Author Topic: Presentation about Internet Security held during Let's Warp Cologne User Meeting  (Read 1149 times)

Sandra Asja Eickel

  • Newbie
  • *
  • Thank You
  • -Given: 0
  • -Receive: 0
  • Posts: 20
    • View Profile
German original version is part of https://www.os2.org/viewtopic.php?f=14&t=1524&start=50.
Translation done by copying text into https://www.deepl.com/translator.


There are no slides from my talk on internet security, as I showed some settings using the current FireFox on Ubuntu (the FF in the OS/2 VM had decided to do nothing but create 100% system load) and also addressed things beyond that.

Besides some settings of FireFox itself I recommended the following extensions:

HTTPS Everywhere from the Electronic Frontier Foundation (EFF.org)
https://www.eff.org/https-everywhere
This extension is used to encrypt as much traffic as possible - many pages integrate images or external sources via classic HTTP instead of the now normal HTTPS, and the extension of the Electronic Frontier Foundation also changes URLs entered to HTTPS if it is known that the page delivers the same content.
SeaMonkey on Windows can use the current version, we need to find out which of the releases on https://github.com/EFForg/https-everywhere/releases still work with our browsers.

uBlock Origin by Raymond Hill
https://github.com/gorhill/uBlock#ublock-origin
If you use other ad blockers, you should clean them out very quickly (compared to uBlock Origin, they are lame, memory-consuming junk), plus the part can do much more.
We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases, which also gets updates from time to time, but these have to be loaded manually.

NoScript by Giorgio Maone
http://noscript.net/
Since PrefBar no longer runs on newer FireFox to disable JavaScript, I switched to NoScript. This can allow JavaScript for single domains/hostnames temporarily or permanently. You can set up that the main page is automatically allowed to use JavaScript - I set this up for my mother, then most pages will work, only for some you have to allow additional hosts.
I use the stricter default setting myself and only allow temporarily - the only exception is the homepage of my QNAP TVS-873e. Basically a number of frequently used JavaScript suppliers are allowed by default.
SeaMonkey for Windows needs the Classic version 5.1.9 from https://noscript.net/getit, we need the 2.9.0.14 version.

By the way, the two extensions HTTPS Everywhere and NoScript are also part of the standard Tor browser based on the ESR versions of FireFox.


In the browser settings for the current FireFox, I have selected the custom setting in Privacy & Security, checked everything and prohibited all third party cookies, as well as all activity tracking in all windows. When you exit the browser, all cookies are deleted (and thus turned into session cookies, which leads to the need to log in to websites again). Turn off everything in permissions. I have allowed sending crash reports, but not the other things (for our older versions even crash reports don't make any sense).


I also reported about PiHole and Unbound, which was the subject of an article in the c't or Heise has appeared online. This software is available for Linux and Raspis.

PiHole works as a DNS server, and it should be configured so that the router uses it and reports it as DNS server to the clients. PiHole itself either queries the external DNS of provider/Google etc. or it is configured to use the DNSSEC-checking recursive resolver unbound, which will then quasi loop through from the root servers and only queries the DNS servers relevant for the name to be resolved.

PiHole itself is fed with several lists containing millions of names/addresses of known ad-, tracking- and malware servers. The queries to the garbage servers run into nothing (either via NXDOMAIN or via IP of the PiHole server, which returns empty documents on HTTP(S) requests), only the clean queries are forwarded to the configured DNS.
This gives you even more filtering than with uBlock Origin, which should be used on supported browsers anyway. Most importantly, you can use it to keep all those other devices and programs in check where you can't install such software.


There is an audio recording of the lecture in two parts, but it is not on my mobile phone ...

Kind regards
Sandra-Asja

Sandra Asja Eickel

  • Newbie
  • *
  • Thank You
  • -Given: 0
  • -Receive: 0
  • Posts: 20
    • View Profile
Fix for shortened uBlock Origin download link in part one: https://github.com/gorhill/uBlock-for-firefox-legacy/releases.
Part two, also translated via DeepL:


In addition, I have recommended to set the "plain text" view as default in mail programs and to switch to "simplified HTML" if necessary, never to "original HTML".

Secure, longer passwords with at least 12 random upper and lower case letters and digits should be used everywhere - and different ones everywhere - to avoid frequent password changes. Special characters, umlauts and possibly also Y and Z can cause problems if you have to enter them on a foreign language keyboard. Especially e-mail accounts need high quality passwords, because other passwords can be reset with them. It is helpful to use a password manager and additionally keep a printout on a piece of paper as an analog backup.

