767If you're in doubt whether you did a rkhunter --propupd after an upgrade and you are getting a warning you can run the following command:
768
769$ sudo rkhunter --pkgmgr dpkg -c --sk
770
771Now rkhunter will check back with your package-manager to verify that all the binary-changes were caused by legitimate updates/upgrades. If you previously had a warning now you should get zero of them. If you still get a warning you can check which package the file that caused the warning belongs to.
772
773To do this:
774
775$ dpkg -S /folder/file/in/doubt
776
777Example:
778
779$ dpkg -S /bin/ls
780
781Output:
782
783coreutils: /bin/ls
784
785This tells you that the file you were checking (in this case /bin/ls) belongs to the package "coreutils".
786
787Now you can fire up packagesearch.
788
789If you haven't installed it:
790
791$ sudo apt-get install packagesearch
792
793To run:
794
795$ sudo packagesearch
796
797In packagesearch you can now enter coreutils in the field "search for pattern". Then you select the package in the box below. Then you go over to the right and select "files". There you will get a list of files belonging to the selected package. What you want to do now is to look for something like:
798
799/usr/share/doc/coreutils/changelog.Debian.gz
800
801The idea is to get a file belonging to the same package as the file you got the rkhunter-warning for - but that is not located in the binary-folder.
802
803Then you look for that file within the respective folder and check the file-properties. When it was modified at the same time as the binary in doubt was modified you can be quite certain that the change was caused by a legitimate update. I think it is save to say that some script-kiddie trying to break into your system will not be that thorough. Also make sure to use debsums when in doubt. I will get to that a little further down.
804
805Another neat tool with similar functionality is:
806chkrootkit
807
808To install:
809
810$ sudo apt-get install chkrootkit
811
812To run:
813
814$ sudo chkrootkit
815
816Other nice intrusion detection tools are:
817tiger
818
819Tiger is more thorough than rkhunter and chkrootkit and can aid big time in securing your box:
820
821$ sudo apt-get install tiger 
822
823to run it:
824
825$ sudo tiger
826
827you find tiger's logs in /var/log/tiger/
828Lynis
829
830If you feel that all the above IDS-tools aren't enough - I got something for you:
831
832Lynis
833Lynis wrote:
834
835    Lynis is an auditing tool for Unix (specialists). It scans the system and available software, to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes.
836
837    This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems
838
839I use it. It is great. If you think you might need it - give it a try. It's available through the debian repos.
840
841$ sudo apt-get install lynis
842
843To run:
844
845$ sudo lynis -c
846
847Lynis will explain its findings in the log-file.
848debsums
849
850debsums checks the md5-sums of your system-files against the hashes in the respective repos.
851
852Installation:
853
854$ sudo apt-get install debsums
855
856To run:
857
858$ sudo debsums -ac 
859
860This will list all the files to which the hashes are either missing or have been changed. But please don't freak out if you find something like: /etc/ipkungfu/ipkungfu.conf after you have been following this guide... wink
861sha256
862
863There are some programs that come with sha256 hashes nowadays. For example: I2P
864
865debsums won't help with that. To check these hashes manually:
866
867$ cd /folder/you/downloaded/file/to/check/to -sha256sum -c file-you-want-to-check
868
869Then compare it to the given hash. Note: This tool is already integrated to debian-systems.
870ClamAV
871
872To make sure eveything that gets into your system is clean and safe use ClamA[nti]V[irus].
873
874To install:
875
876$ sudo apt-get install clamav
877
878To update:
879
880$ sudo freshclam
881
882To inspect e.g. your download folder:
883
884$ sudo clamscan -ri /home/your-username/downloads
885
886This will ClamAV do a scan recursively, i.e. also scan the content of folders and inform you about possibly infected files.
887
888To inspect your whole system:
889
890$ sudo clamscan -irv --exclude=/proc --exclude=/sys --exclude=/dev --exclude=/media --exclude=/mnt 
891
892This will make ClamAV scan your system recursively in verbose mode (i.e. show you what it is doing atm) whilst excluding folders that shouldn't be messed with or are not of interest and spit out the possibly infected files it finds. To also scan attached portable media you need to modify the command accordingly.
893
894Make sure to test everything you download for possible infections. You never know if servers which are normally trustworthy haven't been compromised. Malicious code can be hidden in every usually employed filetype. (Yes, including .pdf!)
895
896Remember: ClamAV is known for its tight nets. That means that you are likely to get some false positives from time to time. Do a web-search if you're in doubt in regards to its findings.
897
898After you set up your host-based security measures we can now tweak our online security.
899
900Starting with:
901DNS-Servers
902Using secure and censor-free DNS
903
904To make changes to your DNS-settings:
905
906$ sudo geany /etc/resolv.conf
907
908change your nameservers to trustworthy DNS-Servers. Otherwise your modem will be used as "DNS-Server" which gets its info from your ISP's DNS.
909And nah... We don't trust the ISP... wink
910Here you can find secure and censor-free DNS-servers. The Germans look here.
911
912HTTPS-DNS is generally preferred for obvious reasons.
913
914Your resolv.conf should look something like this:
915
916nameserver 213.73.91.35
917#CCC DNS-Server
918nameserver 85.214.20.141
919#FoeBud DNS-Server
920
921Use at least two DNS-Servers to prevent connectivity problems when one server happens to be down or experiences other trouble.
922
923To prevent this file to be overwritten on system restart fire up a terminal as root and run:
924
925$ sudo chattr +i /etc/resolv.conf
926
927This will make the file unchangeble - even for root.
928
929To revoke this for future changes to the .conf run:
930
931$ sudo chattr -i /etc/resolv.conf
932
933This forces your web-browser to use the DNS-servers you provided instead of the crap your ISP uses.
934
935To test the security of your DNS servers go here.
936DNScrypt
937
938What you can also do to secure your DNS-connections is to use DNScrypt.
