Properly Paranoid

 

 

Properly Paranoid - A YouTube Privacy Series from Nixie Pixel

• Four Free Browser Tools for Privacy on the Net - Properly Paranoid
• Creepy Things They Know About You
• Brute-forcing your Box : Password Security
• Set Up a Secure Network / File Sharing Server in 5 Minutes
• Password Managers : Why You Need Them - Keepass

Encryption Wizard

Encryption Wizard (EW) https://www.spi.dod.mil/ewizard.htm is simple, strong, Java-based file and folder encryption software, developed by the American military, for protection of sensitive information. EW encrypts all file types for data-in-transit protection, and supplements data-at-rest protection. Without requiring a formal installation or elevated privileges, EW runs on Microsoft Windows, Mac OS X, Linux, Solaris, and many other operating systems. Behind its simple drag-and-drop interface, EW offers 128- or 256-bit AES encryption, several secure hashing algorithms, searchable metadata, encrypted archives with compression, secure file deletion (often called "scrubbing" or "shredding"), and PKI/CAC/PIV support.

EW Public Edition may be downloaded and used by anybody at no charge. It uses the cryptography support already present in Java. It contains all the important features of EW and serves as a good introduction to the software. EW Government Edition is FIPS 140-2 validated. It uses a third-party cryptography module licensed for use by Federal employees and contractors only. EW Unified Edition is FIPS 140-2 validated, and may be downloaded and used by anybody at no charge. It uses a third-party (Bouncy Castle) cryptography module with no distribution restrictions. The Unified edition requires that your Java installation be permitted to use 256-bit keys, even if you never actually use anything stronger than normal 128-bit keys. The three editions (Public, Government, and Unified) are interoperable.

EW Public Edition doesn't provide its own implementation of AES, it just uses whatever is supplied by your Java Runtime Environment. The AES algorithms and their underlying Rijndael ciphers are well known, publicly available, and extensively analyzed. No feasible attacks against AES have yet been demonstrated.

Is there a backdoor in EW? The software authors say no, explaining that a backdoor to a system needs a key. If the key to a backdoor were to get out (whether by accident, malfeasance, or disgruntled employees is irrelevant), then whatever is protected by that system becomes vulnerable. Given that the primary use of Encryption Wizard is to protect sensitive information relevant to the US DoD, inserting a master backdoor would be dangerously risky and profoundly shortsighted.

Can Encryption Wizard be trusted? Yes probably, as much as any encryption software can be trusted. It provides strong encryption that is more than sufficient for most personal or business use. Encryption Wizard is particularly useful for encrypted communication between US Government agencies and other agencies and organizations that don't have compatible PKI encryption.

FBI chief calls encryption a ‘major public safety issue’

FBI Director Christopher A. Wray on Tuesday [January 9, 2018] renewed a call for tech companies to help law enforcement officials gain access to encrypted smartphones, describing it as a "major public safety issue." Wray said the bureau was unable to gain access to the content of 7,775 devices in fiscal 2017 - more than half of all the smartphones it tried to crack in that time period - despite having a warrant from a judge. "Being unable to access nearly 7,800 devices in a single year is a major public safety issue," he said, taking up a theme that was a signature issue of his predecessor, James B. Comey.  (Washington Post)

Unintended consequences

Technology companies as well as many digital security experts claim that the FBI’s attempts to order all devices to have a way for investigators to access a criminal suspect’s phone would harm internet security while also empowering malicious hackers.

Any laws that have the effect of weakening the encryption schemes used by popular Internet services could have unintended consequences, according the chief technology officer of security software vendor Sophos.

"I think it’s unreasonable to ask anyone who writes any kind of software to intentionally weaken the security of that software, whether that’s in the form of introducing a backdoor or whether it’s in the form of creating this kind of a ‘reversible crypto scheme’ where data could subsequently be decrypted even by authorized party," Joe Levy, CTO at Sophos, told Computerworld in an interview conducted in late 2017.

"No matter how you slice it, you’re basically asking the vendor to weaken the security of the product."

"It might be requested with the very best of intentions and certainly fighting terrorism is a very important and a very noble goal, but there’s this unintended consequence of creating these vast exposures that are inevitably going to be exploited by some bad actor," Levy said.

"You can’t just trust that it will only be the government who is going to have that key or have that ability to decrypt content. You just have to expect that, with knowledge that this capability exists in the product, that bad actors are going to seek to exploit that, especially when you have any kind of a centralization of an ability to do that."

"It’s basically an advertisement saying ‘come and attack me; this will give you the keys to the kingdom’," the CTO said. (Computer World)

Disguised and Concealable Weapons

 

Everyday law enforcement, security, and intelligence personnel are faced with potential threats from disguised and concealable weapons. By being aware of what’s out there, it becomes easier to recognize a threat and take action to protect ourselves against it.  Likewise, in undercover situations, unconventional and special operations it may be possible to adopt certain of these weapons to give us the advantage over an adversary.

