It’s 2020. Is Using Public Wi-Fi Still Dangerous?

A free Wi-Fi sign on a brick wall.
Is Public Wi-Fi Safe or Not?

This is a complicated topic. It’s true that browsing on public Wi-Fi is much safer and more private than it used to be thanks to the widespread embrace of HTTPS on the web. Other people on the public Wi-Fi network can’t just snoop on everything you’re doing. Man-in-the-middle attacks aren’t as trivially easy as they used to be.

The EFF recently came down on the side of public Wi-Fi being safe, writing that “There are plenty of things in life to worry about. You can cross ‘public Wi-Fi’ off your list.”

That sounds like sensible advice. And it’d be great if public Wi-Fi was completely safe! We’ve certainly used public Wi-Fi ourselves, and we don’t worry about it as much as we used to.

But, if you’re asking us whether Wi-Fi is entirely safe, we can’t say that. David Lindner at Contrast Security wrote a counterpoint to the EFF’s argument, pointing out the risks of malicious hotspots. The community over at Hacker News had quite a few thoughts about the dangers of public Wi-Fi, too. We’ve tried to explain the risks below.

Here’s the bottom line: Random people aren’t going to snoop on your activities on public Wi-Fi anymore. But it would be possible for a malicious hotspot to do a bunch of bad things. Using a VPN on a public Wi-Fi network or avoiding public Wi-Fi in favor of your cellular data network is safer.

Why Public Wi-Fi Is Safer Than Ever

Widespread HTTPS encryption on the web has fixed the main security problem with public Wi-Fi. Before HTTPS was widespread, most websites used unencrypted HTTP. When you accessed a standard website over HTTP on public Wi-Fi, other people on the network could snoop on your traffic, viewing the exact web page you were viewing and monitoring any messages and other data you sent.

Worse yet, the public Wi-Fi hotspot itself could perform a “man in the middle” attack, modifying the web pages sent to you. The hotspot could change any web page or other content accessed over HTTP. If you downloaded software over HTTP, a malicious public Wi-Fi hotspot could give you malware instead.

Now, HTTPS has become widespread, and web browsers are branding traditional HTTP sites “not secure.” If you connect to a public Wi-Fi network and access websites over HTTPS, other people on the public Wi-Fi network can see the domain name of the site you’re connected to (for example, howtogeek.com), but that’s it. They can’t see the specific web page you’re viewing, and they certainly can’t tamper with anything on the HTTPS site in transit.

The amount of data people can snoop on has gone way down, and it’d be harder for even a malicious Wi-Fi network to tamper with your traffic.

Some Snooping Is Still Possible

While public Wi-Fi is now much more private, it’s still not completely private. For example, if you’re browsing the web, you might end up on an HTTP site eventually. A malicious hotspot could have tampered with that web page as it was sent to you, and other people on the public Wi-Fi network would be able to monitor your communications with that site—which web page you’re looking at on it, the exact content of the web page you’re looking at, and any messages or other data you upload.

Even when using HTTPS, there’s still a bit of snooping potential. Encrypted DNS isn’t yet widespread, so other devices on the network can see your device’s DNS requests. When you connect to a website, your device contacts its configured DNS server over the network and finds the IP address connected to a website. In other words, if you’re connected to a public Wi-Fi network and browsing the web, someone else nearby could monitor which websites you visit.

However, snooper wouldn’t be able to see the specific web pages you were loading on that HTTPS site. For example, they’d know that you were connected to google.com but not which article you were reading. They would also be able to see some other information, such as the amount of data being transferred back and forth—but not the contents of the data.

A malicious Wi-Fi hotspot could redirect you to malicious websites. If you connect to a malicious Wi-Fi hotspot and try to connect to bankofamerica.com, it could forward you to the address of a phishing site impersonating your real bank. The hotspot could execute a “man in the middle attack,” loading the real bankofamerica.com and presenting you a copy of it over HTTP. When you sign in, you’d be sending your login details to the malicious hotspot, which could capture them.

That phishing site wouldn’t be an HTTPS site, but would you really notice the HTTP in your browser’s address bar? Techniques like HTTP Strict Transport Security (HSTS) allow websites to tell web browsers that they should only connect over HTTPS and never use HTTP, but not every website takes advantage of that.

Apps, in general, could also be a problem—do all the apps on your smartphone correctly validate certificates? Is every application on your computer configured to transfer data over HTTPS in the background, or are there some applications automatically using HTTP instead? In theory, applications should be correctly validating certificates and avoiding HTTP in favor of HTTPS. In practice, it’d be tough to confirm every app is behaving correctly.

