OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Web applications => Topic started by: Sandra Asja Eickel on February 23, 2020, 12:40:21 am

Title: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 12:40:21 am
German original version is part of https://www.os2.org/viewtopic.php?f=14&t=1524&start=50 (https://www.os2.org/viewtopic.php?f=14&t=1524&start=50).
Translation done by copying text into https://www.deepl.com/translator (https://www.deepl.com/translator).


There are no slides from my talk on internet security, as I showed some settings using the current FireFox on Ubuntu (the FF in the OS/2 VM had decided to do nothing but create 100% system load) and also addressed things beyond that.

Besides some settings of FireFox itself I recommended the following extensions:

HTTPS Everywhere from the Electronic Frontier Foundation (EFF.org)
https://www.eff.org/https-everywhere (https://www.eff.org/https-everywhere)
This extension is used to encrypt as much traffic as possible - many pages integrate images or external sources via classic HTTP instead of the now normal HTTPS, and the extension of the Electronic Frontier Foundation also changes URLs entered to HTTPS if it is known that the page delivers the same content.
SeaMonkey on Windows can use the current version, we need to find out which of the releases on https://github.com/EFForg/https-everywhere/releases (https://github.com/EFForg/https-everywhere/releases) still work with our browsers.

uBlock Origin by Raymond Hill
https://github.com/gorhill/uBlock#ublock-origin (https://github.com/gorhill/uBlock#ublock-origin)
If you use other ad blockers, you should clean them out very quickly (compared to uBlock Origin, they are lame, memory-consuming junk), plus the part can do much more.
We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases (https://github.com/gorhill/uBlock-for-f ... y/releases), which also gets updates from time to time, but these have to be loaded manually.

NoScript by Giorgio Maone
http://noscript.net/ (http://noscript.net/)
Since PrefBar no longer runs on newer FireFox to disable JavaScript, I switched to NoScript. This can allow JavaScript for single domains/hostnames temporarily or permanently. You can set up that the main page is automatically allowed to use JavaScript - I set this up for my mother, then most pages will work, only for some you have to allow additional hosts.
I use the stricter default setting myself and only allow temporarily - the only exception is the homepage of my QNAP TVS-873e. Basically a number of frequently used JavaScript suppliers are allowed by default.
SeaMonkey for Windows needs the Classic version 5.1.9 from https://noscript.net/getit (https://noscript.net/getit), we need the 2.9.0.14 version.

By the way, the two extensions HTTPS Everywhere and NoScript are also part of the standard Tor browser based on the ESR versions of FireFox.


In the browser settings for the current FireFox, I have selected the custom setting in Privacy & Security, checked everything and prohibited all third party cookies, as well as all activity tracking in all windows. When you exit the browser, all cookies are deleted (and thus turned into session cookies, which leads to the need to log in to websites again). Turn off everything in permissions. I have allowed sending crash reports, but not the other things (for our older versions even crash reports don't make any sense).


I also reported about PiHole and Unbound, which was the subject of an article in the c't or Heise has appeared online. This software is available for Linux and Raspis.

PiHole works as a DNS server, and it should be configured so that the router uses it and reports it as DNS server to the clients. PiHole itself either queries the external DNS of provider/Google etc. or it is configured to use the DNSSEC-checking recursive resolver unbound, which will then quasi loop through from the root servers and only queries the DNS servers relevant for the name to be resolved.

PiHole itself is fed with several lists containing millions of names/addresses of known ad-, tracking- and malware servers. The queries to the garbage servers run into nothing (either via NXDOMAIN or via IP of the PiHole server, which returns empty documents on HTTP(S) requests), only the clean queries are forwarded to the configured DNS.
This gives you even more filtering than with uBlock Origin, which should be used on supported browsers anyway. Most importantly, you can use it to keep all those other devices and programs in check where you can't install such software.


There is an audio recording of the lecture in two parts, but it is not on my mobile phone ...