GnuPG should be trimmed for better key generation, since our version is quite old. The public key part should be made known, for example manually on the homepage or at a special place there, on a key server or by attaching it to your own mails during initial contacts (they should then also be signed).
EnigMail by Patrick Brunschwig https://www.enigmail.net/ can be installed in SeaMonkey or ThunderBird as an extension, in SeaMonkey 2.49.5 for WIndows in version 2.0.9, we might need older ones.

The OSI layer 8 in front of the screen should also be trimmed for security, otherwise it won't help much.

As it looks like you have to build the older versions of HTTPS Everywhere from the sources yourself, so it is even more complex than expected ...

Just tried it again:
For the releases you can go through the tags, but there you only get the sources. But the finished XPIs still exist - the attempt to list https://www.eff.org/files/ only results in a "Hello world!", but you can take the download link of the currently offered version and just adjust the tags and then use wget. For FireFox 38.8.0, the latest version to be downloaded is 5.2.21 https://www.eff.org/files/https-everywhere-5.2.21-eff.xpi.

Sandra-Asja

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 11
  • -Receive: 181
  • Posts: 2489
    • View Profile
Thanks Sandra for the security run down.
I'm using ublock origin 1.13.8 and noscript 5.19 with the 45ESR codebase, NoScript needs an older version for 38ESR.
EnigMail used to need a DLL and then they moved to using CTYPES to call system libraries from JavaScript. Last time I visited it, I had no luck getting it to work.

Sandra Asja Eickel

  • Newbie
  • *
  • Thank You
  • -Given: 0
  • -Receive: 0
  • Posts: 20
    • View Profile
The current version of uBlock Origin Legacy is 1.16.4.18. Get it from https://github.com/gorhill/uBlock-for-firefox-legacy/releases. Since .17 auto updating of this extension works - just tested (the other two are unlikely to see any compatible updates, perhaps there will be one for NoScript in the version 5 branch for users of FF45ESR). Don't forget to update the filter lists with uBlock Origin's dashboard from time to time.

I think we should provide this set of compatible browser extensions with ArcaOS in a convenient way.
For the future QT/Chromium based falcon browser current versions of there extensions can be used.

Greetings,
Sandra-Asja

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 11
  • -Receive: 181
  • Posts: 2489
    • View Profile
Another consideration is a hosts file to direct ads to NUL: instead of loading them. Much malware comes from ads which usually are hosted on systems other then the one your visiting.
There's a few hosts files around, I'm currently using the one from Steven Black, https://github.com/StevenBlack/hosts/releases.
Download the zip file, unzip and after backing up your current hosts file and reviewing for personification, usually 127.0.0.1 with your machine name copy the new hosts file to x:\mptn\etc (x:\tcpip\etc on Warp V3).
As for Falkon, it doesn't seem to have many extensions yet, mostly an ad blocker last I looked though they are supposed to be working on allowing it to use WebExtensions.

ivan

  • Hero Member
  • *****
  • Thank You
  • -Given: 2
  • -Receive: 42
  • Posts: 1157
    • View Profile
Hi Sandra,

It is nice to see someone in the industry actually telling others to be aware of computer security.  Thank you.

Although I am now retired I still get asked about problems when someone clicks on an email link or opens an attachment and things go wrong.  I have always used PMMAIL as my email client and if people can't send me text emails then I don't read them, it definitely cuts down on the spam.

For myself I use Adblock Plus and  NoScript in firefox on OS/2, Linux Mint, ZorinOS and my Android tablets, they should also be on firefox on my phone but I use that so infrequently I'm not sure as the latest update might have changed things.

Mathias

  • Full Member
  • ***
  • Thank You
  • -Given: 25
  • -Receive: 9
  • Posts: 158
  • using ArcaOS
    • View Profile
    • IRC
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae

Joop

  • Hero Member
  • *****
  • Thank You
  • -Given: 0
  • -Receive: 60
  • Posts: 551
    • View Profile
NoScript by Giorgio Maone
http://noscript.net/
Since PrefBar no longer runs on newer FireFox to disable JavaScript, I switched to NoScript. This can allow JavaScript for single domains/hostnames temporarily or permanently. You can set up that the main page is automatically allowed to use JavaScript - I set this up for my mother, then most pages will work, only for some you have to allow additional hosts.
I use the stricter default setting myself and only allow temporarily - the only exception is the homepage of my QNAP TVS-873e. Basically a number of frequently used JavaScript suppliers are allowed by default.
SeaMonkey for Windows needs the Classic version 5.1.9 from https://noscript.net/getit, we need the 2.9.0.14 version.
Thank you for your information about security. I do understand what you write, but if rule out JavaScript then a lot of pages won't work right. I use JavaScript in order to help the visitor through "databases" or with pictures. When you switch JavaScript off it won't show that easy. I tried without JavaScript, but that didn't worked.