Other devices on the network could also be a problem. For example, if you’re using a computer or other device with unpatched security holes, your device could be attacked by other devices on the network. That’s why Windows PCs come with a firewall enabled by default and why that firewall is more restrictive when you tell Windows you’re connected to public Wi-Fi instead of a private Wi-Fi network. If you tell the computer you’re connected to a private network, your network shared folders may be made available to other computers on the public Wi-Fi.

How to Protect Yourself Anyway

While public Wi-Fi is safer and more private than it used to be, the security picture is still messier than we’d like.

For maximum protection on public Wi-Fi networks, we still recommend a VPN. When you use a VPN, you connect to a single VPN server, and all of your system’s traffic is routed through an encrypted tunnel to the server. The public Wi-Fi network you’re connecting to sees a single connection—your VPN connection. No one can even see which websites you’re connecting to.

That’s a big reason why businesses use VPNs (virtual private networks.) If your organization makes one available to you, you should seriously consider connecting to it when you’re on public Wi-Fi networks. However, you can pay for a VPN service and route your traffic through there when you use networks you don’t completely trust.

You could also skip public Wi-Fi networks entirely. For example, if you have a cellular data plan with wireless hotspot (tethering) capabilities and a solid cellular connection, you could connect your laptop to your phone’s hotspot in public and avoid the potential problems involved in public Wi-Fi.

[mai mult...]

What Is Credential Stuffing? (and How to Protect Yourself)

A silhouette of a padlock in front of a Zoom logo.

A total of 500 million Zoom accounts are for sale on the dark web thanks to “credential stuffing.” It’s a common way for criminals to break into accounts online. Here’s what that term actually means and how you can protect yourself.

It Starts With Leaked Password Databases

Attacks against online services are common. Criminals often exploit security flaws in systems to acquire databases of usernames and passwords. Databases of stolen login credentials are often sold online on the dark web, with criminals paying in Bitcoin for the privilege of accessing the database.

Let’s say you had an account on the Avast forum, which was breached back in 2014. That account was breached, and criminals may have your username and password on the Avast forum. Avast contacted you and had you change your forum password, so what’s the problem?

Unfortunately, the problem is that many people reuse the same passwords on different websites. Let’s say your Avast forum login details were “you@example.com” and “AmazingPassword.” If you logged into other websites with the same username (your email address) and password, any criminal who acquires your leaked passwords can gain access to those other accounts.

Credential Stuffing in Action

“Credential stuffing” involves using these databases of leaked login details and trying to log in with them on other online services.

Criminals take large databases of leaked username and password combinations—often millions of login credentials—and try to sign in with them on other websites. Some people reuse the same password on multiple websites, so some will match. This can generally be automated with software, quickly trying many login combinations.

For something so dangerous that sounds so technical, that’s all it is—trying already leaked credentials on other services and seeing what works. In other words, “hackers” stuff all those login credentials into the login form and see what happens. Some of them are sure to work.

This is one of the most common ways that attackers “hack” online accounts these days. In 2018 alone, the content delivery network Akamai logged nearly 30 billion credential-stuffing attacks.

How to Protect Yourself

Protecting yourself from credential stuffing is pretty simple and involves following the same password security practices security experts have been recommending for years. There’s no magic solution—just good password hygiene. Here’s the advice:

  • Avoid Reusing Passwords: Use a unique password for each account you use online. That way, even if your password leaks, it can’t be used to sign in to other websites. Attackers can try to stuff your credentials into other login forms, but they won’t work.
  • Use a Password Manager: Remembering strong unique passwords is a nearly impossible task if you have accounts on quite a few websites, and almost everyone does. We recommend using a password manager like 1Password (paid) or Bitwarden (free and open-source) to remember your passwords for you. It can even generate those strong passwords from scratch.
  • Enable Two-Factor Authentication: With two-step authentication, you have to provide something else—like a code generated by an app or sent to you via SMS—each time you log in to a website. Even if an attacker has your username and password, they won’t be able to sign in to your account if they don’t have that code.
  • Get Leaked Password Notifications: With a service like Have I Been Pwned?, you can get a notification when your credentials appear in a leak.
How Services Can Protect Against Credential Stuffing

While individuals need to take responsibility for securing their accounts, there are many ways for online services to protect against credential-stuffing attacks.