939
940The thing I don't like about DNScrypt is one of its core functions: to use OpenDNS as your resolver. OpenDNS has gotten quite a bad rep in the last years for various things like aggressive advertising and hijacking google-searches on different setups. I tested it out yesterday and couldn't replicate these issues. But I am certain that some of these "features" of OpenDNS have been actively blocked by my Firefox-setup (which you find below). In particular the addon Request Policy seems to prevent to send you to OpenDNS' search function when you typed in an address it couldn't resolve. The particular issue about that search function is that it apparently is powered by yahoo! and thus yahoo! would log the addresses you are searching for.
941
942Depending on your threat-model, i.e. if you don't do anything uber-secret you don't want anybody to know, you might consider using DNScrypt, as the tool seems to do a good job at encrypting your DNS-traffic. There also seems to be a way to use DNScrypt to tunnel your queries to a DNS-server other than OpenDNS - but I haven't yet checked the functionality of this.
943
944So, if you don't mind that OpenDNS will know every website you visit you might go ahead and configure DNScrypt:
945
946Download the current version.
947
948Then:
949
950$ sudo bunzip2 -cd dnscrypt-proxy-*.tar.bz2 | tar xvf -
951$ cd dnscrypt-proxy-*
952
953Compile and install:
954
955$ sudo ./configure && make -j2
956$ sudo make install
957
958Adjust -j2 with the number of cpu-cores you want to use for the compilation or have at your disposal.
959
960Go and change your resolv.conf to use localhost:
961
962$ geany /etc/resolv.conf
963
964Modify to:
965
966nameserver 127.0.0.1
967
968Run DNScrypt as daemon:
969
970$ sudo dnscrypt-proxy --daemonize
971
972According to the developer:
973jedisct1 wrote:
974
975    DNSCrypt will chroot() to this user's home directory and drop root privileges for this user's uid as soon as possible.
976
977I have to admit that OpenDNS is really fast. What you could do is this: You could use OpenDNS for your "normal" browsing. When you start browsing for stuff that you consider to be private for whatever reasons change your resolv.conf back to the trustworthy DNS-servers mentioned above - which you conveniently could keep as a backup file in the same folder. Yeah, that isn't slick, I know. If you come up with a better way to do this let me know. (As soon as I checked DNScrypt's function to use the same encryption for different DNS-Servers I will make an update.)
978
979The next thing on our list is:
980Firefox/Iceweasel
981Firefox-Sandbox: Sandfox
982
983Sandfox is a neat little script provided by IgnorantGuru which runs firefox (and other applications) in a sandboxed environment which prevents firefox's access to crucial filesystem-areas in case it gets compromised.
984
985To install:
986
987$ sudo -s
988$ gpg --keyserver keys.gnupg.net --recv-keys 7977070A723C6CCB696C0B0227A5AC5A01937621
989$ gpg --check-sigs 0x01937621
990$ bash -c 'gpg --export -a 01937621 | apt-key add -'
991$ echo "deb [url]http://ignorantguru.github.com/debian/[/url] unstable main" >> /etc/apt/sources.list
992$ apt-get update
993$ apt-get install sandfox
994
995(Thanks to tradetaxfree)
996
997To run:
998
999$ sudo sandfox firefox
1000
1001Type "/" into firefox address-bar to check out whether it works. Firefox should now only have access to files it really needs to function and not e.g. /root.
1002
1003To be able to download stuff from the web you need to add a bind in sandfox's default profile:
1004
1005$ sudo geany /etc/sandfox/default.profile
1006
1007add:
1008
1009bind=/home/$user/downloads
1010
1011Check your systems filename-capitalization to make sure you really grant sandfox access to the right folder
1012
1013In #! you can easily set this configuration as your default: simply go to "settings"->"openbox"->"GUI Menu Editor"->"Openbox"->"Web Browser". Then simply add the command "sandfox firefox". For this to work you need to once run
1014
1015$ sudo sandfox firefox
1016
1017after a system start to create a sandbox. If you happen to find this too much hassle simply go with tradetaxfree's init-script.
1018
1019After you successfully sandboxed your browser we now continue to make that particular application much more secure than it is by default.
1020
1021First go to:
1022Firefox-Preferences
1023
1024and change these settings:
1025
1026[Some of these are defaults already - but depending on who was/is using the machine you access the interwebs with and other varying factors you might want to control these settings.]
1027
1028"General"->"when Firefox starts"->"Show a blank page"
1029"General"->"save files to:"Downloads"
1030"Content"->check:"Block pop-up windows"
1031"Content"->uncheck:"Enable JavaScript" [optional - NoScript Add-on will block it anyway]
1032"Content"->"Fonts & Colors"->"Advanced"->"Serif":"Liberation Sans"
1033"Content"->"Fonts & Colors"->"Advanced"->"Sans-serif":"Liberation Sans"
1034"Content"->"Fonts & Colors"->"Advanced"->uncheck:"Allow pages to choose their own fonts"
1035"Content"->"Languages"->choose *only*:"en-us" [remove all others, if any]
1036"Applications"->choose:"Always ask" for every application - if not possible:choose:"Preview in Firefox/Nightly"
1037"Privacy"->"Tracking"->check:"Tell websites I do not want to be tracked"
1038"privacy"->"History"->"Firefox will:"Use custom settings for history"
1039"privacy"->"History"->uncheck:"Always use private browsing mode"
1040"privacy"->"History"->uncheck:"Remember my browsing and download history"
1041"privacy"->"History"->uncheck:"Remember search and form history"
1042"privacy"->"History"->uncheck:"Accept cookies from sites"
1043"privacy"->"History"->uncheck:"Accept third-party cookies"
1044"privacy"->"History"->check:"Clear history when Firefox/Nightly closes"
1045"privacy"->"History"->"settings":check all -> except:"Site Preferences"
1046[to enable cookies for certain trusted sites: use:"Exceptions" and paste URL of site and modify settings according to your preference. If you additionally use Cookie-Monster (Add-on) you need to uncheck "Block all cookies" in CM-Options]
1047"privacy"->"location bar"->"When using the location bar, suggest:"->choose:"Nothing"
1048"security"->check:"Warn me when sites try to install add-ons"
1049"security"->check:"Block reported attack sites"
1050"security"->check:"Block reported web forgeries"
1051"security"->"Passwords"->uncheck:"Remember passwords for sites"
1052"security"->"Passwords"->uncheck:"Use a master password"
1053"advanced"->"General"->"System Defaults"->uncheck:"Submit crash reports"
1054"advanced"->"General"->"System Defaults"->uncheck:"Submit performance data"
1055"advanced"->"Update"->check:"Automatically install updates"
1056"advanced"->"Update"->check:"Warn me if this will disable any of my add-ons"
1057"advanced"->"Update"->check:"Automatically update Search Engines"
1058"advanced"->"Encryption"->"Protocols"->check:"Use SSL 3.0"
1059"advanced"->"Encryption"->"Protocols"->check:"Use TLS 1.0"
1060"advanced"->"Encryption"->"Certificates"->"When a server requests my personal certificate"->check:"Ask me every time"
1061
1062Plugins
1063
1064at the most use:
1065
1066Java
1067
1068Flash [Be aware of the latest security holes in flash!