Kind regards
Sandra-Asja
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 12:50:36 am
Fix for shortened uBlock Origin download link in part one: https://github.com/gorhill/uBlock-for-firefox-legacy/releases (https://github.com/gorhill/uBlock-for-firefox-legacy/releases).
Part two, also translated via DeepL:


In addition, I have recommended to set the "plain text" view as default in mail programs and to switch to "simplified HTML" if necessary, never to "original HTML".

Secure, longer passwords with at least 12 random upper and lower case letters and digits should be used everywhere - and different ones everywhere - to avoid frequent password changes. Special characters, umlauts and possibly also Y and Z can cause problems if you have to enter them on a foreign language keyboard. Especially e-mail accounts need high quality passwords, because other passwords can be reset with them. It is helpful to use a password manager and additionally keep a printout on a piece of paper as an analog backup.

GnuPG should be trimmed for better key generation, since our version is quite old. The public key part should be made known, for example manually on the homepage or at a special place there, on a key server or by attaching it to your own mails during initial contacts (they should then also be signed).
EnigMail by Patrick Brunschwig https://www.enigmail.net/ (https://www.enigmail.net/) can be installed in SeaMonkey or ThunderBird as an extension, in SeaMonkey 2.49.5 for WIndows in version 2.0.9, we might need older ones.

The OSI layer 8 in front of the screen should also be trimmed for security, otherwise it won't help much.

As it looks like you have to build the older versions of HTTPS Everywhere from the sources yourself, so it is even more complex than expected ...

Just tried it again:
For the releases you can go through the tags, but there you only get the sources. But the finished XPIs still exist - the attempt to list https://www.eff.org/files/ (https://www.eff.org/files/) only results in a "Hello world!", but you can take the download link of the currently offered version and just adjust the tags and then use wget. For FireFox 38.8.0, the latest version to be downloaded is 5.2.21 https://www.eff.org/files/https-everywhere-5.2.21-eff.xpi (https://www.eff.org/files/https-everywhere-5.2.21-eff.xpi).

Sandra-Asja
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Dave Yeo on February 23, 2020, 01:32:22 am
Thanks Sandra for the security run down.
I'm using ublock origin 1.13.8 and noscript 5.19 with the 45ESR codebase, NoScript needs an older version for 38ESR.
EnigMail used to need a DLL and then they moved to using CTYPES to call system libraries from JavaScript. Last time I visited it, I had no luck getting it to work.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 02:05:45 am
The current version of uBlock Origin Legacy is 1.16.4.18. Get it from https://github.com/gorhill/uBlock-for-firefox-legacy/releases (https://github.com/gorhill/uBlock-for-firefox-legacy/releases). Since .17 auto updating of this extension works - just tested (the other two are unlikely to see any compatible updates, perhaps there will be one for NoScript in the version 5 branch for users of FF45ESR). Don't forget to update the filter lists with uBlock Origin's dashboard from time to time.

I think we should provide this set of compatible browser extensions with ArcaOS in a convenient way.
For the future QT/Chromium based falcon browser current versions of there extensions can be used.

Greetings,
Sandra-Asja
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Dave Yeo on February 23, 2020, 03:59:49 am
Another consideration is a hosts file to direct ads to NUL: instead of loading them. Much malware comes from ads which usually are hosted on systems other then the one your visiting.
There's a few hosts files around, I'm currently using the one from Steven Black, https://github.com/StevenBlack/hosts/releases (https://github.com/StevenBlack/hosts/releases).
Download the zip file, unzip and after backing up your current hosts file and reviewing for personification, usually 127.0.0.1 with your machine name copy the new hosts file to x:\mptn\etc (x:\tcpip\etc on Warp V3).
As for Falkon, it doesn't seem to have many extensions yet, mostly an ad blocker last I looked though they are supposed to be working on allowing it to use WebExtensions.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: ivan on February 23, 2020, 04:04:00 pm
Hi Sandra,

It is nice to see someone in the industry actually telling others to be aware of computer security.  Thank you.