  • Scan Leaked Databases for User Passwords: Facebook and Netflix have scanned leaked databases for passwords, cross-referencing them against login credentials on their own services. If there’s a match, Facebook or Netflix can prompt their own user to change their password. This is a way of beating credential-stuffers to the punch.
  • Offer Two-Factor Authentication: Users should be able to enable two-factor authentication to secure their online accounts. Particularly sensitive services can make this mandatory. They can also have a user click a login verification link in an email to confirm the login request.
  • Require a CAPTCHA: If a login attempt looks strange, a service can require entering a CAPTCHA code displayed in an image or clicking through another form to verify a human—and not a bot—is attempting to sign in.
  • Limit Repeated Login Attempts: Services should attempt to block bots from attempting a large number of sign-in attempts in a short period of time. Modern sophisticated bots may attempt to sign in from multiple IP addresses at once to disguise their credential-stuffing attempts.

Poor password practices—and, to be fair, poorly secured online systems that are often too easy to compromise—make credential stuffing a serious danger to online account security. It’s no wonder many companies in the tech industry want to build a more secure world without passwords.

[mai mult...]

How to Encrypt and Decrypt Files With GPG on Linux

Linux terminal window on a laptop

Protect your privacy with the Linux gpg command. Use world-class encryption to keep your secrets safe. We’ll show you how to use gpg to work with keys, encrypt files, and decrypt them.

GnuPrivacy Guard (GPG) allows you to securely encrypt files so that only the intended recipient can decrypt them. Specifically, GPG complies with the OpenPGP standard. It is modeled on a program called Pretty Good Privacy (PGP). PGP was written in 1991 by Phil Zimmerman.

GPG relies on the idea of two encryption keys per person. Each person has a private key and a public key. The public key can decrypt something that was encrypted using the private key.

To send a file securely, you encrypt it with your private key and the recipient’s public key. To decrypt the file, they need their private key and your public key.

You’ll see from this that public keys must be shared. You need to have the public key of the recipient in order to encrypt the file, and the recipient needs your public key to decrypt it. There is no danger in making your public keys just that—public. In fact, there are Public Key Servers for that very purpose, as we shall see. Private keys must be kept private. If your public key is in the public domain, then your private key must be kept secret and secure.

There are more steps involved in setting up GPG than there are in using it. Thankfully, you usually need only set it up once.

Generating Your Keys

The gpg command was installed on all of the Linux distributions that were checked, including Ubuntu, Fedora, and Manjaro.

You don’t have to use GPG with email. You can encrypt files and make them available for download, or pass them physically to the recipient. You do need to associate an email address with the keys you generate, however, so choose which email address you are going to use.

Here is the command to generate your keys. The --full-generate-key option generates your keys in an interactive session within your terminal window. You will also be prompted for a passphrase. Make sure you remember what the passphrase is. Three or four simple words joined together with punctuation is a good and robust model for passwords and passphrases.

gpg --full-generate-key

gpg --full-generate-key in a terminal window

You will be asked to pick an encryption type from a menu. Unless you have a good reason not to, type 1 and press Enter.

You must choose a bit-length for the encryption keys. Press Enter to accept the default.

key generation questions in a terminal window

You need to specify how long the key should last. If you are testing the system, enter a short duration like 5 for five days. If you are going to keep this key, enter a longer duration like 1y for one year. The key will last 12 months and so will need renewing after one year. Confirm your choice with a Y.

You must enter your name and your email address. You can add a comment if you wish.

key generation questions in a terminal window

You will be prompted for your passphrase. You will need the passphrase whenever you work with your keys, so make sure you know what it is.

gpg passphrase window

Click the OK button when you have entered your passphrase. You’ll see this window as you work with gpg, so make sure you remember your passphrase.

The key generation will take place, and you will be returned to the command prompt.

gpg key generation completed in a terminal window

Generating a Revocation Certificate

If your private key becomes known to others, you will need to disassociate the old keys from your identity, so that you can generate new ones. To do this, you will require a revocation certificate. We’ll do this now and store it somewhere safe.

The --output option must be followed by the filename of the certificate you wish to create. The --gen-revoke option causes gpg to generate a revocation certificate. You must provide the email address that you used when the keys were generated.

gpg --output ~/revocation.crt --gen-revoke dave-geek@protonmail.com

gpg --output ~/revocation.crt --gen-revoke dave-geek@protonmail.com in a terminal window

You will be asked to confirm you wish to generate a certificate. Press Y and hit Enter.  You will be asked for the reason you are generating the certificate. As we’re doing this ahead of time, we don’t know for sure. Press 1 as a plausible guess and hit Enter.

You can enter a description if you wish. Press Enter twice to end your description.

You will be asked to confirm your settings, press Y and hit Enter.

gpg certificate questions in a terminal window

The certificate will be generated. You will see a message reinforcing the need to keep this certificate safe.

It mentions someone called Mallory. Cryptography discussions have long used Bob and Alice as the two people communicating. There are other supporting characters. Eve is an eavesdropper, Mallory is a malicious attacker. All we need to know is we must keep the certificate safe and secure.

