OS/2, eCS & ArcaOS - Technical > Web applications

Presentation about Internet Security held during Let's Warp Cologne User Meeting

(1/4) > >>

Sandra Asja Eickel:
German original version is part of https://www.os2.org/viewtopic.php?f=14&t=1524&start=50.
Translation done by copying text into https://www.deepl.com/translator.

There are no slides from my talk on internet security, as I showed some settings using the current FireFox on Ubuntu (the FF in the OS/2 VM had decided to do nothing but create 100% system load) and also addressed things beyond that.

Besides some settings of FireFox itself I recommended the following extensions:

HTTPS Everywhere from the Electronic Frontier Foundation (EFF.org)
This extension is used to encrypt as much traffic as possible - many pages integrate images or external sources via classic HTTP instead of the now normal HTTPS, and the extension of the Electronic Frontier Foundation also changes URLs entered to HTTPS if it is known that the page delivers the same content.
SeaMonkey on Windows can use the current version, we need to find out which of the releases on https://github.com/EFForg/https-everywhere/releases still work with our browsers.

uBlock Origin by Raymond Hill
If you use other ad blockers, you should clean them out very quickly (compared to uBlock Origin, they are lame, memory-consuming junk), plus the part can do much more.
We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases, which also gets updates from time to time, but these have to be loaded manually.

NoScript by Giorgio Maone
Since PrefBar no longer runs on newer FireFox to disable JavaScript, I switched to NoScript. This can allow JavaScript for single domains/hostnames temporarily or permanently. You can set up that the main page is automatically allowed to use JavaScript - I set this up for my mother, then most pages will work, only for some you have to allow additional hosts.
I use the stricter default setting myself and only allow temporarily - the only exception is the homepage of my QNAP TVS-873e. Basically a number of frequently used JavaScript suppliers are allowed by default.
SeaMonkey for Windows needs the Classic version 5.1.9 from https://noscript.net/getit, we need the version.

By the way, the two extensions HTTPS Everywhere and NoScript are also part of the standard Tor browser based on the ESR versions of FireFox.

In the browser settings for the current FireFox, I have selected the custom setting in Privacy & Security, checked everything and prohibited all third party cookies, as well as all activity tracking in all windows. When you exit the browser, all cookies are deleted (and thus turned into session cookies, which leads to the need to log in to websites again). Turn off everything in permissions. I have allowed sending crash reports, but not the other things (for our older versions even crash reports don't make any sense).

I also reported about PiHole and Unbound, which was the subject of an article in the c't or Heise has appeared online. This software is available for Linux and Raspis.

PiHole works as a DNS server, and it should be configured so that the router uses it and reports it as DNS server to the clients. PiHole itself either queries the external DNS of provider/Google etc. or it is configured to use the DNSSEC-checking recursive resolver unbound, which will then quasi loop through from the root servers and only queries the DNS servers relevant for the name to be resolved.

PiHole itself is fed with several lists containing millions of names/addresses of known ad-, tracking- and malware servers. The queries to the garbage servers run into nothing (either via NXDOMAIN or via IP of the PiHole server, which returns empty documents on HTTP(S) requests), only the clean queries are forwarded to the configured DNS.
This gives you even more filtering than with uBlock Origin, which should be used on supported browsers anyway. Most importantly, you can use it to keep all those other devices and programs in check where you can't install such software.

There is an audio recording of the lecture in two parts, but it is not on my mobile phone ...

Kind regards

Sandra Asja Eickel:
Fix for shortened uBlock Origin download link in part one: https://github.com/gorhill/uBlock-for-firefox-legacy/releases.
Part two, also translated via DeepL:

In addition, I have recommended to set the "plain text" view as default in mail programs and to switch to "simplified HTML" if necessary, never to "original HTML".

Secure, longer passwords with at least 12 random upper and lower case letters and digits should be used everywhere - and different ones everywhere - to avoid frequent password changes. Special characters, umlauts and possibly also Y and Z can cause problems if you have to enter them on a foreign language keyboard. Especially e-mail accounts need high quality passwords, because other passwords can be reset with them. It is helpful to use a password manager and additionally keep a printout on a piece of paper as an analog backup.

GnuPG should be trimmed for better key generation, since our version is quite old. The public key part should be made known, for example manually on the homepage or at a special place there, on a key server or by attaching it to your own mails during initial contacts (they should then also be signed).
EnigMail by Patrick Brunschwig https://www.enigmail.net/ can be installed in SeaMonkey or ThunderBird as an extension, in SeaMonkey 2.49.5 for WIndows in version 2.0.9, we might need older ones.

The OSI layer 8 in front of the screen should also be trimmed for security, otherwise it won't help much.

As it looks like you have to build the older versions of HTTPS Everywhere from the sources yourself, so it is even more complex than expected ...

Just tried it again:
For the releases you can go through the tags, but there you only get the sources. But the finished XPIs still exist - the attempt to list https://www.eff.org/files/ only results in a "Hello world!", but you can take the download link of the currently offered version and just adjust the tags and then use wget. For FireFox 38.8.0, the latest version to be downloaded is 5.2.21 https://www.eff.org/files/https-everywhere-5.2.21-eff.xpi.


Dave Yeo:
Thanks Sandra for the security run down.
I'm using ublock origin 1.13.8 and noscript 5.19 with the 45ESR codebase, NoScript needs an older version for 38ESR.
EnigMail used to need a DLL and then they moved to using CTYPES to call system libraries from JavaScript. Last time I visited it, I had no luck getting it to work.

Sandra Asja Eickel:
The current version of uBlock Origin Legacy is Get it from https://github.com/gorhill/uBlock-for-firefox-legacy/releases. Since .17 auto updating of this extension works - just tested (the other two are unlikely to see any compatible updates, perhaps there will be one for NoScript in the version 5 branch for users of FF45ESR). Don't forget to update the filter lists with uBlock Origin's dashboard from time to time.

I think we should provide this set of compatible browser extensions with ArcaOS in a convenient way.
For the future QT/Chromium based falcon browser current versions of there extensions can be used.


Dave Yeo:
Another consideration is a hosts file to direct ads to NUL: instead of loading them. Much malware comes from ads which usually are hosted on systems other then the one your visiting.
There's a few hosts files around, I'm currently using the one from Steven Black, https://github.com/StevenBlack/hosts/releases.
Download the zip file, unzip and after backing up your current hosts file and reviewing for personification, usually with your machine name copy the new hosts file to x:\mptn\etc (x:\tcpip\etc on Warp V3).
As for Falkon, it doesn't seem to have many extensions yet, mostly an ad blocker last I looked though they are supposed to be working on allowing it to use WebExtensions.


[0] Message Index

[#] Next page

Go to full version