Computer security

From BoyWiki
(Redirected from Browser security)
Jump to: navigation, search

The term computer security for boylovers normally refers to preventing hostile operatives from tracing your Internet activities back to you. You need to make sure that your computer, if stolen or lost, does not reveal anything linking you to any boylove activities, even if activism is legal. That still means the risk of losing your job, friends, and family, and being physically attacked.

Although one hundred per cent security is impossible, you can make it more difficult for hackers and authorities to trace you, so they'll go bother somebody else. It is like installing an alarm system in your house - it guarantees nothing, but it makes breaking in burdensome, so the would-be burglar goes to a house with no alarm. Security is a function of the resources your adversary is willing to commit, said Julian Sanchez, a policy expert with the Cato Institute in Washington, D.C.[1]

Because terrorists are perceived as a bigger danger than boylovers, the bulk of the computing power available in the world (always finite) is focused on them.

Internet security

The Internet was originally built with no security, as it came out of a military environment in which all participants were known and trusted [2]. Privacy and security is continuously grafted onto the platform as it grows and expands into new fields that their creators never designed it for. With complexity it increases the chances of a vulnerability being exploited for nefarious purposes, Internet Security is a game of a whack a mole, you should never lower your guard.

There are technological advances every single day, if you care about computer security, you must read about technology and security news as often as you can to update your knowledge, what is safe today might change tomorrow, by being up to date on technological advances you can plan for the future, for example, by picking a strong encryption algorithm that will be safe for the next twenty years.

Web browsers

A Web browser is a program that runs on your computer/smartphone/tablet and is used to access the Internet. It has the function, among others, of decoding the data received — most of it strings of characters are meaningless if not processed — and transforming them into a meaningful form to a human while displaying it optimally on your computer/smartphone/tablet. Chrome, Firefox, Microsoft Edge and Apple's Safari are some example of Internet browsers.

When your browser sends a request for a page to a web server, it goes first to your Internet Service Provider (in some countries a government agency), which records it and sends it on its way on the Internet. Together with the name/address of the page desired, the request includes information about you. Most important is your IP (Internet protocol) address, a string of numbers that identifies the requesting computer, so that the desired data can be sent to it. It also includes the browser and operating system used, and sometimes the hardware used.

IP Address

Every device connected to the Internet is identified by a unique number known as an IP address, IP stands for Internet Protocol, an IPv4 address number is made up of 32 bits and takes the form n.n.n.n, IPv4 address example: 127.1.67.235. To cope with Internet growth, due to IPv4 addresses running out, a new Internet Protocol Version called IPv6 was developed, they are made up of 128 bits and represented as eight groups of four hexadecimal digits with the groups being separated by colons, IPv6 address example: 3ffe:1900:4545:3:200:f8ff:fe21:67cf

Both protocols IPv4 and IPv6 are interoperable, the numbers may be different each time you connect but your Internet Service Provider assigns these numbers, they know the history of each IP address, they can provide law enforcement with the name and address of the subscriber that has been assigned a particular IP address.

Internet Service Providers have the capacity of logging each page a user visits and blocking access to them, in some countries this is a reality. In the United Kingdom the Investigatory Powers Bill forces Internet Service Providers to keep web records of users for 12 months. [3]

In the United States, if national security is at stake, National Security Letters, authorised by Congress can be used by federal agencies. They require Internet Service Providers to release to all data they have about any user, furthermore, the Internet Service Provider is prohibited from informing you that a request for information about you has been received. Given the recent history of misconduct by the FBI and similar agencies, it would be naive to assume that all of these warrantless, secret searches are for legitimate national security purposes. It is well documented that if evidence of any illegal activity is found in the data gathered using a National Security Letter, even if it has no relevance to national security, that data can be and is legally used to bring criminal charges.

In addition to your ISP, Web sites routinely log the IP address of every visitor, together with the browser they are using and operating system. This information may also be retained indefinitely. While a subpoena is usually necessary for law enforcement to obtain access in the United States, a subpoena may entail little more for the requesting agency than filling out an online form. In many countries law enforcement has total access to servers within its borders. [4]

To secure your web browsing and stop Internet Service Providers from logging, spying and censoring your Internet activities, you can use a VPN or Tor.

