Negative, I am a meat popsicle.

  • 0 Posts
  • 22 Comments
Joined 1 year ago
cake
Cake day: June 15th, 2023

help-circle


  • HarrisontoPrivacy@lemmy.mlThe Cloudflare Poison
    link
    fedilink
    arrow-up
    9
    ·
    edit-2
    6 months ago

    Remember not to compromise security in favor of privacy. To me they’re both important, but security wins every time.

    Remember that services directly accessible over tunnels, whether from cloudflare or frp or ngrok or whatever, are directly accessible over the internet. So if any of those various self-hosted services have a remote vulnerability, and EVERYTHING does sooner or later, you will be exposed. This is why I personally WG VPN to my home LAN rather than exposing most of my stuff via any sort of tunnel. Tailscale is another option I often recommend.

    I do use CF tunnels for specific purposes; Home Assistant Google Home integration for example, but I secure that via their “zero trust” authentication by validating incoming IP ranges, so only Google can reach the tunnel in the first place, everybody else is stopped by Cloudflare. For other services with human users, I have them authenticate via github or google oauth first. I also run all services accessible by the internet by any means on a restricted VLAN firewalled off from the rest of my LAN.


  • HarrisontoPrivacy@lemmy.mlThe Cloudflare Poison
    link
    fedilink
    arrow-up
    12
    arrow-down
    7
    ·
    6 months ago

    I’m all for healthy paranoia, keeping my attack surface small. That’s just professional IT ops.

    Incendiary statements like saying US intelligence compromised the supply chain with hidden backdoors, those really do need to be substantiated to not sound like a crazy uncle. Our adversaries have counterintelligence also, they aren’t incompetent, and if Cisco or Juniper or whatever planted backdoors in hardware shipped to China, the Chinese would make a ton of noise about it. And so would we; Huawei was banned without any substantiated proof, out of fears that if used, their 5G infra could have hidden backdoors and the hardware would be so widely distributed that it would be onerous to replace.



  • HarrisontoPrivacy@lemmy.mlThe Cloudflare Poison
    link
    fedilink
    arrow-up
    89
    arrow-down
    10
    ·
    6 months ago

    Cloudflare is a MITM by design. Calling it an attack is disingenuous; you’re signing up for the service of your own free will, not a victim.

    If a substantiated news article came out showing that Cloudflare shared SSL keys or otherwise gave direct access to various intelligence agencies without a court order, that would essentially destroy the company. So they certainly aren’t doing that.

    So then the question becomes whether those nefarious three letter agencies penetrated Cloudflare with APT tools and are silently listening to everything. Our adversaries are certainly trying, China, Russia, Iran, etc. If the NSA (which lacks a mandate to act on US soil, and CF is a US company) or perhaps the FBI hacked a US company, particularly one that covers like a third of the internet like Cloudflare, that would be a truly enormous scandal.

    But in the end, yes, it is a MITM. If you need your data to be E2E encrypted, don’t use it.






  • Here’s another one— click through on macOS. Coming from other systems I find it infuriating. Not just the click though itself but its inconsistency, where it works in browsers and some other selected programs but not in most.

    For those not aware, click through is when you’re focused on another window and click on this one. With click through, it will immediately action what you click without you have to click first to the window then click again. This isn’t inherently inferior, but I really don’t like it personally. And it is absolutely impossible to change this behavior on MacOS by any means. Believe me, I researched this extensively.





  • Specifically, the way iOS content blocking works is guaranteed safe. All it does is write to a file loaded by the Safari browser to block content, the app can’t do anything at all itself. No indication any VPN sold by AdGuard (or the local device-wide fake VPN) is particularly unsafe that I’ve seen.


  • HarrisontoPrivacy Guides@lemmy.one2FA app
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    It’s less that Twilio specifically owns it than problems resulting from corporate ownership. Briefly:

    1. You can’t get your data out of Authy. Actually you can, but it’s a long annoying process involving installing an out of date chrome extension and using developer tools.
    2. Privacy issues. Authy links a lot of data including location to your identity.
    3. Authy supports SMS account recovery (which is inherently insecure) and doesn’t allow users to disable it.

  • HarrisontoPrivacy Guides@lemmy.one2FA app
    link
    fedilink
    arrow-up
    8
    ·
    1 year ago

    Android is easy, Aegis.

    IOS is much harder. Right now, probably “2FAs”. Authy is owned by Twilio, Raivo was just bought out by an advertising company, and the others are either too small to get the exposure required for any level of security or charge for the feature.



  • HarrisontoPrivacy@lemmy.ml2FA for iOS
    link
    fedilink
    arrow-up
    1
    ·
    edit-2
    1 year ago

    I just tried “2FAs”, which seems to be the most recommended free one. It failed to import any 2FAs from the Raivo export with 7 digits, but otherwise worked fine. Problem is it failed to import silently, didn’t give any errors, which was offputting. Using it for now, but Raivo was better software. Pouring one out.