Applied Paranoia

62 readers
1 users here now

Discussions of Paranoia, how to apply it in a digital ecosystem (Security, Privacy, Tools, Applications, Questions)

Rules

  1. Be nice
  2. Stay on topic
  3. Don’t farm rage
  4. Be respectful of others

founded 4 months ago
MODERATORS
1
 
 

This is a story that my friend Mike was telling me about a particularly memorable job he was on in his career as a safe technician. I am often heard both extolling the virtues of this work and also expressing concern about who will be the next generation that takes on this work as current owners and field technicians continue to age and even retire. Mike is fortunate to have a gifted and talented family who is interested in this field and offspring who appreciate the satisfaction of this work, but not every shop out there does.

I share stories like this to hopefully help both educate and inspire younger folk who would like to be a part of an essential field which is in need of individuals who can think critically, apply their skills to unique problems, and stick with a project until it is completed properly. If this sort of work sounds interesting to you and you would like to develop in this career path, I always encourage folk to reach out to groups like Lockmasters or MBA or the Taylor Family...

summerizer

Summary

This video transcript revolves around a fascinating locksmith story shared at the Sava Safe Tech event, highlighting a unique challenge involving an antique safe from Portugal. The safe, originally installed in a 1940s Portuguese bank, had been converted into a humidor by its owner — a wealthy and charitable gentleman in the U.S. During a gathering, the humidor safe was accidentally locked, and the key went missing, prompting a desperate search. The locksmith, along with his partner, was called in to open the safe without damaging its intricately refinished facade and maintaining its historic value.

After determining that the high-security key lock and decorative lettered dials were integral parts of the locking mechanism, the locksmiths used drilling and an inspection scope to analyze the bolt work because no manuals or code existed for the rare safe. Ultimately, they discovered the dials, which the owner claimed were decorative, were actually functional, and spelled out the word “CUBA.” By manipulating the dials to the correct combination, they successfully opened the safe, finding the keys inside and realizing the safe had never truly been locked by the key mechanism. The story underscores the importance of exploring all possibilities in problem-solving, questioning customer assumptions, and preserving the integrity of valuable items through care and expertise. The locksmith ultimately replaced the lock with a modern high-security one, restored the safe’s exterior, and pleased the client.

Highlights 🔐 Antique 1940s Portuguese safe converted into a luxury humidor 🔑 Client accidentally locked the safe during a social event and lost the key 🕵️‍♂️ Locksmiths faced a rare, undocumented lock with no blueprints or templates 🔎 Use of drilling, inspection scopes, and skilled manipulation to open the safe 🔠 Decorative dials on the safe actually spelled “CUBA” and were part of the lock 🛠 Safe opened without visible damage; lock replaced with modern security system 🤝 Story highlights the value of expertise, patience, and challenging assumptions Key Insights 🔑 Historic safes present unique challenges: Working on antique safes with unknown mechanisms requires creative problem-solving and specialized tools, emphasizing the need for locksmiths to be versatile and adaptive rather than relying on manuals or databases. 🎯 Customer assumptions can mislead: The client was certain the dials were only decorative, which almost delayed the solution. This highlights how locksmiths must trust their instincts and verify all parts of a locking system rather than fully relying on client information. 🔍 Advanced surveillance and diagnostic tools are vital: Utilizing a scope and drilling at multiple angles allowed the locksmith to understand the lock’s internal structure without unnecessary damage—critical when dealing with valuable or irreplaceable items. 🧩 Patience and tactile skills trump technology at times: The locksmith’s ability to manipulate the dials physically and detect resistance led to the discovery of the true locking mechanism, proving that experience and “by-feel” skills remain important in a modern high-tech world. 🛡 Preserving integrity while repairing: The priority to not mark or damage the safe meant the locksmiths had to carefully patch the drilling hole and refit the escutcheon plate, demonstrating respect for the item’s historical and sentimental value. 🔄 Modern replacement enhances security: Installing a high-security block lock after opening maintained the safe’s functionality and offered better future servicing options, combining modern technology with historical preservation. 🌟 Trade stories inspire and teach: Sharing detailed service experiences not only inspires future locksmiths but educates customers and professionals about the complexities of the trade and the value of experienced craftsmanship.