Virtual Private Networks (VPNs)

A Virtual Private Network creates an encrypted tunnel and connects you to a proxy server that will receive your data request for an Internet page or download and forward it using the VPN server IP address instead of yours, because of the encryption, your Internet Service Provider will not be able to see what you are doing on the Internet or intercept your communications, only the VPN provider will be able to do that, many claim they keep no logs, or keep them very briefly but such claims must be treated with caution as you have no way to verify it.

A VPN provider located in a foreign country, simply because of the hassle of dealing with an agency of another country, can provide more protection than a domestic one. The client software running on your computer/smartphone or tablet will encrypt your request for a Web page, so even if your data is being monitored, all the monitor can tell is that a certain IP address (you) sent a request to a VPN, but the URL of the page that you requested is not visible. Another use of a VPN is being able to access websites that are georestricted, for example watching CBS online outside the USA.

In most Western countries using a VPN is completely legal and there are many legitimate purposes to use one, like wanting to secure your Internet activities on a Wifi access point or a business looking for secure access to a stock market account.

The Onion Router Tor is a chain of proxy servers located in multiple countries and it is far more secure than a VPN, however speed is slower.

What information does your browser store?

Most web browsers store a great deal of information every time you visit a web page; law enforcement accesses it by running the program Browser Postmortem. This storage is intended to make it easier for you to later find and reload already visited Web pages. What information is stored, how and where, depends on which browser you use, which version you have, on what platform or operating system you are running it, and your personal security settings. Some of the items a browser may record are:

  1. All web page addresses (URLs) you entered into your browser's address bar. This is found in your browser's History.
  2. The page itself in your cache.
  3. Any embedded elements, such as graphics or scripts, saved separately in your cache.
  4. Cookies.
  5. Search history (terms searched for by search engines).

Address Bar and History

Both the browser history and address-bar list make it easier to access recently-visited sites by storing the addresses of any site you visit. These effectively leaves a trail for others with access to your computer to find and follow your activity on the Internet. Anyone else who uses or has access to your browser can easily look at your recent internet activity.

All major browsers have a menu command to delete the history; but this is no protection and can be easily recovered with specialist software by law enforcement or computer technicians. There are programs like Bleachbit that will securely overwrite temporary files so that recovery it is not possible but wiping software is not 100% perfect, the only way to be sure that no data will ever be recovered from your computer is to encrypt the whole hard drive or use a live DVD to browse the Internet, for example Tails.

The Browser Cache

The browser cache is designed to make loading frequently-accessed pages quicker. Downloading a page from the internet takes time, so the cache is designed to store entire pages from sites which you visit. Some browsers create a single cache file, while others may store embedded elements such as images, style-sheets or scripts separately. When you type an address into your browser it will check with the server to see if the page has been modified since last accessed and if there are no changes it will draw the page from the cache rather than from the server.

The browser cache is a record of the sites you have visited and can easily be accessed by others. Major browsers have a menu selection to erase the cache. However it does not securely erase the data is still recoverable with specialist undelete software. A medium security solution is to deploy secure erasing software like CCleaner, or browse the Internet in incognito mode, it considerably reduces the information available in your hard drive but not all of it if your opponent has high IT skills he might still be able to recover small bits of information.

Cookies

Cookies are small files used to by web sites to either store settings or track what you do online. They are sent to your computer and stored by your browser when you visit a site. Cookies are necessary for innocent purposes such as automating log-in and storing preferences, and providing targeted advertising, but they too leave their footprints for others to follow. If someone can look at what cookies you have stored in your Internet browser they can find out what websites you visited and the associated usernames.

Inside your Internet browser settings you can manually erase cookies but this will not be done safely unless they are overwritten with specialist Internet privacy software that stops computer forensic tools from unerasing them.

"Private" or "Incognito" mode

Modern browsers often have what is called Private Browsing (Firefox) or Incognito Mode (Chrome), when activated, no browsing history, cookies or cache are kept. Once all tabs are closed, all session information is discarded. However, it does not conceal from your Internet Service Provider, workplace, library or Internet cafe which pages you visited and it will not stop other applications in your computer. like a keylogger, from monitoring what you are browsing, if you have downloaded a file in Incognito mode, this file will remain in your hard drive. [5]

