@PrivSec_Dev

A practical approach to Privacy and Security

privsec.dev
Joined July 2022
  • Tweets150
  • Following0
  • Followers742
4Media
It is actually possible to use Cloudflare Pages and DNS without CF messing with your CAA records. The first step is to disable BOTH Universal SSL and AMP. If either is enabled, Cloudflare will override the CAA records for your apex. Verify that your records are correct:
1
1
2
985
privsec.dev/posts/linux/choo… Post updated: - Added caveats for the recommendations - Removed Kicksecure - Added SecureBlue - Reorganized the structure a little bit

Choosing Your Desktop Linux Distribution

Not all Linux distributions are created equal. When choosing a Linux distribution, there are several things you need to keep in mind. Release Cycle You should choose a distribution which stays close...

privsec.dev
1
2
10
1,026
A little update on the encryption situation on ChromeOS - local password is a thing now. privsec.dev/posts/knowledge/…

ChromeOS's Questionable Encryption

Premise ChromeOS encrypts user data on the disk by default. The implementation details are documented upstream but not relevant within the scope of this post. It is well-known that ChromeOS uses...

privsec.dev
2
9
851
Replying to @mer__edith
- This has been known for a long time, you didn't do anything about it. - What about the Signal TLS being outdated for a long time or the fact that it leaks info like no tomorrow? I sent the PR for you guys to merge on on a silver platter and no one merged it. You guys also...
1
5
2
45
3,624
Using Lokinet on Qubes OS post updated to work with the latest release: privsec.dev/posts/qubes/usin… This is for having fun only. 😅 Lokinet isn't really in a good state right now so don't rely on it... at least until they finish rewriting their stuff.

Using Lokinet on Qubes OS

Lokinet is an Internet overlay network utilizing onion routing to provide anonymity for its users, similar to Tor network. This post will go over how to set it up on Qubes OS. Before we start… This...

privsec.dev
3
4
1,017
New blog post: privsec.dev/posts/qubes/usin… This is essentially the same approach used for Mullvad VPN, just adapted to work with IVPN

Using IVPN on Qubes OS

IVPN is a fairly popular and generally trustworthy VPN provider. In this post, I will walk you through how to use the official IVPN client in a ProxyVM on Qubes OS. We will deviate from the official...

privsec.dev
3
4
757
Using Mullvad VPN on Qubes OS post updated to use systemd path. DNS changes made by Mullvad VPN will be automatically applied now 😄 privsec.dev/posts/qubes/usin…

Using Mullvad VPN on Qubes OS

Mullvad is a fairly popular and generally trustworthy VPN provider. In this post, I will walk you through how to use the official Mullvad client in a ProxyVM on Qubes OS. This method is a lot more...

privsec.dev
3
3
1
7
1,134
New post: privsec.dev/posts/knowledge/…

ChromeOS's Questionable Encryption

Premise ChromeOS encrypts user data on the disk by default. The implementation details are documented upstream but not relevant within the scope of this post. It is well-known that ChromeOS uses...

privsec.dev
1
3
1
9
910
So @Puri_sm's PureBoot seems to have this circular logic: - The Firmware measures itself and sends the measurements to the TPM - If the measurements matches what the TPM expect, the TPM releases the secret. If the measurements do not match, the TPM will think that...
1
3
9
878
Microsoft Edge Enterprise Policies for macOS + Linux: github.com/TommyTran732/Micr… I currently leave SmartScreen as "recommended to be off", as it is quite privacy invasive (sending FULL URLs to Microsoft). You can adjust it based on your threat model.

GitHub - TommyTran732/Microsoft-Edge-Policies: Enterprise Policies for Microsoft Edge

Enterprise Policies for Microsoft Edge. Contribute to TommyTran732/Microsoft-Edge-Policies development by creating an account on GitHub.

github.com
2
3
909
👀 This is quite interesting ... Fedora and Red Hat apparently set this to 2 by default, while Ubuntu and Debian set this to 1. Also, chrony >=4 counts from 0 to 2. chrony <=3.5 actually counts from -1 to 1.
1
857
New post: privsec.dev/posts/knowledge/…

Setting up MTA-STS with a custom domain on Proton Mail

To this date, Proton Mail doesn’t support MTA-STS for custom domains. While DANE for SMTP is a much better solution to the same problem, MTA-STS exists for a reason: many providers are slow at...

privsec.dev
1
1
651
New post :) privsec.dev/posts/macos/secu…

Secure Time Synchronization on macOS

macOS by default uses the unencrypted and unauthenticated Network Time Protocol (NTP) for time synchronization. A popular solution to mitigate this problem is to use ChronyControl to setup NTS....

privsec.dev
2
1
6
1,591
One nice thing about Ubuntu and Snap is that you can actually confine some daemons that would not be confined at all otherwise... Wonder why this is not the default
1
832
We have opened up a new subreddit: reddit.com/r/privsec_dev/ The same moderation rules as the Matrix channels apply: Technical discussions only. No politics, no conspiracy theories, no "backdoored because proprietary". Any claim of malware/spyware must be backed up with proof.

r/privsec_dev

A practical approach to Privacy and Security

reddit.com
1
2
7
1,152
When someone tells me GNU/Linux phones have better security because of the hardware kill switches:
4
1
10
6,620
New post :) privsec.dev/posts/linux/usin…

Using Native ZFS Encryption with Proxmox

Currently, the Proxmox installer does not support setting up encryption with ZFS. Thus, we have to set it up manually. This post will go over how to use the native ZFS encryption with Proxmox. The...

privsec.dev
2
2
679
New post: privsec.dev/posts/android/in…

Installing Kali NetHunter Lite on DivestOS 20.0

Update: DivestOS has been discontinued and downloads are no longer available. This will turn your device into a purely penetration testing device, and it will be very insecure for any other purpose....

privsec.dev
3
2
602
Ah yes, @robbraxmantech thinks it is impossible to implement proper E2EE with web apps. Maybe that’s why he keep saying “E2EE doesn’t mean anything because they have the key”. Maybe he actually thinks E2EE means sending the keys to the server in plain text then praying…
Avoid The Hack!@avoidthehack27 Feb 2023
One of my readers sent me these screenshots in reference to brax.me handling encryption keys for chats. Reminder: Web apps using properly implemented E2EE do not leak #encryption keys to the server #privacy Please use a trusted secure messenger.
1
1
7
1,067
One of my readers sent me these screenshots in reference to brax.me handling encryption keys for chats. Reminder: Web apps using properly implemented E2EE do not leak #encryption keys to the server #privacy Please use a trusted secure messenger.
3
3
1
21
4,430
Load more