Although I am now retired I still get asked about problems when someone clicks on an email link or opens an attachment and things go wrong.  I have always used PMMAIL as my email client and if people can't send me text emails then I don't read them, it definitely cuts down on the spam.

For myself I use Adblock Plus and  NoScript in firefox on OS/2, Linux Mint, ZorinOS and my Android tablets, they should also be on firefox on my phone but I use that so infrequently I'm not sure as the latest update might have changed things.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Mathias on February 23, 2020, 05:42:47 pm
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Joop on February 23, 2020, 05:45:47 pm
NoScript by Giorgio Maone
http://noscript.net/ (http://noscript.net/)
Since PrefBar no longer runs on newer FireFox to disable JavaScript, I switched to NoScript. This can allow JavaScript for single domains/hostnames temporarily or permanently. You can set up that the main page is automatically allowed to use JavaScript - I set this up for my mother, then most pages will work, only for some you have to allow additional hosts.
I use the stricter default setting myself and only allow temporarily - the only exception is the homepage of my QNAP TVS-873e. Basically a number of frequently used JavaScript suppliers are allowed by default.
SeaMonkey for Windows needs the Classic version 5.1.9 from https://noscript.net/getit (https://noscript.net/getit), we need the 2.9.0.14 version.
Thank you for your information about security. I do understand what you write, but if rule out JavaScript then a lot of pages won't work right. I use JavaScript in order to help the visitor through "databases" or with pictures. When you switch JavaScript off it won't show that easy. I tried without JavaScript, but that didn't worked.

Now your posts. Switch off your picture, take something NOT personal.

Regards,
Joop
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Joop on February 23, 2020, 05:51:02 pm
We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases (https://github.com/gorhill/uBlock-for-f ... y/releases), which also gets updates from time to time, but these have to be loaded manually.
I get a 404 on that address.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Hakuchi on February 23, 2020, 06:04:27 pm
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae

Yeah! I stopped to use that some time ago ... nothing that has something remotely like that is no-no.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Dave Yeo on February 23, 2020, 07:43:45 pm
Adblock Plus also whitelists ads for money, which by itself isn't so bad but they weren't upfront about it or the data collection. The consensus on the internet seems to be that ublock origin is the best ad blocker.
As for JavaScript, the idea with NoScript is that you only allow trusted scripts to run. Generally the ones that originate from the same site. It can be tricky and sometimes out of frustration you might temporarily allow most scripts to run except those that you have blacklisted. Most sites don't need Facebook or most Google scripts running to work right.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Hakuchi on February 23, 2020, 08:23:08 pm
Using NoScript is a bit encumbering at first, but by the time one gets those settings as they should be for the daily cruising ... until they make yet another layer of B$cripts that renders one site unusable until those settings are in place again. But mostly it's not that much bother for normal daily use, since we tend to go through only few sites anyway ..

But not exactly your average joe's thing to go by ... Privacy Badger would be my recommendation for non tech savvy person for daily browsing privacy.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 09:36:55 pm
Hi Sandra,

It is nice to see someone in the industry actually telling others to be aware of computer security.  Thank you.

Although I am now retired I still get asked about problems when someone clicks on an email link or opens an attachment and things go wrong.  I have always used PMMAIL as my email client and if people can't send me text emails then I don't read them, it definitely cuts down on the spam.

Nearly all OS/2 users use computers since decades, but quoting Roderick "many OS/2 users live in caves" ...

There are even new OS/2 users - at our meeting in Cologne (30.11.2019) someone popped up who had just rescued an old IBM ThinkPad from going into trash and we helped him to get OS/2 installed.

Nowadays, you can get computers in every super market somewhere between bread and butter - but even if you go to a computer retail store and order a PC together with a printer there, the best you can hope for is a system which is up to date, not filled with bloatware and has drivers for your printer installed ...

Real configuration or education? Forget about that - and in the rare cases, where it is offered, it's deemed too expensive by the buyer ...