Windows 10

  • Microsof account: Microsoft Windows 10 operating system attempts to convince users to sign up for a Microsoft account, signing into Windows 10 with your Microsoft account will immediately sync settings and data to the company’s servers, the data contains your Internet browsing history, passwords and settings saved. [6] to avoid this use a local Windows 10 account instead of a Microsoft cloud account.
  • OneDrive: When you upload files to OneDrive they are automatically scanned to detect child pornography, [7] the main problem with this is approach is that Microsoft treats everybody like a suspected criminal and child pornographer without being one, it is like having to submit yourself to a search without any evidence of any wrongdoing and without any warrant, by agreeing to using OneDrive, you are waving your privacy rights, the same for Dropbox and other cloud services. If you care about not being treated like a suspected criminal, uninstall OneDrive from Windows 10.
  • Cortana: Microsoft speech assistant is turned on by default, it collects and analyses speech data like your name, contacts and calendar events, they are all saved on Microsoft servers. You can not uninstall Cortana from Windows 10 but you can turn it off in settings and you should do that if you are privacy conscious.

Smartphones and tablets

iPhone/iPad

The latest Apple's iOS operating system, used on the iPhone and iPad, encrypts all information on the device. A user-chosen 4 digit (6 digit for iOS 9) passcode [8] must be created when the phone is first used, and it must be entered each time the device restarts (after complete shutdown). The passcode is also required when a screen lock activates after a certain (adjustable) period of inactivity; this feature is on by default, though it can be turned off.

Finding a 6 number passcode by what cryptographers call the "brute force" method (trying all 999999 possible codes) is almost impossible, because the iPhone only permits 10 attempts to enter the code. After that the phone is frozen, and a setting, not enabled by default in older models, will cause all data on the phone to be erased after 10 unsuccessful attempts.

The encryption on the iPhone has never been defeated by either thieves or law enforcement. Police and similar agencies have hundreds of seized iPhones, which cannot be accessed without the passcode. Apple itself cannot break the encryption.

All of the data on the iPhone is backed up onto servers operated by Apple, iCloud, easily accessed by law enforcement because Apple hold the decryption key for iCloud, but this backup can be turned off by the user. If this is done, the only way to access the data on your iPhone will be with your password, however, in some countries like the United Kingdom, the law forces you to hand over your decryption keys if law enforcement requests it. [9], but in other countries like the United States, you can plead the Constitution Fifth Amendment right not to self-incriminate and refuse handing over the password to your iPhone. [10].

There has been cases in the US where people using Touch ID, fingerprints, and Face ID to lock the iPhone have been forced to unlock it for law enforcement, this is contested area, some judges have ruled that forcing somebody to unlock a phone with his fingerprint does not violate the Fifth Amendment[11] and other judges have said that this is a violation of their right not to self-incriminate. If you are want top privacy use only a passphrase to lock your iPhone and do not rely on fingerprints or Face ID.

Android

See also

References

  1. "Beat the FBI: How to Send Anonymous Email Without Getting Caught", by Ben Weitzenkorn,http://www.tomsguide.com/us/-anonymous-email-how-to,news-17511.html
  2. Wikipedia: History of the Internet https://en.wikipedia.org/wiki/History_of_the_Internet
  3. Investigatory Powers Bill UK https://www.wired.co.uk/article/ip-bill-law-details-passed
  4. Russia demands access to VPN providers’ servers https://www.networkworld.com/article/3385050/russia-demands-access-to-vpn-providers-servers.html
  5. Myths about private browsing: https://support.mozilla.org/en-US/kb/common-myths-about-private-browsing
  6. 5 privacy settings you should change in Windows 10 https://www.cnet.com/how-to/5-privacy-settings-to-change-in-windows-10/
  7. Microsoft tip leads to child porn arrest in Pennsylvania https://www.bbc.com/news/technology-28682686
  8. How to encrypt your iPhone: https://ssd.eff.org/en/module/how-encrypt-your-iphone
  9. UK police can now force you to reveal decryption keys: https://www.theregister.co.uk/2007/10/03/ripa-decryption_keys_power/
  10. Forcing Someone to Unlock and Decrypt Their Phone Violates the Constitution https://www.eff.org/deeplinks/2017/03/eff-court-forcing-someone-unlock-and-decrypt-their-phone-violates-constitution
  11. Police Can Force You to Use Your Fingerprint to Unlock Your Phone: https://www.theatlantic.com/technology/archive/2016/05/iphone-fingerprint-search-warrant/480861/

External links