Tag: security

  • Obscura —> Mullvad —> Internet

    Obscura —> Mullvad —> Internet

    screenshot from obscura.net. Headline, "Private by Design: Our Two-Party VPN Protocol". 

Body copy left, "Obscura never sees your traffic
Obscura's servers relay your connection to exit servers but can never decrypt your traffic.
Your traffic is always end-to-end encrypted via
WireGuard® to the exit server."

Body copy right, "Exit hops never see who you are
Exit servers (run by Mullvad) connect you to the internet but never see your personal info.
Obscura masks your real IP address when relaying to the exit server."

Pixelated design at top of window holding content. Image of a line drawn to the obscura icon, then to a server icon, then to a globe icon.

Obscura's website header up top with links including "Download for macOS"

    I’m experimenting with Obscura VPN.

    I’m largely curious about how they’re chaining Obscura —> Mullvad —> Internet.

    “Traffic first passes through Obscura’s servers before exiting to the Internet via Mullvad’s WireGuard servers. This two-party architecture ensures that neither Obscura nor Mullvad can see both your identity and your Internet traffic.”
    Via: Mullvad has partnered with Obscura VPN

    According to Obscura’s FAQ:

    Obscura is provably private by design.

    Even “no-logs” VPNs see both your identity and your internet activity, meaning you have to blindly trust their pinky-promise for privacy. This is exactly why some privacy-conscious folks will tell you not to use a VPN at all.

    Obscura is different – we never see your decrypted internet packets. It’s simply impossible for us to log your internet activity, even if we were compelled to, or if our servers were compromised. You can even verify this yourself.

    Obscura’s stealth protocol is much harder to block.

    Our unique stealth protocol is designed to blend in with regular internet traffic. It does so by leveraging QUIC – the same technology that powers HTTP/3 – making it far harder for censors or network filters to detect or block.

    Not too shabby:

    Screenshot of full speed.cloudflare.com website test results. Shows download and upload measurements as well as latency and jitter. Everything looks pretty snappy.
  • Meredith Whittaker + Signal + You Caring about Privacy

    Meredith Whittaker + Signal + You Caring about Privacy

    The State of Personal Online Security and Confidentiality · SXSW 2025

    Meredith Whittaker making the case for why you should be using Signal.

    No excuses.
    Tolerance has been reduced to zero.

    Hero Image: Jan Zappner/re:publica
    https://commons.wikimedia.org/wiki/File:Re-publica_23_-Tag_1(52952663983).jpg

  • Ring reintroduces video sharing with police

    The Verge

    While I’m already familiar, that Bruce Schneier share got me to take another look at the Ring doorbell relationship with law enforcement.

    This time I caught the heartwarming mention, “Ring is ‘exploring a new integration with Axon that would enable livestreaming from Ring devices.’”

    good lookin’ out

  • Digital Threat Modeling Under Authoritarianism

    Schneier on Security

    The mighty Bruce Schneier breaking down the existing data about us, how it’s collected, how it’s used and what you personally might want to consider given your situation.

    Compute technology is constantly spying on its users—and that data is being used to influence us. Companies like Google and Meta are vast surveillance machines, and they use that data to fuel advertising. A smartphone is a portable surveillance device, constantly recording things like location and communication.

    What’s different in a techno-authoritarian regime is that this data is also shared with the government, either as a paid service or as demanded by local law. Amazon shares Ring doorbell data with the police. Flock, a company that collects license plate data from cars around the country, shares data with the police as well.

    Imagine there is a government official assigned to your neighborhood, or your block, or your apartment building. It’s worth that person’s time to scrutinize everybody’s social media posts, email, and chat logs.

  • VirusTotal Firefox Browser Extension

    VirusTotal Firefox Browser Extension

    Something I try to share with people is the need to test links before you click them. Not all links, but anything suspicious. For me that means anything I receive via email.

    VirusTotal has been a tool/service I’ve been using for a long while. Their browser extension facilitates the scanning of suspicious links by situating the functionality into the context sensitive menu triggered by a right click.

    Screenshot of the NYSee.nyc homepage. A context sensitive menu is displayed with the item, "Preview of VT4Browsers + Google TI
VT4Browsers + Google TI" toggled open and the option "Scan selected link" highlighted.
    Screenshot of a VirusTotal URL scan results page. Information about the safety of the scanned link is displayed with the summary up top and the indiviual vendors scan results are displayed in a table below.

    Selecting that menu option triggers the VirusTotal URL scan page to open and initiates the scan of that link. Results of that scan are returned and from those you can decide for yourself if you trust what’s on the other side of that link.

    Screenshot of the VT4Browsers + Google TI firefox extension page. Details about the extension are displayed with a "Remove" button to their right. Below are screenshots showing the functionality of the extension.