1069
1070Only allow them to run on trusted sites!
1071Addons
1072
1073Empty Cache Button [optional]
1074
1075Calomel SSL Validation [cool little addon which does exactly what its name says and also has some more tweaks in the settings]
1076
1077Adblock Edge
1078
1079[---> Filter Supscriptions: make sure you get some anti-tracking filters up and running! (depending on location & internet use)]
1080
1081Easylist
1082
1083EasyPrivacy
1084
1085fanboy-adblock
1086
1087Fanboy's Tracking List
1088
1089Fanboy's Annoyance List
1090
1091[---]
1092
1093BetterPrivacy [LSO/Flash-Cookie-Protection]
1094
1095Cookie Monster [Allows you to Manage your Cookie-Policies. For less baggage use Firefox/Iceweasel "Preferences" -> "Privacy"]
1096
1097HTTPS-Everywhere [Download via EFF.org] [settings: enable SSL-Observatory but don't allow to transmit ISP-data]
1098
1099HTTPS Finder
1100
1101NoScript [go to "settings" and check "also apply on whitelisted sites"]
1102
1103Perspectives [SSL-Cerfiticate-Control - go to settings: "notary servers" -> check "only contact when websites cause security error"]
1104
1105RefControl [controls your HTTP-Referers - setting: "block" -> "3rd parties only"]
1106
1107Request Policy [rejects cross-site requests]
1108
1109WOT [Web of Trust - user based website ratings that show up in websearches. Caution: Not very accurate. Always double check when in doubt. This addon tends
1110to get abused by different groups of users who either give malicious sites good ratings - or flag perfectly good sites.]
1111
1112PwdHash [Nice addon to help your password management. Use "F2" when entering a password into a password field when setting up a new account somewhere to create a MD5-hash using your password and the domain. (When logging in you have to select the password-field and press F2 again to run the hashing.) This way you can use the same password on different sites without having to worry about security implications - because every site gets its own password generated through the hash. The tool is provided by Standford University and can be trusted. No data is actually transmitted to their servers. The hash is generated using your local java-script. If you need to login from a machine that doesn't have pwdhash installed: go to https://www.pwdhash.com/ -> their SSL is very strong.]
1113
1114FoxyProxy [a convenient Proxy Switcher]
1115
1116Useragent Switcher [Does exactly that. But be careful: If you set your user-agent as shown below - using this addon it will overwrite these settings and will not automatically restore them if you turn off the switcher. So you would have to manually reconfigure about:config again. Which kinda sucks. But you can get a whole load really cool user agents here. Simply download the .xml and import it to the Useragent Switcher. There are really neat current agents in there: e.g. all kinds of different web browser for all OSs and of course various bots. Google bot comes in handy when you need access to some forum... wink]
1117
1118Web Developer [Has some cool features. If you like inspecting websites just check it out.]
1119
1120Bloody Vikings [Creates disposable mail-addresses]
1121
1122Note: You don't need Ghostery. The above mentioned Adblock lists do a much better job protecting you from web-tracking without using the additional resourced Ghostery uses.
1123
1124Of course there are more addons you could use. But I don't really see the point of them. Most of them either are snake-oil or even dangerous. But please inform me if you happen to come across something really cool which could help improve security which none of the setting provided here can do.
1125
1126To keep your ISP and possible MITM-attackers from reading what you do on the web always use SSL - as far as it is available. To help with this use:
1127SSL-Search Engines
1128
1129To get them go here.
1130
1131The user "SSL Search Bar" has provided easily installable SSL-searchbar-plugins
1132
1133You get SSL-plugins for all the alternative search-engines like ixquick, duckduckgo etc. there. Install those you happen to use.
1134
1135Privatelee also looks promising. But I haven't tried it out extensively.
1136
1137The next thing to do is to change macromedias flash-settings:
1138Flash-Settings
1139
1140Go here.
1141
1142And fight yourself through their nasty settings-manager. Set everything to "0" or "never allow"/"never ask again" and
1143delete all stored website-content. Give special attention to the "webcam and mic"-options... wink
1144
1145You might as well set the permissions of your .macromedia folder to read only - but that's kind of unnecessary because you want to make sure to edit the options mentioned above - to make sure that you don't allow websites to use your mic or webcam... [I actually take this one step further by disabling them in BIOS and sticking some neatly cut little piece of black cardboard on my webcam. Just because you're paranoid doesn't mean they aren't after you... big_smile ] And if you set the parameters in the settings-manager accordingly nothing will be written to that folder anyway.
1146
1147Now we come to the fun part. Finetuning Firefox using about:config. If you've never done this before: No reason to freak out. It's really easy.
1148about:config
1149
1150[You can simply copy/paste these variables into the search-bar at the top: e.g. "browser.cache.disk.enable" and
1151then double-click on the entry that shows up to modify the settings.]