This account blends technical locksmith expertise with a human story, emphasizing problem-solving, respect for craftsmanship, and continuous learning.

2
 
 

This video demonstrates how to install apps on a Google Pixel running GrapheneOS, detailing a setup refined over three years. The presenter emphasizes starting users should use the standard Play Store before transitioning to a more complex app installation system for enhanced privacy and control. The process involves using multiple app sources, setting up user profiles for separation, and maintaining security through methods like Orbot and anonymous Google accounts.

Key Points

Setup Disclaimer

The presenter advises beginners to initially use the standard Play Store for easy app access and to adapt more smoothly before attempting the outlined complex setup.

User Profiles

After installing GrapheneOS, users operate under an owner profile and can create additional profiles to separate app usage, enhancing privacy.

Using Orbot

Orbot, a free proxy service, is installed to route all traffic over the Tor network, ensuring user anonymity when accessing the Play Store and downloading updates.

App Sources

The video outlines three primary sources for app installation: the default GrapheneOS app store, Crescent (an actively developed alternative app store), and Obtainium for open source apps. Each source plays a role in the app search process.

Creating Anonymous Google Accounts

For accessing the Google Play Store, the presenter suggests creating an anonymous account using temporary phone numbers to maintain privacy without linking back to personal identities.

Disabling Apps in Owner Profile

The installed apps are disabled in the owner profile to prevent accidental access, subsequently allowing users to install apps in a separate daily user profile where the apps are actually used.

Maintaining App Updates

Apps installed in the owner profile are updated across all user profiles, allowing for convenient management of applications without needing to update each profile separately.

Privacy Measures

The presenter discusses the importance of maintaining app permissions diligently and offers a solution for potential issues regarding the use of temporary phone numbers.

3
1
Writing C For Curl (daniel.haxx.se)
submitted 2 months ago* (last edited 2 months ago) by [email protected] to c/[email protected]
 
 

It is a somewhat common question to me: how do we write C in curl to make it safe and secure for billions of installations? Some precautions we take and decisions we make. There is no silver bullet, just guidelines. As I think you can see for yourself below they are also neither strange nor surprising.

The ‘c’ in curl does not and never did stand for the C programming language, it stands for client. ...

This is a excellent read, and If you work on a multi-person project, I highly recommend going through it.

4
 
 

Do you have a go bag?

Where do you keep it?

What is inside of it?

5
 
 

Build Your Own Darknet

Discover the simplest way to re-enter independent computing with our framework. Placing control directly at your fingertips.

Features of Clan

  • Full-Stack System Deployment: Utilize Clan’s toolkit alongside Nix's reliability to build and manage systems effortlessly.
  • Overlay Networks: Secure, private communication channels between devices.
  • Virtual Machine Integration: Seamless operation of VM applications within the main operating system.
  • Robust Backup Management: Long-term, self-hosted data preservation.
  • Intuitive Secret Management: Simplified encryption and password management processes.

https://clan.lol/

https://git.clan.lol/clan/clan-core/

6
 
 

During our previous research on Android File-Based encryption, we studied the boot chain of some Samsung devices based on Mediatek system on chips. Our objective was to exploit a known boot ROM vulnerability to bypass the secure boot and ultimately retrieve the required ingredients to brute force the user credentials. Once we became familiar with this boot chain, we decided to take a closer look at a component coming later in the process: the Little Kernel bootloader (LK, also called BL3-3)....

By: Maxime Rossi Bellom & Raphael Neveu Additional Contributors: Damiano Melotti & Gabrielle Viala

Full Abstract and Presentation Materials: blackhat.com/us-24/briefings/schedule/#attacking-samsung-galaxy-a-boot-chain-and-beyond-38526

7
 
 

The security architecture of modern operating systems is intricate and layered. To effectively challenge these defenses, attackers must extensively audit the security policies of the operating system across various dimensions. In July 2023, the speaker redirected their focus from Android and IoT vulnerabilities to those within macOS. This transition was motivated by an intent to adapt methodologies typically employed by Android security researchers for use in macOS environments, which subsequently led to the identification of numerous vulnerabilities.

In this presentation, the speaker will introduce a generic method for escaping macOS application sandboxes.