As a minimum, let’s remove all permissions apart from ours from the certificate.

chmod 600 ~/revocation.crt

chmod 600 ~/revocation.crt  in a terminal window

Let’s check with ls to see what the permission are now:

ls -l

http://cryptocouple.com/ in a terminal window

That’s perfect. No one apart from the file owner—us—can do anything with the certificate.

Importing Someone Else’s Public Key

To encrypt a message that another person can decrypt, we must have their public key.

If you have been provided with their key in a file, you can import it with the following command. In this example, the key file is called “mary-geek.key.”

gpg --import mary-geek.key

gpg --import mary-geek.key ina terminal window

The key is imported, and you are shown the name and email address associated with that key. Obviously, that should match the person you received it from.

successfully imported key in a terminal window

There is also the possibility that the person you need a key from has uploaded their key to a public key server. These servers store people’s public keys from all over the world. The key servers synchronize with one another periodically so that keys are universally available.

The MIT public key server is a popular key server and one that is regularly synchronized, so searching there should be successful. If someone has only recently uploaded a key, it might take a few days to appear.

The --keyserver option must be followed by the name of the key server you wish to search. The --search-keys option must be followed by either the name of the person you are searching for or their email address.  We’ll use the email address:

gpg --keyserver pgp.mit.edu --search-keys mary-geek@protonmail.com

gpg --keyserver pgp.mit.edu --search-keys mary-geek@protonmail.com in a terminal window

Matches are listed for you and numbered. To import one, type the number and press Enter. In this case, there is a single match, so we type 1 and press Enter.

gpg keyserver results in a terminal window

The key is imported, and we are shown the name and email address associated with that key.

Verifying and Signing a Key

If you have been handed a public key file by someone known to you, you can safely say it belongs to that person. If you’ve downloaded it from a public key server, you may feel the need to verify that the key belongs to the person it is meant to.

The --fingerprint option causes gpg to create a short sequence of ten sets of four hexadecimal characters. You can ask the person to send you the fingerprint of their key.

You can then use the --fingerprint option to generate the same fingerprint sequence of hexadecimal characters and compare them. If they match, you know that the key belongs to that person.

gpg --fingerprint mary-geek@protonmail.com

gpg --fingerprint mary-geek@protonmail.com in a terminal window

The fingerprint is generated.

gpg fingerprint in a terminal window

When you’re satisfied that the key is genuine and is owned by the person it is supposed to be associated with, you can sign their key.

If you don’t do this, you can still use it to encrypt and decrypt messages from and to that person. But gpg will ask you every time whether you wish to proceed because the key is unsigned. We’ll use the aptly named --sign-key option and provide the email address of the person, so that gpg knows which key to sign.

gpg --sign-key mary-geek@protonmail.com

gpg --sign-key mary-geek@protonmail.com in a terminal window

You’ll see information about the key and the person, and will be asked to verify you really want to sign the key. Press Y and hit Enter to sign the key.

gpg key signing confirmation in a terminal window

How To Share Your Public Key

To share your key as a file, we need to export it from the gpg local key store. To do this, we’ll use the --export option, which must be followed by the email address that you used to generate the key. The --output option must be followed by the name fo the file you wish to have the key exported into. The --armor option tells gpg to generate ASCII armor output instead of a binary file.

gpg --output ~/dave-geek.key --armor --export dave-geek@protonmail.com

gpg --output ~/dave-geek.key --armor --export dave-geek@protonmail.com in a terminal window

We can take a look inside the key file with less.

less dave-geek.key

public key file in less in a terminal window

The key is shown in all its glory:

public key file in less in a terminal window

You can also share your public key on a public key server. The --send-keys option sends the key to the keyserver. The --keyserver option must be followed by the web address of the public key server. To identify which key to send, the fingerprint for the key must be provided on the command line. Note there are no spaces between the sets of four characters.

(You can see the fingerprint for your key by using the --fingerprint option.)

gpg --send-keys --keyserver pgp.mit.edu 31A4E3BE6C022830A804DA0EE9E4D6D0F64EEED4

gpg --send-keys --keyserver pgp.mit.edu 31A4E3BE6C022830A804DA0EE9E4D6D0F64EEED4 in a terminal window

You’ll get confirmation that the key has been sent.

confirmation key has been sent to key server in a terminal window

Encrypting FIles

We’re finally ready to encrypt a file and send it to Mary. The file is called Raven.txt.