1152
1153---disable browser cache:
1154browser.cache.disk.enable:false 
1155browser.cache.disk_cache_ssl:false 
1156browser.cache.offline.enable:false 
1157browser.cache.memory.enable:false 
1158browser.cache.disk.capacity:0 
1159browser.cache.disk.smart_size.enabled:false
1160browser.cache.disk.smart_size.first_run:false
1161browser.cache.offline.capacity:0
1162dom.storage.default_quota:0
1163dom.storage.enabled:false
1164dom.indexedDB.enabled:false
1165dom.battery.enabled:false
1166---disable history & localization
1167browser.search.suggest.enabled:false
1168browser.sessionstore.resume_from_crash:false
1169geo.enabled:false
1170---misc other tweaks:
1171keyword.enabled:false
1172network.dns.disablePrefetch:true -> very important when using TOR
1173network.dns.disablePrefetchFromHTTPS -> very important when using TOR
1174dom.disable_window_open_feature.menubar:true
1175dom.disable_window_open_feature.personalbar:true
1176dom.disable_window_open_feature.scrollbars:true
1177dom.disable_window_open_feature.toolbar:true
1178browser.identity.ssl_domain_display:1
1179browser.urlbar.autocomplete.enabled:false
1180browser.urlbar.trimURL:false
1181privacy.sanitize.sanitizeOnShutdown:true
1182network.http.sendSecureXSiteReferrer:false
1183network.http.spdy.enabled:false ---> use http instead of google's spdy
1184plugins.click_to_play:true ---> also check each drop-down-menu under "preferences"->"content"
1185security.enable_tls_session_tickets:false ---> disable https-tracking
1186security.ssl.enable_false_start:true ---> disable https-tracking
1187extensions.blocklist.enabled:false ---> disble Mozilla's option to block/disable your addons remotely
1188webgl.disabled:true ---> disable WebGL ([url]http://security.stackexchange.com/questions/13799/is-webgl-a-security-concern[/url])
1189network.websocket.enabled:false ---> ***Tor Users: This is extremely important as it could blow your cover! See: [url]http://pastebin.com/xajsbiyh***[/url]
1190---make your browsing faster:
1191network.http.pipelining:true
1192network.http.pipelining.ssl:true
1193network.http.proxy.pipelining:true
1194network.http.max-persistent-connections-per-proxy:10
1195network.http.max-persistent-connections-per-server:10
1196network.http.max-connections-per-server:15
1197network.http.pipelining.maxrequests:15
1198network.http.redirection-limit:5
1199network.dns.disableIPv6:true
1200network.http.fast-fallback-to-IPv4:false 
1201dom.popup_maximum Mine:10
1202network.prefetch-next:false
1203browser.backspace_action:0
1204browser.sessionstore.max_tabs_undo:5
1205browser.sessionhistory.max_entries:5
1206browser.sessionstore.max_windows_undo:1
1207browser.sessionstore.max_resumed_crashes:0
1208browser.sessionhistory.max_total_viewers:0
1209browser.tabs.animate:0
1210
1211[thanks to machinebacon for these last entries.
1212Prevent Browser Fingerprinting [still in about:config]
1213
1214                                           
1215For all Firefox Versions after 17.0 [you should be using current versions and update them regularly anyway - to do this go to "preferences"->"advanced"->"update" select: "automatically install updates" & "warn me if this will disable any of my addons"] [not required for iceweasel]
1216
1217For the following changes right-click in about:config and select "new"->"string" and enter in this order:
1218
1219Variable:                               Value:
1220                            
1221general.useragent.override   Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0 
1222general.appname.override    Netscape
1223general.appversion.override  5.0 (Windows)
1224general.oscpu.override          Windows NT 6.1
1225general.platform.override      Win32
1226general.productSub.override  20100101
1227general.buildID.override     0
1228general.useragent.vendor     [enter variable - but leave value blank]
1229general.useragent.vendorSub  [enter variable - but leave value blank]
1230intl.accept_languages       en-us,en;q=0.5
1231network.http.accept.default  text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
1232network.http.accept-encoding  gzip, deflate
1233
1234This creates a fake-profile of your browser via the readable HTTP-headers it sends.
1235
1236Check out if your browser is profilable.
1237
1238With all the above settings I get 8.1 bits of identifying information at Panopticlick for my browser - which is really good.
1239
1240Considering:
1241
1242"In particular, a fingerprint that carries no more than 15-20 bits of identifying information will in almost all cases be sufficient to uniquely identify a particular browser, given its IP address, its subnet, or even just its Autonomous System Number."
1243
1244Source: EFF's "Browser Uniqueness" [page 3]
1245
1246Also check your settings on ip-check.info - but don't rely on it. Apparently they are quite busy promoting their JonDonym-Browser and services - which quite frankly I don't think anyone needs. I would rather warn you to use it since according to this defcon-talk JAP/JonDonym has implemented tracking-features which are disabled by default but can be activated anytime. So don't use it.
1247
1248Now, after having configured your host-based security and your web-browser we can start connecting to the web. But there are different options:
1249TOR [The Onion Router]
1250
1251TOR is probably the most famous anonymizing-tool available. You could consider it a safe-web proxy. [Update: I wouldn't say that any longer. See the TOR-Warning below for more info.] Actually, simply put, it functions as a SOCKS-proxy which tunnels your traffic through an encrypted network of relays in which your ip-address can not be traced. When your traffic exits the network through so-called exit-nodes the server you are contacting will only be able to retrieve the ip-address of the exit-node. It's pretty useful - but also has a few drawbacks:
1252
1253First of all it is slow as f**k. Secondly exit-nodes are often times honey-pots set up by cyber-criminals and intelligence agencies. Why? The traffic inside the TOR-network is encrypted - but in order to communicate with services on the "real" internet this traffic needs to be decrypted. And this happens at the exit-nodes - which are thus able to inspect your packets and read your traffic. Pretty uncool. But: you can somewhat protect yourself against this kind of stuff by only using SSL/https for confidential communications such as webmail, forums etc. Also, make sure that the SSL-certificates you use can be trusted, aren't broken and use secure algorithms. The above mentioned Calomel SSL Validation addon does a good job at this. Even better is the Qualys SSL Server Test.
