Privacy Lover

Review: Anonymous internet surfing VforVPN

December 10th, 2008 2 Comments

It has been quite a while since I last used VforVPN and I am glad they are still online as I was quite happy with their services and customer support.

With a VPN you will avoid your ISP logging your internet activities and will make it next to impossible for outsiders to eavesdrop on your internet activities. I would recommend you to always get a VPN located outside the country where you live, aka offshore, this will make it even harder for your local Stasi, aka Cia, aka Mi5, et al, to read your emails and look at your online habits.

I still do not understand why VforVPN is so little know as it is one of the few services that will support Unix systems, my guess is that many people will be put off when they read in their about page that the person behind the company is a high school student.

The Good Stuff

Once you can install OpenVPN in your Unix system you are ready to go, VforVPN will work in Linux, Solaris or any BSD, and I used it with FreeBSD so I can tell you for sure it will work with it.

If you plan on using VforVPN with Unix you will need to ask support to send you a digital certificate which in my case they did in less than 24 hours. For some reason unknow to me I only managed to make it work when I was logged in as root, otherwise the openvpn command would give me some error, even though the other user in the box had full rights.

One of the big frustations I have with VPN proxies is that they will only support Windows, it is refreshing to find a provider that will not force you to use Microsoft. Some of those providers don’t even work with Windows 64 bit, when incidentally a Windows 64 bit OS is more secure than a 32 bit operating system.

You have two plans available with VforVPN, one using PPTP and another using OpenVPN. PPTP is an outdated Microsoft technology that does not provide confidentiality nor encryption; It relies on the protocol being tunneled to provide privacy, for high security you would be advised to keep well away from the Point-to-Point Tunneling Protocol (PPTP), the OpenVPN plan is slightly more expensive but considerably safer.

During the time I used VforVPN I never experienced any downtime or speed issue, however I could not connect to the Undernet network in IRC as they have VforVPN IP blacklisted, likely to be due to somebody misusing anonymity to carry out abuse.

Connecting to other IRC networks other than Undernet worked fine. You are very likely to find many proxies blacklisted in IRC servers, including tor proxies, so I can not hold this against VforVPN.

The Bad Stuff

A high school student managing your privacy is not what you would ideally expect from a privacy service, you would probably want an individual with many years of IT experience and a proven record in the privacy business.

Their servers are located in the US, and their privacy policy claims that they do not log anything, this is not possible as any internet connexion to any server will produce logs of some kind, what they probably mean like most other services claiming no logs, is that they only retain them for a few hours and then they get overwritten, but logs must be created in some way or shape even if for a few hours or less, without this it would be impossible for them to troubleshoot any technical problem.

I can not vouch for the no logs claim of any VPN provider, there is no way anyone but them can know the truth about this. They could claim 30 days logs and keep them for 30 years or 30 seconds, that is why for truly anonymity, anything other than tor is only pseudoanonymous, but tor proxies are slow and you can’t stream video or do bittorrent or anything that demands high bandwith and speed, at times you will need to consider a VPN provider for internet surfing.

Conclusion

VforVPN has some of the cheapest prices I have found, their speed and uptime was 100% during the time I used them, they replied quickly and efficiently to my emails, and their service works with Windows, Linux and even the iPhone (or other smartphones)!

You will have to trust a high school student to manage your privacy, but at least they are letting you know, if VforVPN stay in business for a few years this will not apply anymore.

At other companies you usually do not have a clue of who is managing your privacy, it could be the same or worse.

This is my independent review based on my personal experience, you are more than welcome to comment below any negative or positive experience you had with them, I never censor anyone other than spammers.

VPN Tunnel

UPDATE: As of 01 September 2009, VforVPN has gone offline!

I am deleting the link I had to them as their domain name is now parked.

UPDATE 2: As of 01 December 2009, VforVPN came back online! I would avoid paying one year in advance to this VPN just in case it goes offline again.

Researching people online, advanced internet search

December 3rd, 2008 4 Comments

Most Joe Does end up leaving some kind of tracks on the internet, a few months ago I posted about TinEye, an internet searcher that allows you to upload an image and it will match it with websites that are using the graphic in one shape or another .

I have now found a much better internet searcher for spying on other people’s life, it is called 123people.

I attempted to find all information on the internet about Jonathan Evans the current Director General of British Security Services, aka Mi5. The results have not been fantastic on this master trespasser of citizen’s privacy as he is probably well aware of the methods his lackeys use to spy on people, but you will get more lucky finding out your neigbours internet trail.

Only one problem, if someone has a very common surname you will get too many positives, but besides that, I highly reccomend 123people for those in need of doing a background search on someone who may or may not be who he/she says he/she is.

If you are still posting your email and address on public forums it is about time you seriously thought about the consequences and how it can be used against you one day.