The --encrypt option tells gpg to encrypt the file, and the --sign option tells it to sign the file with your details. The --armor option tells gpg to create an ASCII file. The -r (recipient) option must be followed by the email address of the person you’re sending the file to.

gpg --encrypt --sign --armor -r mary-geek@protonmail.com

gpg --encrypt --sign --armor -r mary-geek@protonmail.com in a terminal window

The file is created with the same name as the original, but with “.asc” appended to the file name. Let’s have a look inside it.

less Raven.txt.asc

less Raven.txt.asc in a terminal window

The file is completely illegible, and can only be decrypted by someone who has your public key and Mary’s private key. The only person to have both of those should be Mary.

Encrypted content of raven.txt.asc in a terminal window

We can now send the file to Mary confident that no one else can decrypt it.

Decrypting Files

Mary has sent a reply. It is in an encrypted file called coded.asc. We can decrypt it very easily using the --decrypt option. We are going to redirect the output into another file called plain.txt.

Note that we don’t have to tell gpg who the file is from. It can work that out from the encrypted contents of the file.

gpg --decrypt coded.asc > plain.txt

gpg --decrypt coded.asc > plain.txt in a terminal window

Let’s look at the plain.txt file:

less plain.txt

less plain.txt in a terminal window

The file has been successfully decrypted for us.

decrytpted file in less in a terminal window

Refreshing Your Keys

Periodically, you can ask gpg to check the keys it has against a public key server and to refresh any that have changed. You might do this every few months or when you receive a key from a new contact.

The --refresh-keys option causes gpg to perform the check. The --keyserver option must be followed by the key server of your choice. Once the keys have been synchronized between the public key servers, it shouldn’t matter which one you choose.

gpg --keyserver pgp.mit.edu --refresh-keys

gpg --keyserver pgp.mit.edu --refresh-keys in a terminal window

gpg responds by listing the keys it checks and letting you know if any have changed and been updated.

gpg key refreshes in a terminal window

Privacy is a Hot Topic

Privacy is never far from the news these days. Whatever your reasons for wanting to keep your information secure and private, gpg provides a simple means to apply incredibly strong encryption to your files and communications.

There are other ways to use gpg. You can get a plugin for Thunderbird called Enigmail. It hooks right into your gpg configuration to allow you encrypt email messages from inside Thunderbird.

[mai mult...]

How to Delete Your Personal Information From People-Finder Sites

There was a time on the internet when no one would know if you were a dog, but those days are long gone. It’s now incredibly easy to find deeply personal information about someone online thanks to data brokers, more commonly known as “people-finder” sites.

People-finder sites are a veritable treasure trove of information. They often have your address, phone number, email, and age. They even include data from court documents and other public or government records. These days, not only can you find out the breed of a blogging dog, but also the last time he had ringworm.

If you want to check out this seedy underbelly of the web, just Google yourself or a family member. Unless you’re a public figure who’s frequently in the news, the top results will likely be from Whitepages, Spokeo, BeenVerified, and other similar sites.

People-Finders Know a Lot About You

These sites often display an alarming amount of information up front but provide even more behind a paywall. They sometimes prey on the basest of human motivations. For example, BeenVerified teases that you should “check your lover.” If you click for more info, it tends to take an artificially long time to “compile results.” This is a psychological tool designed to make you invest in the process and more likely to shell out some cash when the paywall appears.

Some of these sites are even more unscrupulous than that! In 2011, MyLife.com was sued for scamming people into believing they were being investigated, and then giving them fake names for a fee. The suit was ultimately dismissed, but the site was sued again in 2015 for misleading people into giving up both personal information and cash.

Selling to consumers generally isn’t even the primary business model for these websites—it’s often just a side hustle.

“Selling directly to consumers doesn’t scale,” said Nader Henein, senior research director at Gartner. “Data brokers primarily sell to organizations looking to enrich their information about a large pool of individuals.”

The Spokeo data broker site showing search results for "Dave Johnson."

These sites get some data about you from social media sites. However, most of it comes from public records, like court documents and real estate transactions, or other online data, like search histories.

Many companies are more than willing to sell your information to these data brokers—even seemingly innocuous sources, like warranty and sweepstakes registrations will do so. Unless a form specifically states a company won’t sell your personal information, you can safely assume, sooner or later, it’ll end up on a site like Spokeo.

You can extricate yourself from this sordid affair and delete your personal information from these sites. Depending on your approach, though, it can be either difficult or expensive.

Despite an abundance of advice to the contrary, one thing that probably won’t be terribly effective is reducing your social media footprint. That’s because social media reflects only a tiny percentage of the data these companies collect about you.

“That’s just the tip of the iceberg,” said Henein.

Use the Law to Your Advantage

Depending on where you live, the law might be on your side. While there’s no federal law akin to the National Do Not Call Registry in the U.S., a law took effect in California on Jan. 1, 2020 that protects the 40 million people there.