1254
1255The third bummer with TOR is that once you start using TOR in an area where it is not used that frequently which will be almost everywhere - your ISP will directly be able to identify you as a TOR user if he happens to use DPI (Deep Packet Inspection) or flags known TOR-relays. This of course isn't what we want. So we have to use a workaround.  (For more info on this topic watch this vid: How the Internet sees you [27C3])
1256
1257This workaround isn't very nice, I admit, but basically the only way possible to use TOR securely.
1258
1259So, the sucker way to use TOR securely is to use obfuscated bridges. If you don't know what this is please consider reading the TOR project's info on bridges
1260
1261Basically we are using TOR-relays which are not publicly known and on top of that we use a tool to hide our TOR-traffic and change the packets to look like XMPP-protocol.
1262
1263Why does this suck? It sucks because this service is actually meant for people in real disaster-zones, like China, Iran and other messed up places. This means, that everytime we connect to TOR using this technique we steal bandwidth from those who really need it. Of course this only applies if you live somewhere in the Western world. But we don't really know what information various agencies and who-knows-who collect and how this info will be used if, say, our democratic foundations crumble. You could view this approach as being proactive in the West whereas it is necessary and reactive in the more unfortunate places around the world.
1264
1265But, there is of course something we can do about this: first of all only use TOR when you have to. You don't need TOR for funny cat videos on youtube. Also it is good to have some regular traffic coming from your network and not only XMPP - for obvious reasons. So limit your TOR-use for when it is necessary.
1266
1267The other thing you/we can do is set up our own bridges/relays and contribute to the network. Then we can stream the DuckTales the whole darn day using obfuscated bridges without bad feelings... wink
1268
1269How to set up a TOR-connection over obfuscated bridges?
1270
1271Simple: Go to -> The Tor project's special obfsproxy page and download the appropriate pre-configured Tor-Browser-Bundle. wink
1272
1273Extract and run. (Though never as root!)
1274
1275If you want to use the uber-secure webbrowser we configured above simply go to the TOR-Browsers settings and check the port it uses for proxying. (This will be a different port every time you start the TOR-Bundle.)
1276
1277Then go into your browser and set up your proxy accordingly. Close the TOR-Browser and have phun! - But don't forget to: check if you're really connected to the network.
1278
1279To make this process of switching proxies even more easy you can use the FireFox-addon: FoxyProxy. This will come in handy if you use a regular connection, TOR and I2P all through the same browser.
1280
1281Tipp: While online with TOR using google can be quite impossible due to google blocking TOR-exit-nodes - but with a little help from HideMyAss! we can fix this problem. Simply use the HideMyAss! web interface to browse to google and do your searchin'. You could also use search engines like ixquick, duckduckgo etc. - but if you are up for some serious google hacking - only google will do... wink [Apparently there exists an alternative to the previously shut-down scroogle: privatelee which seems to support more sophisticated google search queries. I just tested it briefly after digging it up here. So you need to experiment with it.]
1282
1283But remember that in case you do something that attracts the attention of some three-letter-organization HideMyAss! will give away the details of your connection. So, only use it in combination with TOR - and: don't do anything that attracts that kind of attention to begin with.
1284
1285Warning: Using Flash whilst using TOR can reveal your real IP-Address. Bear this in mind! Also, double-check to have network.websocket.enabled set to false in your about:config! -> more info on that one here.
1286
1287Another general thing about TOR: If you are really concerned about your anonymity you should never use anonymized services along non-anonymized services. (Example: Don't post on "frickkkin'-anon-ops-forum.anon" while browsing to your webmail "JonDoe@everybodyknowsmyname.com")
1288
1289And BTW: For those who didn't know it - there are also the TOR hidden services...
1290
1291One note of caution: When dealing with darknets such as TOR's hidden services, I2P and Freenet please be aware that there is some really nasty stuff going on there. In fact in some obscure place on these nets everything you can and can't imagine is taking place. This is basically a side-effect of these infrastructure's intended function: to facilitate an uncensored access to various online-services from consuming to presenting content. The projects maintaining these nets try their best to keep that kind of stuff off of the "official" search engines and indexes - but that basically is all that can be done. When everyone is anonymous - even criminals and you-name-it are.
1292
1293What has been seen...
1294
1295To avoid that kind of exposure and thus keep your consciousness from being polluted with other people's sickness please be careful when navigating through these nets. Only use search-engines, indexes and trackers maintained by trusted individuals. Also, if you download anything from there make sure to triple check it with ClamAV. Don't open even one PDF-file from there without checking.
1296
1297To check pdf-files for malicious code you can use wepawet. Or if you are interested in vivisecting the thing have a look at Didier Steven's PDFTools or PeePDF.
1298
1299Change the file-ownership to a user with restricted access (i.e. not root) and set all the permissions to read only. Even better: only use such files in a virtual machine. The weirdest code thrives on the darknets... wink I don't want to scare you away: These nets generally are a really cool place to hang out and when you exercise some common sense you shouldn't get into trouble.
1300
1301[Another short notice to the Germans: Don't try to hand over stuff you may find there to the authorities, download or even make screenshots of it. This could get you into serious trouble. Sad but true. For more info watch this short vid.]
1302TOR-Warning
1303
1304The above mentioned issues unfortunately aren't the only ones. I have come across more and more reasons not to use TOR:
1305
1306- When using TOR you use about five times your normal bandwidth - which makes you stick out for your ISP - even with obfuscate bridges in use.
1307
1308- TOR-nodes (!) and TOR-exit-nodes can be and are being used to deploy malicious code and to track and spy on users.
1309
1310- There are various methods of de-anonymizing TOR-users: from DNS-leaks over browser-info-analysis to traffic-fingerprinting.