123peoplesearch

http://www.123people.com

Altought 123people is great, it is still reccomendable you combine it with the power of Google Advanced Search, two Google links inmensely overlooked:

Google Advanced Image Search

Google Advanced Seach

Interview with a computer forensics expert

November 26th, 2008 Comments Off

I thought this was a cool interview, if you already know about computer forensics you may find you will not learn anyting new here, but I really reccomend to listen to the interview to begginers who have no clue what a computer forensics expert does.

One day it may be one of the bad guys who takes your computer away, you better know what they do before your private computer life becomes an open book. You may also want to look at the other posts I have tagged with computer forensics.

Review: Free speech webhost Crisishost

November 19th, 2008 4 Comments

Crisishost has been in the free speech webhosting business since 2003 and they advertise themselves as a Professional and reliable free speech webhosting, as someone who has been one of his customers I can tell you for sure that their advertising is nothing but a joke.

The Good Stuff

They call themselves a free speech host and they really are, no matter what controversial neonazi or pedophile site you want to host with them, they will host it! As long as it is legal in the USA of course, that is where Crisishost management and servers are based, the last traceroute (2nd November 2008) to their server revealed that their server is located at The Planet datacenter, a well known place for dedicated and colocation servers.

Besides the fact that they will host your controversial site with no questions asked, nor hassle, and their reasonable prices, I couldn’t find anything else good about them.

The Bad Stuff

Keep every single email you receive from Josh! Josh is the guy behind Crisishost, he will be prone to lose your emails and forget things, so you better keep a copy of everything he sends you, that includes Paypal receipts.

1- I make the payment via Paypal two days later I have to email him to ask to set my account up, Josh quickly replies, sets up my hosting account and apologies about the delay.

2- A few days later I send an email to Josh asking some CPanel (webhosting control panel) related question, he does not reply, I send a second email with the same question, he doesn’t reply neither, so it then becomes pretty obvious he is simply ignoring them.

3- I email Josh to upgrade my plan to get more bandwith, no problem, reply in less than 24 hours and all set up quickly. A few days later I email him asking something else about the hosting, no reply again, “Why bother anymore?” crosses my mind.

4- I visit my website and I see that the server has gone down, the disruption will go on for two whole days, I never get any kind of warning from Crisishost, and knowing Josh email habit of not replying to any email not related to payments I decide not to waste my time asking. Crisishost webpage has no update about any downtime.

5- I get an email from Josh asking for renewal of payment, I email him back with evidence of Paypal payment that already covers that period, the guy even doesn’t reply to apologise for his mistake or anything.

6- I get an email from Josh, three short lines to inform me that they are moving servers and I have four days to back up all my data locally and will possibly have to reupload it all again to the new server.

Conclusion

Crisishost will not bother you about your website content if this is legal in the USA, their prices are reasonable, and they use CPanel for webhosting which is pretty cool, but if you ever need any kind of technical support you will be on your own.

Any email asking questions will not get a reply, your site will be up and running as long as their server doesn’t go down, if it does nobody will warn you. You may also get a short notice one day telling you to back up all your data and reupload.

I think there are better free speech hosting offerings out there and I will review them soon, so stay tuned.

I am hotlinking this review to Crisishost so they will know about it, if anyone wants to reply they are more than welcome to do so in the comments section, I don’t censor anybody on this blog unless it is a spammer.

Hard drive destruction with Thermite

November 12th, 2008 Comments Off

You don’t have to do this unless you are really nuts, I include this video of a hard drive drestruction with thermite as a curiosity more than anything else.

If you need to wipe your hard disk completely I reccomend you use DBAN which is free and open source and it will work for any operating system, DBAN works as a live CD and you only have to follow the instructions on the screen, it is really easy to use.

As hard disks get cheaper you may also consider to simply replace it, and use a handheld butane torch for melting the plates of the old hard disk containing the confidential data.

For those who don’t know, a thermite reaction is a process in which the correct mixture of metallic fuels are combined with a metal oxidizer and ignited. Ignition requires extremely high temperatures, but once ignited, thermite supplies its own source of oxygen.

Making thermite is also probably illegal as it could be used to build pretty powerful incendiary devices. The explosion you will see in the video was achieved with 1 pound of thermite in a clay flower pot and lighting from the drain hole in the bottom.

Video: Echelon, The Most Secret Spy System

November 6th, 2008 Comments Off

ECHELON: THE MOST SECRET SPY SYSTEM 3 OF 3
by Top-Notch112

Using secure FTP for data transfer

October 31st, 2008 Comments Off

Anyone with a website is likely to upload the data via FTP but this protocol is easily intercepted with the worst part being that in FTP even the passwords and usernames are sent in the clear. Packet sniffers such as Wireshark can easily intercept it. This is why I reccomend you use SFTP instead, aka Secure File Transfer Protocol or Secure FTP.