The California Consumer Privacy Act allows people to, in part, request that their personal information be deleted from websites. It’s similar to the General Data Protection Regulation, a European law that went into effect in 2018.

If you live in California, you can use resources at YourDigitalRights to send data deletion requests to a large number of people-finder sites. The site also offers a browser extension for Chrome and Firefox that will submit a deletion request when you visit an offending website.

A nonprofit organization operates YourDigitalRights. The service is free and doesn’t collect your personal data.

The YourDigitalRights website.

Manually Deleting Yourself from People-Finders

If you don’t live in California, you can still opt out of many people-finders, it’s just a more “manual” process. While some sites might have a link for removing personal information, the actual process could be convoluted.

Spokeo is, perhaps, the simplest. You just find your profile page on the site, go to spokeo.com/optout, and then type (or paste) the link along with your email address so you can confirm.

Others are not as straightforward. At Whitepages, you have to paste the URL to your profile at whitepages.com/suppression_requests, and then type the reason you want to opt-out. After that, you have to provide your phone number—yes, you have to give a data broker your phone number. You then receive a call from a robot, which gives you a verification code you have to type on the website to complete the process.

The ultimate indignity? 411.info actually charges a fee if you want it to remove your info.

“It is illegal in Europe,” Henein said. “But there’s nothing to stop them from charging for this in the U.S.”

Overall, removing your info isn’t hard; it’s just cumbersome and time-consuming, which is intentional. If you want some help, Delete Me offers detailed instructions for a handful of the most common sites. Privacy Duck maintains some video opt-out guides, as well.

Likewise, the Privacy Rights Clearinghouse has a fairly exhaustive database of over 200 data brokers. It also indicates whether each site has a way you can opt-out, although you’ll notice many entries are marked “unclear.” If it’s possible to opt-out, click the company’s name on the left to see the details page, which generally includes a link to the site’s opt-out form.

Opting Out Is an Endless Task

Manually removing yourself from people-finder sites can be a lot of work. And just because you opt out today doesn’t mean you’ll remain opted-out forever. If you move, change your phone number, or have a major life event that’s documented somewhere, you might find these sites add you again.

“When you ask to delete your information, they’re obliged to delete the information today,” said Henein. “But there’s nothing that says they can’t start collecting more information about you moving forward from that point.”

Paying to Delete Yourself from People-Finders

One way to mitigate all this is to sign up for a service that removes your personal data on your behalf. Unfortunately, these are not cheap. Privacy Duck, for example, is ludicrously expensive. The basic service, which cleans up to two people from 91 data-broker sites, costs a heart-stopping $500 per year (the VIP service covers 190 sites for $1,000 a year).

In comparison, DeleteMe is a bargain! This service removes you from 38 common sites for $129 per year, with other plans that go up from there.

Faced with these prices, removing yourself manually might look compelling. Or, you might question whether it’s that important to remove your personal data in the first place.

The DeleteMe website.

The Cost of Privacy Is Eternal Vigilance

Keep in mind that no matter which solution you choose—doing it yourself or investing in a removal service—you’re only removing results from a particular set of sites. If you want to keep your info off these sites forever, eternal vigilance is required.

Your personal info will likely reappear on these sites as they acquire new info about you. So, you’ll still have to clean up on your own if or when you stop paying for a subscription service.

[mai mult...]

How to Enable DNS Over HTTPS in Google Chrome

Google Chrome Logo

Google Chrome supports DNS over HTTPS (DoH) for increased privacy and security. It’s still disabled by default as of Google Chrome 80, but you can enable it using a hidden flag.

Note that Chrome won’t actually use DoH unless you’re configured to use a DNS server that supports DNS over HTTPS. You might have to change your DNS server to take advantage of it. Google Public DNS, Cloudflare, and even Comcast’s DNS all support it.

How to Enable DNS Over HTTPS in Chrome

To enable DoH in Chrome, start by typing or copy-pasting “chrome://flags/#dns-over-https” into the address bar and press Enter.

Open the drop-down menu to the right of “Secure DNS Lookups” and select “Enabled.”

Chrome Enable DoH

Click the “Relaunch” button at the bottom of this page to restart Chrome and activate these changes.

Switch to a DoH-Compatible DNS Server

DNS over HTTPS will work only if your configured DNS server has DoH support. You might need to change your DNS server to take advantage of DoH.

We recommend using Google’s own Google Public DNS or Cloudflare, which is the default DNS server when DoH is enabled for Firefox. Google has a list of DNS providers Chrome can use DoH with, including Cleanbrowsing, Comcast, DNS.SB, OpenDNS, and Quad9. You can check to see if DNS over HTTPS is working in Chrome by visiting Cloudflare’s Browsing Experience Security Check. Run the test by clicking the button and see whether “Secure DNS” is enabled or not.