1311
1312I won't explain all these issues in detail but if you are interested in finding out why TOR isn't safe to use (and you should if you actually think that TOR is making you anonymous) I recommend you watch these talks:
1313
1314Attacking TOR at the Application-Layer
1315De-TOR-iorate Anonymity
1316Taking Control over the Tor Network
1317Dynamic Cryptographic Backdoors to take over the TOR Network
1318Security and Anonymity vulnerabilities in Tor
1319Anonymous Internet Communication done Right (I disagree with the speaker on Proxies, though. See info on proxies below.)
1320Owning Bad Guys and Mafia with Java-Script Botnets
1321
1322And if you want to see how TOR-Exit-Node sniffing is done live you can have a look at this:
1323Tor: Exploiting the Weakest Link
1324
1325To make something clear: I have nothing against the TOR-project. In fact I like it really much. But TOR is simply not yet able to cash in the promises it makes. Maybe in a few years time it will be able to defend against a lot of the issues that have been raised and illustrated. But until then I can't safely recommend using it to anybody. Sorry to disappoint you.
1326I2P
1327
1328I2P is a so-called darknet. It functions differently from TOR and is considered to be way more secure. It uses a much better encryption and is generally faster. You can theoretically use it to browse the web - but it is generally not advised and even slower as TOR using it for this purpose. I2P has some cool sites to visit, an anonymous email-service and a built-in anonymous torrent-client. wink
1329
1330For I2P to run on your system you need Open-JDK/JRE since I2P is a java-application. To install:
1331
1332Go to-> The I2P's website download, verify the SHA256 and install:
1333
1334$ cd /directory/you/downloaded/the/file/to && java -jar i2pinstall_0.9.4.jar
1335
1336Don't install as root - and even more important: Never run as root!
1337
1338To start: $ cd /yourI2P/folder ./i2prouter start
1339To stop: $ cd /yourI2P/folder ./i2prouter stop
1340
1341Once running you will be directed to your Router-Console in FireFox. From there you have various options. You should consider to give I2P more bandwidth than default for a faster and more anonymous browsing experience.
1342
1343The necessary browser configuration can be found here.
1344
1345For further info go to the project's website.
1346Freenet
1347
1348A darknet I have not yet tested myself, since I only use TOR and I2P is Freenet. I heard that it is not that populated and that it is mainly used for filesharing. A lot of nasty stuff also seems to be going on on Freenet - but this is only what I heard and read about it. The nasty stuff issue of course is also true for TOR's hidden services and I2P. But since I haven't been on it yet I can't say anything about that. Maybe another user who knows Freenet better can add her/his review.
1349
1350Anyhow...:
1351
1352You get the required software here.
1353
1354If you want to find out how to use it - consult their helpsite.
1355Secure Peer-to-Peer-Networks
1356
1357GNUnet
1358
1359RetroShare
1360Mesh-Networks
1361
1362If you're asking yourself what mesh-networks are take a look at this short video.
1363
1364guifi.net
1365
1366Netsukuku Community
1367
1368OpenWireless
1369
1370Commotion
1371
1372FabFi
1373
1374Mesh Networks Research Group
1375
1376Byzantium live Linux distro for mesh networking
1377
1378(Thanks to cyberhood!)
1379Proxies
1380
1381I have not yet written anything about proxy-servers. In short: Don't ever use them.
1382
1383There is a long and a short explanation. The short one can be summarized as follows:
1384
1385- Proxy-servers often sent xheaders containing your actual IP-address. The service you are then communication to will receive a header looking like this:
1386
1387X-Forwarded-For: client, proxy1, proxy2
1388
1389This will tell the server you are connecting to that you are connecting to him via a proxy which is fetching data on behalf of... you!
1390
1391- Proxy servers are infested with malware - which will turn your machine into a zombie within a botnet - snooping out all your critical login data for email, banks and you name it.
1392
1393- Proxy servers can read - and modify - all your traffic. When skilled enough sometimes even circumventing SSL.
1394
1395- Proxy servers can track you.
1396
1397- Most proxy servers are run by either criminals or intelligence agencies.
1398
1399Seriously. I really recommend watching this (very entertaining) Defcon-talk dealing with this topic. To see how easy e.g. java-script-injections can be done have a look at beef.
1400VPN (Virtual Private Network)
1401
1402You probably have read the sections on TOR and proxy-servers (do it now - if you haven't) and now you are asking yourself: "&*%$!, what can I use to browse the web safely and anonymously????"
1403
1404Well, there is a pretty simple solution. But it will cost you a few nickels. You have to buy a premium-VPN-service with a trustworthy VPN-provider.
1405
1406If you don't know what a VPN is or how it works - check out this video.
1407
1408Still not convinced? Then read what lifehacker has to say about it.
1409
1410Once you've decided that you actually want to use a VPN you need to find a trustworthy provider. Go here to get started with that.
1411
1412Only use services that offer OpenVPN. Basically all the other protocols aren't that secure. Or at least they can't compare to OpenVPN.
1413
1414Choose the most trustworthy service you find out there and be paranoid about it.
1415
1416A trustworthy service doesn't keep logs. If you choose a VPN, read the complete FAQ, their Privacy Policy and the Terms of Service. Check where they're located and check local privacy laws. And: Don't tell people on the internet which service you are using.
1417
1418You can get yourself a second VPN account with a different provider you access through a VM. That way VPN#1 only knows your IP-address but not the content of your communication and VPN#2 knows the content but not your IP-address.
1419
1420Don't try to use a free VPN. Remember: If you're not paing for it - you are the product.
1421The Web
1422
1423If for some unimaginable reason you want to use the "real" internet wink - you now are equipped with a configuration which will hopefully make this a much more secure endeavour. But still: Browsing the internet and downloading stuff is the greatest vulnerability to a linux-machine. So use some common sense. wink
1424RSS-Feeds
1425
1426Please be aware that using RSS-feeds can be used to track you and the information-sources you are using. Often RSS-feeds are managed through 3rd-party providers and not the by the original service you are using.