Additionally, the speaker will discuss a permission granting mechanism on macOS

Moreover, macOS 14.0 introduced new TCC protections, preventing non-sandboxed apps from accessing the private container folders of sandboxed apps. Previously, executing a malicious non-sandboxed app could leak sensitive data from sandboxed apps like WeChat, Slack, and WhatsApp. However, this is no longer possible on macOS due to the new TCC protections. The speaker will explain how macOS implements these new TCC protections, which are complex and involve multiple high-privilege system processes and Sandbox.kext. If abused, there is potential to gain access to arbitrary files.

By: Zhongquan Li | Senior Security Researcher, Dawn Security Lab, JD.com Qidan He | Director, Chief Researcher, Dawn Security Lab, JD.com

8
 
 

Location-based dating (LBD) apps enable users to meet new people nearby and online by browsing others' profiles, which often contain very personal and sensitive data. We systematically analyze 15 LBD apps on the prevalence of privacy risks that can result in abuse by adversarial users who want to stalk, harass, or harm others. Through a systematic manual analysis of these apps, we assess which personal and sensitive data is shared with other users, both as (intended) data exposure and as inadvertent yet powerful leaks in API traffic that is otherwise hidden from a user, violating their mental model of what they share on LBD apps.

As one finding of our research, 6 apps allow for pinpointing a victim's exact location, enabling physical threats to users' personal safety. All these data exposures and leaks—supported by easy account creation—enable targeted or large-scale, long-term, and stealthy profiling and tracking of LBD app users. While privacy policies acknowledge personal data processing, and a tension exists between app functionality and user privacy, significant data privacy risks remain. We recommend user control, data minimization, and API hardening as countermeasures to protect users' privacy.

By: Karel Dhondt | Researcher Victor Le Pochat | Postdoctoral Researcher, DistriNet, KU Leuven

Full Abstract and Presentation Materials: blackhat.com/us-24/briefings/schedule/#swipe-left-for-identity-theft-an-analysis-of-user-data-privacy-risks-on-location-based-dating-apps-39007

White Paper http://i.blackhat.com/BH-US-24/Presentations/US24-Dhondt-Swipe-Left-for-Identity-Theft-wp.pdf

9
1
Comparison of Payment Methods (eylenburg.github.io)
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/[email protected]
 
 

I love evelynburg.github.io

This is comparison of various payment methods. In my opinion the most important aspects are: (1) privacy, (2) fungibility and resilience to censorship and expropriation, (3) day-to-day convenience and acceptance.

10
1
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/[email protected]
 
 

Hacking backdoor backdoors by taking over abandoned C&C domains

Writeup - https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/)

Youtube review - Low Level https://youtu.be/ST1frnx-5Nw

11
 
 

Ideal for archiving important data, such as password vault keys, in case of death information, swiss bank accounts, etc. The key can be distributed amongst trusted parties, so no single person can access, but if they cooperate it could be resurrected.

paperback is a paper-based backup scheme that is secure and easy-to-use. Backups are encrypted, and the secret key is split into numerous "key shards" which can be stored separately (by different individuals), removing the need for any individual to memorise a secret passphrase.

12
 
 

A hardware secure token that requires a fingerprint to unlock adds another factor to your secure authentication.

  • Something you have
  • Something you are

Even if the key falls out of your control, the fingerprint reader would render it useless

yubico

I'm a big fan of yubikeys, they have the bio series with built in fingerprint reader, and now the multi-protocol edition is not only webauthn fido2, it acts as a smartcard/PIV (i.e. ssh keys) Tech Details

The one annoying thing is the multi-protocol version isn't generally available, the fido2 edition is available

feitian

also provides fingerprint fido2 keys, but I'm not familiar with their security reputation https://shop.ftsafe.us/collections/fido-security-key-biometric

others

Any other biometric key options?

13
1
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/[email protected]
 
 

BusKill - A clip on device that when disconnected from a computer will trigger a fail safe event on the computer, such as locking the computer, shutting down, or any script you care for. Totally open source, both hardware and software.

If your a digital nomad or use a computer in public, this might be of interest.

https://www.buskill.in/ https://github.com/BusKill

You can even build it yourself

https://docs.buskill.in/buskill-app/en/stable/hardware_dev/bom.html

If you want to purchase a prebuilt model, they do accept crypto!