Fortunately, DNS over HTTPS is becoming standard by default soon. Google plans to enable DoH by default in Chrome 81, due mid-March. However, you’ll still need to use a DoH-compatible DNS server to take advantage of it.

[mai mult...]

How iOS 13 Will Unlock NFC’s Potential

NFC has long been held back by Apple not supporting it—only Android did. Now that both major smartphone platforms will soon support NFC, the technology can reach its full potential. From keyless locks to digital IDs, the future is here.

Three NFC tags on a paper strip.

Apple Pay has always used NFC for contactless payments. If you’ve ever paid for something using your iPhone or Apple Watch, you’ve used NFC.

NFC stands for Near Field Communications, and it’s a set of standards that allow devices to communicate through radio waves when they’re in close proximity. Emphasis on the close, as the devices need to be 4 inches apart or less.

With NFC, you can accomplish a variety of tasks, whether it be sharing data, mobile payments, or tag reading and writing.

NFC isn’t a new technology by any means, but comprehensive support is something we’ve never seen. Android phones have longed enjoyed full NFC support, along with Blackberrys and Windows Phone. But adopting NFC doesn’t guarantee the success of a mobile platform.

But for all the mobile devices that do have NFC, one significant outlier existed: iPhones. While the Android phone with NFC hardware (the Nexus S) released in 2010, it took until 2014 to see an iPhone with NFC hardware (the iPhone 6). And in the beginning, it was locked down to solely payment processing.

That’s been changing over time, and with iOS 13, an iPhone going back to the iPhone 7 will have its NFC potential unlocked. App developers can read and write to NFC tags, read chipped passports and ID cards, unlock NFC-enabled doors, and more.

Use Your iPhone to Unlock Doors

One of the promises of NFC is added convenience to your life. With expanded support in iOS 13, you could not only leave your wallet at home but maybe even your house keys, too.

Some hotels, like Starwood, already have a similar function that relies on Bluetooth and your phone or Apple Watch to unlock your room, but the technology could just as easily use NFC instead (and does in many hotels). More and more business are using NFC cards to grant to access to offices or even protected areas of a workplace. Instead of remembering to attach your badge to your belt with a badge reel, pull out your phone and wave it over the sensor.

You can unlock some smart locks with NFC as well. If you installed an NFC lock in your home, you can forget about one more key you used to carry everywhere. Some apartment complexes are making a move to NFC key fobs as well, and if you have the option, carrying around just a phone will be more convenient.

Digital ID Cards for Your Phone

ReadID app showing a digitized passport on iPhone.

With iOS 13, iPhones will be able to scan NFC chipped IDs and store their details. With appropriate apps, you could then save a digital copy of your ID on your iPhone and pull it up when needed.

If you’ve ever used the Wallet app on iPhone, you’ll know why this is powerful and something to get excited over. Currently, you can digitize credit cards, debit cards, and even some rewards cards and store them in the Wallet app. But you still needed to carry your wallet or purse anyways, because you needed your ID. At that point, why not bring the physical cards and use them too?

But if you can store even your ID on a smartphone, then you can leave the wallet safe at home and have that less to carry.

We’ll have to wait on ID cards to catch up and support both NFC chips and digitization, but companies like RealID are already working on supporting iOS 13 with its passport digitization service.

But E.U residents of Great Britain will benefit even sooner with the release of iOS 13. The U.K. government created an EU Exit app that lets residents scan their passports and apply for to say in the U.K. after Brexit completes. But Apple didn’t support using NFC to scan the passport before. The only option was to Android, even if that meant borrowing a friend’s as the U.K. suggested. Now, Apple will support the feature, and an iOS EU Exit app is in the works.

 

Tagged Transactions Let You Ditch the Apps

A man looking at an iPhone while holding a Bird escooter

Right now, if you want to rent a scooter or bike from Lime or Bird, you first have to download an associated app. That’s not always feasible if you have low data caps, or the app exceeds the cellular download limit. A company can choose to support Apple Pay instead, but that requires a payment terminal, like that tap and pay credit card machines you see in stores.

With iOS 13, companies can strategically place NFC  stickers (for instance, on the scooter) and use those to arrange payment instead of download an app. The process should be faster overall since you won’t need to set up an account or wait for an app install. The change should benefit companies, too, as the ability to forgo an app download will likely spur impulse buys. The more barriers a company can remove, the more likely you’ll give a new service a try, even if just once.