1427
1428Web-bugs are commonly used in RSS-tracking. Also your IP-address and other available browser-info will be recorded.
1429
1430Even when you use a text-based desktop-feedreader such as newsbeuter - which mitigates tracking though web-bugs and redirects - you still leave your IP-address.
1431
1432To circumvent that you would want to use a VPN or TOR when fetching your RSS-updates.
1433
1434If you want to learn more about RSS-tracking read this article.
1435Secure Mail-Providers:
1436
1437Please consider using a secure email-provider and encourage your friends and contacts to do the same. All your anonymization is worthless when you communicate confidential information in an unencrypted way with someone who is using gmx, gmail or any other crappy provider. (This also applies if you're contemplating setting up your own mail-server.)
1438
1439If possible, encrypt everything, but especially confidential stuff, using gpg/enigmail.
1440
1441lavabit.com [SSL, SMTP, POP]
1442hushmail.com [SSL, SMTP, no POP/IMAP - only in commercial upgrade]
1443vfemail.net [SSL, SMTP, POP]
1444
1445I found these to be the best. But I may have missed others in the process.
1446Hushmail also has the nice feature to encrypt "inhouse"-mails, i.e. mail sent from one hushmail-account to another. So, no need for gpg or other fancy stuff. wink
1447
1448The user cyberhood mentioned these mail-providers in the other #! thread on security.
1449
1450autistici.org [SSL, SMTP, IMAP, POP]
1451
1452Looks alright. Maybe someone has tested it already?
1453
1454mailoo.org [SSL, SMTP, IMAP, POP]
1455
1456Although I generally don't trust services that can not present themselves without typos and grammatical errors - I give them
1457the benefit of the doubt for they obviously are French. roll Well, you know how the French deal with foreign languages... tongue
1458
1459countermail.com [SSL, SMTP, IMAP, POP]
1460
1461See this Review
1462
1463riseup.org
1464
1465You need to prove that you are some kind of activist-type to get an account with them. So I didn't bother to check out their security. This is how they present themselves:
1466Riseup wrote:
1467
1468    The Riseup Collective is an autonomous body based in Seattle with collective members world wide. Our purpose is to aid in the creation of a free society, a world with freedom from want and freedom of expression, a world without oppression or hierarchy, where power is shared equally. We do this by providing communication and computer resources to allies engaged in struggles against capitalism and other forms of oppression.
1469
1470Edit: I changed my mind and will not comment on Riseup. It will have its use for some people and as this is a technical manual I edited out my political criticism to keep it that way.
1471Disposable Mail-Addresses
1472
1473Sometimes you need to register for a service and don't want to hand out your real mail-address. Setting up a new one also is a nuisance. That's where disposable mail-addresses come in. There is a firefox-addon named Bloody Vikings that automatically generates them for you. If you rather want to do that manually you can use some of these providers:
1474
1475anonbox
1476anonymouse/anonemail
1477trash-mail
147810 Minute Mail
1479dispostable
1480SilentSender
1481Mailinator
1482
1483It happens that websites don't allow you to register with certain disposable mail-addresses. In that case you need to test out different ones. I have not yet encountered a site where I could not use one of the many one-time-address out there...
1484Secure Instant-Messaging/VoIP
1485
1486Using Skype is not advised from a security standpoint. Although Skype communication is encrypted there are a few ways to attack it. Also, you probably don't want to trust Skype to keep all your data safe, do you?
1487
1488Instead you can use:
1489TorChat
1490
1491To install:
1492
1493$ sudo apt-get install torchat
1494
1495TorChat is generally considered to be really safe - employing end-to-end encryption via the TOR network. It is both anonymous and encrypted.
1496
1497Obviously you need TOR for it to function properly.
1498
1499Here you find instructions on how to use it.
1500OTR [Off-the-Record Messaging]
1501
1502OTR is also very secure. Afaik it is encrypted though not anonymous.
1503
1504Clients with native OTR support:
1505
1506Jitsi
1507Climm
1508
1509Clients with OTR support through Plugins:
1510
1511Pidgin
1512Kopete
1513
1514XMPP generally supports OTR.
1515
1516Here you find a tutorial on how to use OTR with Pidgin.
1517Secure and Encrypted VoIP
1518
1519As mentioned before - using Skype is not advised. There is a much better solution:
1520
1521Jitsi
1522
1523Jitsi is a chat/VoIP-client that can be used with different services, most importantly with XMPP. Jitsi doesn't just offer chat, chat with OTR, VoIP-calls over XMPP, VoIP-video-calls via XMPP - but also the ZRTP-protocol, which was developed by the developer of PGP, Phil Zimmerman.
1524
1525ZRTP allows you to make fully end-to-end encrypted video-calls. Ain't that sweet? wink
1526
1527If you want to know how that technology works, check out these talks by Phil Zimmerman at Defcon. [Defcon 15 | Defcon 16]
1528
1529Setting up Jitsi is pretty straightforward.
1530
1531Here is a very nice video-tutorial on how get started with Jitsi.
1532Social Networking
1533Facebook
1534
1535Although I actually don't think I need to add this here - I suspect other people coming to this forum from google might need to consider this: Don't use Facebook!
1536
1537Apart from security issues, malware and viruses Facebook itself collects every bit of data you hand out: to store it, to sell it, to give it to the authorities. And if that's still not enough for you to cut that crap you might want to watch this video.
1538
1539And no: Not using your real name on Facebook isn't helping you anything. Who are your friends on Facebook? Do you always use an IP-anonymization-service to login to Facebook? From where do you login to Facebook? Do you accept cookies? LSO-cookies? Do you use SSL to connect to Facebook? To whom are you writing messages on Facebook? What do you write there? Which favorite [movies | books | bands | places | brands]-lists did you provide to Facebook which only need to be synced with google-, youtube-, and amazon-searches to match your profile? Don't you think such a massive entity as Facebook is able to connect the dots? You might want to check out this vid to find out how much Facebook actually does know about you. Still not convinced? [Those who understand German might want to hear what the head of the German Police Union (GDP), Bernhard Witthaut, says about Facebook on National TV...]