Now your posts. Switch off your picture, take something NOT personal.

Regards,
Joop

Joop

  • Hero Member
  • *****
  • Thank You
  • -Given: 0
  • -Receive: 60
  • Posts: 551
    • View Profile
We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases, which also gets updates from time to time, but these have to be loaded manually.
I get a 404 on that address.

Hakuchi

  • Jr. Member
  • **
  • Thank You
  • -Given: 24
  • -Receive: 3
  • Posts: 53
    • View Profile
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae

Yeah! I stopped to use that some time ago ... nothing that has something remotely like that is no-no.
//
白痴

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 11
  • -Receive: 181
  • Posts: 2489
    • View Profile
Adblock Plus also whitelists ads for money, which by itself isn't so bad but they weren't upfront about it or the data collection. The consensus on the internet seems to be that ublock origin is the best ad blocker.
As for JavaScript, the idea with NoScript is that you only allow trusted scripts to run. Generally the ones that originate from the same site. It can be tricky and sometimes out of frustration you might temporarily allow most scripts to run except those that you have blacklisted. Most sites don't need Facebook or most Google scripts running to work right.

Hakuchi

  • Jr. Member
  • **
  • Thank You
  • -Given: 24
  • -Receive: 3
  • Posts: 53
    • View Profile
Using NoScript is a bit encumbering at first, but by the time one gets those settings as they should be for the daily cruising ... until they make yet another layer of B$cripts that renders one site unusable until those settings are in place again. But mostly it's not that much bother for normal daily use, since we tend to go through only few sites anyway ..

But not exactly your average joe's thing to go by ... Privacy Badger would be my recommendation for non tech savvy person for daily browsing privacy.
//
白痴

Sandra Asja Eickel

  • Newbie
  • *
  • Thank You
  • -Given: 0
  • -Receive: 0
  • Posts: 20
    • View Profile
Hi Sandra,

It is nice to see someone in the industry actually telling others to be aware of computer security.  Thank you.

Although I am now retired I still get asked about problems when someone clicks on an email link or opens an attachment and things go wrong.  I have always used PMMAIL as my email client and if people can't send me text emails then I don't read them, it definitely cuts down on the spam.

Nearly all OS/2 users use computers since decades, but quoting Roderick "many OS/2 users live in caves" ...

There are even new OS/2 users - at our meeting in Cologne (30.11.2019) someone popped up who had just rescued an old IBM ThinkPad from going into trash and we helped him to get OS/2 installed.

Nowadays, you can get computers in every super market somewhere between bread and butter - but even if you go to a computer retail store and order a PC together with a printer there, the best you can hope for is a system which is up to date, not filled with bloatware and has drivers for your printer installed ...

Real configuration or education? Forget about that - and in the rare cases, where it is offered, it's deemed too expensive by the buyer ...

For driving cars, you'll need a driving license. For computers, with whom you can cause accidents all over the world and that simultaneously, a corresponding driving license should be a requirement, too.

For myself I use Adblock Plus and  NoScript in firefox on OS/2, Linux Mint, ZorinOS and my Android tablets, they should also be on firefox on my phone but I use that so infrequently I'm not sure as the latest update might have changed things.

Years ago, I found a comparision between Adblock and uBlock where uBlock was way faster and used significantly less memory - I switched and never looked back.

Greetings,
Sandra-Asja

Sandra Asja Eickel

  • Newbie
  • *
  • Thank You
  • -Given: 0
  • -Receive: 0
  • Posts: 20
    • View Profile
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae

I'm logged in, but trying to go to ticked 2397 just gives an "Access Denied."

Sandra Asja Eickel

  • Newbie
  • *
  • Thank You
  • -Given: 0
  • -Receive: 0
  • Posts: 20
    • View Profile
Now your posts. Switch off your picture, take something NOT personal.

???


We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases, which also gets updates from time to time, but these have to be loaded manually.
I get a 404 on that address.

That visible link was shortened by OS2.org and I used that to re-create the links here ... I included a working link at the top of the second part.

Greetings,
Sandra-Asja
« Last Edit: February 23, 2020, 09:51:40 pm by Sandra Asja Eickel »