Weak spot

Before establishing a connection, the SFTP server sends an encrypted fingerprint of its public host keys to ensure that the SFTP connection will be exchanging data with the correct server. The first time the connection is established, this key is not yet known to the client program and must therefore be confirmed by the user before data is exchanged for the first time, that is when a SFTP connexion will be vulnerable to man in the middle attack, you need to make sure that the digital key given to you by the host, aka fingerprint, is the correct one and has not been tampered with.

How to use SFTP with Filezilla

I use Filezilla to manage this site and it is a great free open source FTP client, but using SFTP in Filezilla is very little intuitive, you will have to open the site manager first and from the drop down menu chosse “SFTP -SSH File Transfer Protocol”, you cant simply enter the SFTP port in the toolbar in Filezilla it will not work if you do that.

Filezilla site manager

Be aware that not all FTP clients and not all webhosts support SFTP! You will need to make sure they do before you use them, and your host will have to enable SSH access for you (most times this is disabled by default) otherwise it won’t work neither.

Sponsor:

Countermeasures against the UK Communications Data Bill

October 22nd, 2008 2 Comments

In order to protect British citizens from crime the UK government has come up with an idea, a law called The Communications Data Bill.

Every email within, or coming into or out of the UK will be time stamped and logged (email content not included, at this stage), and websites will be tracked so that the ayone that the UK government believes could be interested in your private data will be granted access to it.

My blog is not as much about making a case for privacy, but about teaching people how to secure their lives from unwanted guests, so I go straight about how you render useless The UK Communications Data Bill.

1) Never use your British ISP to send email, use webmail instead and make sure it is not a British webmail provider, use SSL in all your email communications, for extra security from eavesdroppers, illegal wihout a court order, but you never know what a government obssessed with controlling its citizens is capable of doing.

2) Change your computer MAC address every week, you can use a free utility called Technitium MAC Address Changer for this. It will make locating your computer more difficult, ISPs log your MAC address when you connect to them.

3) Only browse the internet through an pseudoanonymous VPN that will stop your ISP from logging any website you visit, like for example the paid for Steganos VPN that claims not to keep any logs, they dont have to because they are not an ISP, or use a proxy like tor safer than a VPN and free but very slow for downloading data.

4) Dont use your phone for making calls, use your favourite voice over IP utility with Zphone instead, VoIP will not record your calls like phone companies have to do, and Zphone is a free an open source utility that will encrypt the content of your calls to stop Jacqui Smith from watching and listening your private calls.

5) Wear a cap when you walk through the British streets, if you believe Jacqui Smith is after you, you need to know that some British CCTV have automatic facial face recognision installed, (at the moment mainly at airports), you probably dont want them to see you going into that SexShop a cap will make it difficult for CCTV located above you to recognise your face due to the shadow.

I could go a little further, one of the sponsors of this blog, Spyworld sells counter surveillance goodies that will upset Jacqui in her attempt to know everything about everyone, feel free to visit them.

Backup of your own passport chip

October 20th, 2008 Comments Off

The Hackers Choice (THC/vonJeek) has released an emulator applet that allows you to create a backup of your own passport chip(s). It can be downloaded for free here:

http://freeworld.thc.org/thc-epassport/

You can also use the tool for modification. For example, if you don’t like your picture, you can change it. Or, if you don’t want someone to know your real name, then change that too, but of course that would be illegal.

Darkmarket administrator was and undercover FBI agent

October 15th, 2008 Comments Off

Leaked documents show that the FBI had access to DarkMarket since November 2006 and was monitored by the FBI from the banks of the Monongahela River in Pittsburgh.

For the last two years cybercriminals involved in credit card fraud had been using Darkmartet, an internet forum which offered a place to flog stolen credit card information and identities plus hardware, and credit card magstripe swipe.

During all this time Federal agents used intelligence from the site to develop intelligence reports and mount investigations but keeping the site alive, crunch time has come!

big brother watch

But even the FBI makes mistakes and most clued up cybercrimimals were aware that DarkMarket was a federal sting since the latter part of 2006, after a hacker reported evidence that Master Splynter and admistrator of Darkmarket and undercover FBI agent, had logged in from the National Cyber Forensics Training Alliance in Pittsburgh. One would have believed than an expert FBI agent would have known better than doing such thing.

You can read the article about this sting operaton in Wired.

Darkmarket.ws is now obviously offline, and you can only see the forum frontpage in the Wayback Machine:

http://web.archive.org/web/20070123224221/www.darkmarket.ws/index.php

Privacy Lover

Computer privacy and security for the paranoid