1540
1541For all of you who still need more proof regarding the dangers of Facebook and mainstream social media in general - there is a defcon-presentation which I urge you to watch. Seriously. Watch it.
1542
1543Well, and then there's of course Wikipedia's collection of criticism of Facebook. I mean, come on.
1544Alternatives to Facebook
1545
1546Friendica is an alternative to Facebook recommended by the Free Software Foundation
1547
1548Lorea seems a bit esoteric to me. Honestly, I haven't wrapped my head around it yet. Check out their description:
1549Lorea wrote:
1550
1551    Lorea is a project to create secure social cybernetic systems, in which a network of humans will become simultaneously represented on a virtual shared world.
1552
1553    Its aim is to create a distributed and federated nodal organization of entities with no geophysical territory, interlacing their multiple relationships through binary codes and languages.
1554
1555Diaspora - but there are some doubts - or I'd better say: questions regarding diasporas security.
1556
1557But it is certainly a better choice than Facebook.
1558
1559One last thing:
1560Passwords
1561
1562Always make sure to use good passwords.
1563
1564To generate secure passwords you can use:
1565pwgen
1566
1567Installation:
1568
1569$ sudo apt-get install pwgen
1570
1571Usage:
1572
1573pwgen [ OPTIONS ] [ pw_length ] [ num_pw ]
1574
1575Options supported by pwgen:
1576  -c or --capitalize
1577    Include at least one capital letter in the password
1578  -A or --no-capitalize
1579    Don't include capital letters in the password
1580  -n or --numerals
1581    Include at least one number in the password
1582  -0 or --no-numerals
1583    Don't include numbers in the password
1584  -y or --symbols
1585    Include at least one special symbol in the password
1586  -s or --secure
1587    Generate completely random passwords
1588  -B or --ambiguous
1589    Don't include ambiguous characters in the password
1590  -h or --help
1591    Print a help message
1592  -H or --sha1=path/to/file[#seed]
1593    Use sha1 hash of given file as a (not so) random generator
1594  -C
1595    Print the generated passwords in columns
1596  -1
1597    Don't print the generated passwords in columns
1598  -v or --no-vowels
1599    Do not use any vowels so as to avoid accidental nasty words
1600
1601Example:
1602
1603$ pwgen 24 -y
1604
1605Pwgen will now give you a list of password with 24 digits using at least one special character.
1606
1607To test the strength of your passwords I recommend using Passfault. But: Since Passfaults' symmetric cypher is rather weak I advise not to use your real password. It is better to substitute each character by another similar one. So you can test the strength of the password without
1608transmitting it in an insecure way over the internet.
1609
1610If you have reason to assume that the machine you are using is compromised and has a keylogger installed you should generally only use virtual keyboards to submit critical data. They are built in to every OS afaik.
1611
1612Another thing you can do is use:
1613KeePass
1614
1615KeePass stores all kinds of password in an AES/Twofish encrypted database and is thus highly secure and a convenient way to manage your passwords.
1616
1617To install:
1618
1619$ sudo apt-get install keepass2
1620
1621A guide on how to use it can be found here.
1622Live-CDs and VM-Images that focus on security and anonymity
1623
1624Tails Linux The classic. Debian-based.
1625
1626Liberté Linux Similar to Tails. Gentoo-based.
1627
1628Privatix Live-System Debian-based.
1629
1630Tinhat Gentoo-based.
1631
1632Pentoo Gentoo-based. Hardened kernel.
1633
1634Janus VM - forces all network traffic through TOR
1635
1636
1637Further Info/Tools:
1638
1639TOR
1640I2P
1641Securing Debian Manual
1642Electronic Frontier Foundation
1643EFF's Surveillance Self-Defense Guide
1644Schneier on Security
1645Irongeek
1646SpywareWarrior
1647SecurityFocus
1648Wilders Security Forums
1649Insecure.org
1650CCC [en]
1651Eli the Computer Guy on Security
1652Digital Anti-Repression Workshop
1653The Hacker News
1654Anonymous on the Internets!
1655#! Privacy and Security Thread [Attention: There are some dubious addons listed! See my post there for further info.]
1656EFF's Panopticlick
1657GRC
1658Rapid7 UPnP Vulnerability Scan
1659HideMyAss! Web interface
1660Browserspy
1661ip-check.info
1662IP Lookup
1663BrowserLeaks
1664Whoer
1665evercookie
1666Sophos Virus DB
1667f-secure Virus DB
1668Offensive Security Exploit DB
1669Passfault
1670PwdHash
1671Qualys SSL Server Test
1672MyShadow
1673Security-in-a-Box
1674Calyx Institute
1675CryptoParty
1676Self-D0xing
1677Wepawet
1678German only:
1679
1680awxcnx
1681anondat
1682SemperVideo
1683SemperVideo [youtube]
1684Fefes Blog
1685heise
1686golem
1687CCC [de]
1688FoeBud
1689German Privacy Foundation
1690Postscript:
1691
1692If you find any error in this guide please don't hesitate to reply with an explanation. Also, if you have anything to add please also use the reply function. Since this is my first "real" post on the #! forums I don't know how long the edit-function is available for regular posts. Should it be usable indefinitely I will edit this original post to include all the additional information you will provide. This way we keep all the required info in one place. Thanks!
1693
1694...and keep sorcering!
1695
1696[Edit: Apparently I can edit the hell out of this post. wink So I will be constantly updating this guide in the future. I already scrambled together all the info I found noteworthy from the #! Privacy and Security Thread. So you should in theory find everything you need from there in this manual, too. But you know how personal opinions differ. So please raise your hand if you find I missed something.
1697
1698I will also work on migrating this guide into the #!-wiki in the future.]
1699
1700Moderator note, removed broken image link to ompldr.org - chillicampari 01/03/1014)
1701
1702Last edited by chillicampari (2014-01-07 06:25:09)
1703
1704The paranoid #! Security Guide
1705
1706sapere aude.