Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - Sandra Asja Eickel

Pages: [1]
1
German original version is part of https://www.os2.org/viewtopic.php?f=14&t=1524&start=50.
Translation done by copying text into https://www.deepl.com/translator.


There are no slides from my talk on internet security, as I showed some settings using the current FireFox on Ubuntu (the FF in the OS/2 VM had decided to do nothing but create 100% system load) and also addressed things beyond that.

Besides some settings of FireFox itself I recommended the following extensions:

HTTPS Everywhere from the Electronic Frontier Foundation (EFF.org)
https://www.eff.org/https-everywhere
This extension is used to encrypt as much traffic as possible - many pages integrate images or external sources via classic HTTP instead of the now normal HTTPS, and the extension of the Electronic Frontier Foundation also changes URLs entered to HTTPS if it is known that the page delivers the same content.
SeaMonkey on Windows can use the current version, we need to find out which of the releases on https://github.com/EFForg/https-everywhere/releases still work with our browsers.

uBlock Origin by Raymond Hill
https://github.com/gorhill/uBlock#ublock-origin
If you use other ad blockers, you should clean them out very quickly (compared to uBlock Origin, they are lame, memory-consuming junk), plus the part can do much more.
We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases, which also gets updates from time to time, but these have to be loaded manually.

NoScript by Giorgio Maone
http://noscript.net/
Since PrefBar no longer runs on newer FireFox to disable JavaScript, I switched to NoScript. This can allow JavaScript for single domains/hostnames temporarily or permanently. You can set up that the main page is automatically allowed to use JavaScript - I set this up for my mother, then most pages will work, only for some you have to allow additional hosts.
I use the stricter default setting myself and only allow temporarily - the only exception is the homepage of my QNAP TVS-873e. Basically a number of frequently used JavaScript suppliers are allowed by default.
SeaMonkey for Windows needs the Classic version 5.1.9 from https://noscript.net/getit, we need the 2.9.0.14 version.

By the way, the two extensions HTTPS Everywhere and NoScript are also part of the standard Tor browser based on the ESR versions of FireFox.


In the browser settings for the current FireFox, I have selected the custom setting in Privacy & Security, checked everything and prohibited all third party cookies, as well as all activity tracking in all windows. When you exit the browser, all cookies are deleted (and thus turned into session cookies, which leads to the need to log in to websites again). Turn off everything in permissions. I have allowed sending crash reports, but not the other things (for our older versions even crash reports don't make any sense).


I also reported about PiHole and Unbound, which was the subject of an article in the c't or Heise has appeared online. This software is available for Linux and Raspis.

PiHole works as a DNS server, and it should be configured so that the router uses it and reports it as DNS server to the clients. PiHole itself either queries the external DNS of provider/Google etc. or it is configured to use the DNSSEC-checking recursive resolver unbound, which will then quasi loop through from the root servers and only queries the DNS servers relevant for the name to be resolved.

PiHole itself is fed with several lists containing millions of names/addresses of known ad-, tracking- and malware servers. The queries to the garbage servers run into nothing (either via NXDOMAIN or via IP of the PiHole server, which returns empty documents on HTTP(S) requests), only the clean queries are forwarded to the configured DNS.
This gives you even more filtering than with uBlock Origin, which should be used on supported browsers anyway. Most importantly, you can use it to keep all those other devices and programs in check where you can't install such software.


There is an audio recording of the lecture in two parts, but it is not on my mobile phone ...

Kind regards
Sandra-Asja

Pages: [1]