For driving cars, you'll need a driving license. For computers, with whom you can cause accidents all over the world and that simultaneously, a corresponding driving license should be a requirement, too.

For myself I use Adblock Plus and  NoScript in firefox on OS/2, Linux Mint, ZorinOS and my Android tablets, they should also be on firefox on my phone but I use that so infrequently I'm not sure as the latest update might have changed things.

Years ago, I found a comparision between Adblock and uBlock where uBlock was way faster and used significantly less memory - I switched and never looked back.

Greetings,
Sandra-Asja
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 09:39:55 pm
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae

I'm logged in, but trying to go to ticked 2397 just gives an "Access Denied."
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 09:44:44 pm
Now your posts. Switch off your picture, take something NOT personal.

???


We need - just like SeaMonkey for Windows - the legacy version at https://github.com/gorhill/uBlock-for-f ... y/releases, which also gets updates from time to time, but these have to be loaded manually.
I get a 404 on that address.

That visible link was shortened by OS2.org and I used that to re-create the links here ... I included a working link at the top of the second part.

Greetings,
Sandra-Asja
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Sandra Asja Eickel on February 23, 2020, 10:02:11 pm
Using NoScript is a bit encumbering at first, but by the time one gets those settings as they should be for the daily cruising ... until they make yet another layer of B$cripts that renders one site unusable until those settings are in place again. But mostly it's not that much bother for normal daily use, since we tend to go through only few sites anyway ..

But not exactly your average joe's thing to go by ... Privacy Badger would be my recommendation for non tech savvy person for daily browsing privacy.

That's why I changed the settings of NoScript to allow JavaScript from the first party site for my mother. This is a good compromise between privacy/security and comfort for normal users. Only for a few sites I had to show her to enable JS from a second site.

I don't know if Privacy Badger runs with our browsers, but it's definitivly a good addition for the list of suggested (or better: must have) extensions.

Greetings,
Sandra-Asja


P.S.: I *REALLY* miss the old OS2.org forum software with its hierarchical tree of replies ... :-(
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Hakuchi on February 23, 2020, 10:09:07 pm
I don't know if Privacy Badger runs with our browsers, but it's definitivly a good addition for the list of suggested (or better: must have) extensions.

This I don't know. But since talk was there I thought to mention it. Also FF multi containers addon is on of those what I usually recommend to people who are asking for some privacy and security tips and are not so tech savvy.

I don't think I can use any other browser after I got used to that little beauty! Makes life so much easier with all the different accounts and whatnots!
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Dave Yeo on February 23, 2020, 10:41:22 pm
Ivan, careful: AdblockPlus has a telemetry feature. Might be selling data to 3rd parties.. See Mantis ticket #0002397 @ ArcaNoae

I'm logged in, but trying to go to ticked 2397 just gives an "Access Denied."

Lewis made the ticket private as it has the testers ftp credentials posted. The ticket doesn't have anything new, just about x:\sys\doc\Mozilla\MOZ_INFO.HTML basically.

I have Privacy Badger installed here, not sure how well it works due to other add-ons doing the same kind of stuff.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Joop on February 23, 2020, 10:46:01 pm
Now your posts. Switch off your picture, take something NOT personal.

???
I understand, but there are some sick people around the world which use these pictures. There is also some sick software around in which they can manipulate faces. Your picture alongside your messages could be enlarged up to 300% easily without that you could see it was originate from a much smaller picture. So, that's why I say "switch off your picture" and take something else. But its up to you.
Title: Re: Presentation about Internet Security held during Let's Warp Cologne User Meeting
Post by: Mathias on February 24, 2020, 08:41:02 am
; ) The ticket contains URLs proving that AdBlock Plus is collecting user data for their telemetry functionality. Lewis initially didn't believe me, but after posting an Adblock-internal chatlog, we came to the conclusion to rather recommend UBlock Origin over Adblock Plus in MOZ_INFO.HTML, shipped with ArcaOS.