Privacy Checkup 2021

Status
Not open for further replies.
Kinda glad I got @'ed for this because I have indeed been slacking on my privacy stuff. Maybe I got cocky cause my dumbass thinks I'll be fine always and only accessing the Farms in Private Mode (retarded as hell I know), but I really should be taking steps to secure myself more. I may live in 'Merica but it's been utter Clown Land for a while and shows no sign of stopping.

Also, how hard or demanding would it be to set up your own VPN? (Wireguard, OpenVPN, Strong Swan, etc.)
 
  • Autistic
  • Feels
  • Optimistic
Reactions: DarkSydeBills, Fustrated, BLEACHED.COM and 11 others
Null said:
Your Email
You should use a permanent email not tied to your real ID.

Only admins can view your email address. However, we have had a security breach in the past which leaked the email addresses of active users.

...

They are not disposable / temporary email addresses. We do not allow those because they are used by spammers and abusive accounts suicide bombing the forum. Any legitimate users with a disposable email will eventually forget their password and be permanently locked out, so it's seriously against our interests to allow it.
Click to expand...
Why not hash them?

Store KDF(email || salt) and salt in DB. To do password reset:
- user inputs username and email
- server gets salt for username, computes hash = KDF(email || salt)
- if hash matches hash on file, send email
- if it doesn't match, do nothing
- "If that was your email address, we've sent you a password reset. If you didn't get anything, try another one."

You could use username as salt.

If you get hacked, it would still be possible to get the emails, but it'd take a lot of cracking effort and be far from 100% effective.

(If you're really worried, it's also possible to use a hardware pepper, but that's almost schizo-tier paranoia)
 
  • Informative
  • Thunk-Provoking
Reactions: Donny Cheese, The giant penis of doom, LilShotaBoy and 3 others
Jolyne THICCujoh said:
Also, how hard or demanding would it be to set up your own VPN? (Wireguard, OpenVPN, Strong Swan, etc.)
Click to expand...
Not that hard, but you'll need a server to host it on, and the VPN will uniquely identify you ("oh hey, that's the digitalocean IP lolyne always uses"). A big VPN provider will rotate your IP addresses among other users.
 
  • Agree
  • Informative
Reactions: DarkSydeBills, Fentanyl Crop Duster, CyrusKissFanClub and 5 others
Slav Power said:
I still feel safer uploading a KeePass database to a cloud like Dropbox rather than using a cloud based password manager, since I know the file is actually encrypted and useless without the password, while I cannot be fully sure of that in case of services like Bitwarden or LastPass.
Click to expand...
Bitwarden also has an opensource docker application which allows the user to make its own server to store passwords on.
This is great if you want to prevent being victim of a dataleak
 
  • Like
  • Informative
Reactions: Dork Of Ages and Slav Power
catpin said:
This is great if you want to prevent being victim of a dataleak
Click to expand...
These applications use your password as an encryption key, so even if shit gets hacked they only get encrypted payloads.

hundredpercent said:
Why not hash them?

Store KDF(email || salt) and salt in DB. To do password reset:
- user inputs username and email
- server gets salt for username, computes hash = KDF(email || salt)
- if hash matches hash on file, send email
- if it doesn't match, do nothing
- "If that was your email address, we've sent you a password reset. If you didn't get anything, try another one."

You could use username as salt.

If you get hacked, it would still be possible to get the emails, but it'd take a lot of cracking effort and be far from 100% effective.

(If you're really worried, it's also possible to use a hardware pepper, but that's almost schizo-tier paranoia)
Click to expand...
We've never had a database leak. The email leak came from using Redis-stored hashes to log in to every recently active account and download their account information page, which includes the email address. This is security through obscurity.
 
  • Informative
Reactions: 419, Dork Of Ages, 2020chan and 4 others
Null said:
We've never had a database leak. The email leak came from using Redis-stored hashes to log in to every recently active account and download their account information page, which includes the email address. This is security through obscurity.
Click to expand...
No. The accounts would not be able to see their email address either, even if logged in. The server simply wouldn't store that information, just as there's no way to see your password even if you're logged in.
 
hundredpercent said:
No. The accounts would not be able to see their email address either, even if logged in. The server simply wouldn't store that information, just as there's no way to see your password even if you're logged in.
Click to expand...
I mean you might as well just suggest not showing people their own email addresses. That'd solve the problem with a single template change and without a hashing system that'd amount to nothing if the system got rooted. Gimmicks like that wouldn't matter if the database was being copied.
 
  • Disagree
  • Thunk-Provoking
Reactions: 420BlazeMy3601337Vagick, The giant penis of doom and hundredpercent
If you want to increase security, wouldn't holding onto IPs for a shorter amount of time help? I've heard it's held up to 6 months, that seems like awhile particularly considering that 2 factor authentication (which everybody really should be using) only lasts for a month.
 
  • Agree
  • Like
Reactions: LilShotaBoy and 6thRanger
Arm Pit Cream said:
If you want to increase security, wouldn't holding onto IPs for a shorter amount of time help? I've heard it's held up to 6 months, that seems like awhile particularly considering that 2 factor authentication (which everybody really should be using) only lasts for a month.
Click to expand...
7 days currently. Changes based on current threat.

Professor Monkey said:
I accidently logged in without my VPN one time. Do I go make another account now?
(Also hive mind opinions on Mullvad?)
Click to expand...
no.
 
  • Informative
  • Like
  • Winner
Reactions: KiwiFuzz, CyrusKissFanClub, Fag Goat and 5 others
Null said:
I mean you might as well just suggest not showing people their own email addresses. That'd solve the problem with a single template change and without a hashing system that'd amount to nothing if the system got rooted. Gimmicks like that wouldn't matter if the database was being copied.
Click to expand...
The hashing system would help you if the database got rooted. The database would not contain any email addresses, just as it doesn't contain any unsalted passwords.
 
  • Like
  • Agree
Reactions: LilShotaBoy and The giant penis of doom
I was always a bit confused at that Firefox is still in privacytools.io but nowadays other places are saying it uses your data or its not safe? Not sure of what I should believe. Tried getting Brave, and that thing runs as slow as molasses for some reason.
 
  • Thunk-Provoking
Reactions: Rotollo 2 and Arm Pit Cream
hundredpercent said:
Not that hard, but you'll need a server to host it on, and the VPN will uniquely identify you ("oh hey, that's the digitalocean IP lolyne always uses"). A big VPN provider will rotate your IP addresses among other users.
Click to expand...
Ahh, I see now. I'm kind of a cheap fuck and thought this would be better than the monthly subscriptions to VPNs but I guess privacy costs something, no matter what.

Or I can just go with TOR for browsing KF and all that. Dunno which option is better at this point cause they both have their ups and downs.
 
  • Like
Reactions: Arm Pit Cream
Status
Not open for further replies.
Back