Below are examples of some of these disguised and concealable weapons.  Whenever possible I have linked to a major retailer (i.e. Amazon.Com) or to the web-site of the company producing the item listed.  Any item that can be easily found or purchased on-line should be considered commonplace and is something that may very likely be encountered in the field.
 
I would like to acknowledge the work of Wendy Kierstead, CCA, of the Brunswick, Maine Police Department.  For several years Ms. Kierstead published a law enforcement safety handbook, identifying unusual weapons and concealment devices.  Ms. Kierstead’s work contributed significantly to officer safety and very probably saved lives by making officers aware of new and unique threats they might come up against in the field.  Ms. Kierstead has since retired from the Brunswick Police Department, but the last update of her work (2006) can still be found on-line (http://www.icops.org/PDFs/LawEnforcementSafetyHandbook.pdf) and is still contributing to officer safety.

In 2012, I published an updated Catalog of Unique, Concealed & Disguised Weapons, Concealments, Escape Techniques, Tactics & Tradecraft which is available from Archive.Org.

The Los Angeles County Sheriff's Department Published a guide to Improvised Weapons and Other Officer Safety Concerns, which is available on the Public Intelligence web-site.

Para-Claw Heavy-Duty Paracord Knife Survival Bracelet

 

 

SOG Key Folding Knife

 

 

Cevinee Coin-shape Mini-Knife

 

 

Spyderco Dog Tag Knife

 

 

Iain Sinclair Credit Card Sized Folding Knife

 

 

Boker Plus Credit Card Knife

 

 

 

Ka-Bar TDI Law Enforcement Knife

 

 

 

Hawkeye Neck Knife

 

 

LifeCard 22LR Pistol

 

 

Ideal Conceal Pistol

 

NAA Folding Revolver

  



 

Hot Tamale Less-Lethal Coin Purse

 

 

DeSantis City Slicer Coin Purse

 

 

Private Browsing

When you browse the Internet normally, your web browser stores data about your browsing. Your browser logs websites that you visit in your browser history, saves cookies from the website, and stores form data it can autocomplete later. It also saves other information, such as a history of files you’ve downloaded, passwords you’ve chosen to save, searches you’ve entered in your browser’s address bar, and bits of web pages to speed page load times in the future (in the web cache).

Privacy mode or "private browsing" or "incognito mode" is a privacy feature in some web browsers to disable browsing history and the web cache. This allows you to browse the Internet without storing local data that could be retrieved by someone examining your computer at a later date. Privacy mode will also disable the storage of data in cookies and Flash cookies. Privacy mode also includes tracking protection, which prevents companies from tracking your browsing history across multiple sites.

This privacy protection is only on the local computing device as it is still possible to identify frequented websites by associating the IP address at the web server. Privacy mode doesn't make you anonymous on the Internet. Your Internet service provider, employer, or the sites themselves can still track what pages you visit. Privacy mode also doesn't protect you from keyloggers or spyware that may be installed on your computer.

Privacy mode doesn't make you invisible on the Internet, but it does block web-sites from recognizing that you've been there before, or from putting cookies on your computer so that they know when you come back again.

To open private browsing in different browsers, use the following key combinations:

• Internet Explorer = Control+Shift+P
• Mozilla Firefox = Control+Shift+P
• Google Chrome = Control+Shift+N

Have I Been Pwned?

 

I have always encouraged people to check their email addresses on sites such as HaveIBeenPwned (https://haveibeenpwned.com/).  If present, your account is included in a known breach, and you should change your passwords immediately. This site has been the standard as far as reported breaches, and the owner stays on top of the latest threats.

 

 

A similar site is Hacked-Emails (https://hacked-emails.com/). Hacked Emails constantly scans paste sites and other release resources, and immediately updates its database. This may be redundant information, but the constant update could reveal a compromised account that may not be present on other similar sites. Overall, I now check both of these services regularly for any of my email addresses that may have been compromised.

EasyCrypt - Email Privacy Crash Course

EasyCrypt is a cutting edge e-mail privacy service that provides end-to-end encryption, metadata protection and anonymity, at your existing email address. In 2016, EasyCrypt published an excellent, six part series called the "E-mail privacy crash course". I highly recommend reading this series if you are interested in learning more about e-mail privacy.

While I recommend reading the "E-mail privacy crash course", I am not recommending the EasyCrypt encryption service at this time. This has nothing to do with any flaws or vulnerabilities in the EasyCrypt system, rather I simply haven't used it long enough to provide a good evaluation and recommendation. That being said, I always encourage readers to test new privacy and security applications and let me know your thoughts and recommendations after you have used something for a while.

Email privacy crash course - Part 1: Introduction

Email privacy crash course - Part 2: Encryption

Email privacy crash course - Part 3: Metadata and Anonymity

Email privacy crash course - Part 4: Usability vs. Security

Email privacy crash course - Part 5: Ubiquity and People Network

Email privacy crash course - Part 6: Make your choice