    May your clicks be merry and bright

    https://addons.mozilla.org/en-US/firefox/addon/vt4browsers

  • It’s Time for the VPN Industry to Innovate (Obscura Interview)

    Techlore Talks

    You don’t have to trust Obscura—you just have to trust that not both Obscura and Mullvad are compromised.

  • Kismet: a One Month Run

    Kismet: a One Month Run

    I’ve just closed out the Kismet process I had running around the clock for just over a month.

    In that month the database files, which I had rotating daily were typically growing to 5GB before flipping. The total data collected is roughly 150GB.

    $ du -sh ./*
    49G	./kismet
    100G	./kismet_logs
    
    # And the log files themselves
    
    ┌── kismet
    │   ├── logged
    │   │   ├── capture-20251213.kismet
    │   │   ├── capture-20251215.kismet
    │   │   ├── capture-20251216.kismet
    │   │   ├── capture-20251217.kismet
    │   │   ├── capture-20251218.kismet
    │   │   ├── capture-20251219.kismet
    │   │   ├── capture-20251220.kismet
    │   │   ├── capture-20251221.kismet
    │   │   ├── capture-20251222.kismet
    │   │   └── capture-20251223.kismet
    │   └── processed
    │       ├── 20251215
    │       ├── 20251216
    │       ├── 20251217
    │       ├── 20251218
    │       ├── 20251219
    │       ├── 20251220
    │       ├── 20251221
    │       ├── 20251222
    │       ├── 20251223
    │       └── boop
    └── kismet_logs
        ├── capture-20251224.kismet
        ├── capture-20251225.kismet
        ├── capture-20251226.kismet
        ├── capture-20251227.kismet
        ├── capture-20251228.kismet
        ├── capture-20251229.kismet
        ├── capture-20251230.kismet
        ├── capture-20251231.kismet
        ├── capture-20260101.kismet
        ├── capture-20260102.kismet
        ├── capture-20260103.kismet
        ├── capture-20260104.kismet
        ├── capture-20260105.kismet
        ├── capture-20260106.kismet
        ├── capture-20260107.kismet
        ├── capture-20260108.kismet
        ├── capture-20260109.kismet
        ├── capture-20260110.kismet
        ├── capture-20260111.kismet
        ├── capture-20260112.kismet
        ├── capture-20260113.kismet
        ├── capture-20260114.kismet
        ├── capture-20260115.kismet
        └── capture-20260116.kismet

    In that processed directory is data I experimented with early on. I hadn’t and still haven’t put much time into it, but was mostly curious about how discreet, as in how unique individual devices are. Much of it generally is.

    It’s really not about the static devices around me. I’m more focused on the devices passing my apartment window.

    Turns out it was trivial to identify an individual device and recognize it every time it passed by. Creepy. Yes. Alarming. Also yes.

    We bleed massive amounts of data as we walk down the street. I want to know what that data is, and from that, how that data might be used by others. That data you’re (un)knowingly sharing is being collected on a massive scale, then is turned around and sold to just about anyone who’s interested in paying for it.

    The United States has some of the most disgracefully absent privacy laws in the world. Advertisers have found that your data is especially valuable, allowing them to build profiles to better target you with ads. They know an astonishing amount of information about us.

    Many say they know more about us than we do ourselves.

    I have lots to share about this. In the coming days and weeks, as I dive into and start working with the data, I’ll expand on what that data actually is, how it’s being used and what you might consider in adjusting—or not—your habits with that information in mind.

    While transforming this data into information, it will simultaneously be transformed into visual form. Exactly what that will look like I’m unsure of at the moment. I like to see where an idea takes me, and to watch how the process governs the eventual shape it takes.

    Maybe this knowledge prompts you to make adjustments. Maybe you’ll become aware of these things and simply move on as, who knows, your unknowingly surrendered data might make the groceries in your cart cheaper than the identical groceries in the cart of the person behind you. However, maybe the algorithm thinks you’re rich. Prepare to pay more for that flight (via Harvard’s Berkman Klein Center for Internet & Society).

  • How CAPTCHAs work | What does CAPTCHA mean?

    Cloudflare Learning Center

    How does reCAPTCHA work without any user interaction?

    The latest versions of reCAPTCHA are able to take a holistic look at a user’s behavior and history of interacting with content on the Internet. Most of the time, the program can decide based on those factors whether or not the user is a bot, without providing the user with a challenge to complete. If not, then the user will get a typical reCAPTCHA challenge.

    If I were stopped and asked on the street to choose a CAPTCHA, image recognition reCAPTCHAs are by far my fav CAPTCHA. I consider it a success on my part whenever I’m confronted with these. Don’t get me wrong, these are annoying af, but it signals to me that they know little about me, something I go to great lengths, and forfeit a lot of convenience to achieve.

    CAPTCHA me if you can.