Your iPhone Can Already Be a Transit Pass

Transport stations have been slowly switching to contactless methods for payment and check-in. Combined with Apple pay, you can easily pay for your rides ahead of time and scan through any check areas as needed. You can already do this in New York, Portland, Japan, Beijing, and Shanghai.

Combined with the upcoming digital ID and door unlock capabilities above, you could leave home, get on the subway, and unlock your office without the need for a wallet or keys. If the subway is too busy, catching a cab or renting a scooter with just an app, or soon the NFC tags above, is getting easier every day.

Shortcuts Speed Up Automations

Shortcuts app on iPhone

Siri Shortcuts let you automate sequences of actions, like dimming the screen and setting do not disturb, or texting three friends you are home after a long trip.

While convenient, you either have to speak to your iPhone or triggering it from an app. In iOS 13, you can create shortcuts that trigger when you tap your phone to an NFC tag.

Imagine for a moment you had two tags in your car. You could set one tag to open your preferred maps app, so you don’t have to hunt for it in your folders. The other tag could also open the maps app and insert your home address. While these ideas sound minor, they’re convenient, especially if you’re exhausted after a long day of travel.

You could also stick an NFC tag to your laptop that triggers your iPhone to turn on hotspot when tapped, thus skipping the hassle of digging through to the hotspot settings.

These scenarios aren’t just theory; we’ve used NFC tags and Android phone to accomplish the same goals.

The Two Major Smartphone Platforms Now Support NFC

An iPhone XR and Samsung S8 with NFC tags laying on top of them.
NFC sees use in many scenarios that Apple hasn’t yet explicitly promised to support, but could. Hotels and businesses have long used NFC chips and keyfobs to grant access to rooms or office. Instead out another card or fob, they could add a digital copy to your smartphone, giving one less item to worry about forgetting on the way out the door. Instead of pressing your card or fob to a reader, you would pull out your phone and scan that.

Other platforms like Android and Windows Phone have long championed NFC and its capabilities, and we can look to them for other potential features. Windows Phones used NFC to pair and share contact info and other data like photos. Rather than go through a complicated process of connecting via Bluetooth across two phones, you selected a photo or photos and then chose to send via NFC. Once you tapped the phones together, they paired and took care of the rest. Android has similar sharing capabilities called Android Beam that used NFC.

That same capability extends to business cards. Instead of carrying around dozens of business cards, you could create a digital card with your contact info and share it via NFC. It’s a dual-sided benefit, not only do you have less to carry (and buy) but you’ll know your contact details went into somebody’s phone and not the trash. Likewise, you can store tickets for events on your phone and use them via NFC; the venue would just need an NFC reader.

NFC can make Wi-Fi sharing less of a pain as well. By saving the relevant details to an NFC tag, your guests can connect to your network by just tapping it. No need to muddle through several SSID names, or write down your password. Any place that offers public Wi-Fi, like Hotels and restaurants, could also share Wi-Fi details on an NFC tag in central locations.

Some password managers, like Dashlane, let you add credit card info by tapping the card’s NFC chip (if it has one) to your phone. The information is pulled and stored securely in the password manager to make payment processing all the faster. The feature is Android only right now, but with iOS 13 that can change.

In some ways, what iPhone is doing now is something other platforms have tried to do for ages. But this is likely a case where everybody wins. Without all the major platforms on board, governments and companies lacked the incentive to embrace NFC fully. Much like Apple finally including QI wireless charging in its phone helped the wireless charging market reach a new level everyone can appreciate, adding more support for NFC may push it to a point where everybody embraces it, and so everyone wins.

[mai mult...]

How to See All Devices on Your Network With nmap on Linux

Ethernet cables plugged into a router
Think you know what’s connected to your home network? You might be surprised. Learn how to check using nmap on Linux, which will let you explore all the devices connected to your network.

You might think your home network is pretty simple, and there’s nothing to be learned from having a deeper look at it. You might be right, but the chances are you’ll learn something you didn’t know. With the proliferation of Internet of Things devices, mobile devices such as phones and tablets, and the smart home revolution—in addition to “normal” network devices such as broadband routers, laptops, and desktop computers—it might be an eye-opener.

If You Need To, Install nmap

We’re going to use the nmapcommand. Depending on what other software packages you have installed on your computer, nmap might be installed for you already.

If not, this is how to install it in Ubuntu.

sudo apt-get install nmap

sudo apt-get install nmap in a terminal window

This is how to install it on Fedora.

sudo dnf install nmap

sudo dnf install nmap in a terminal window

This is how to install it on Manjaro.

sudo pacman -Syu nmap

sudo pacman -Syu nmap in a terminal window

You can install it on other versions of Linux using the package manager for your Linux distributions.

Find Your IP Address

The first task is to discover what the IP address of your Linux computer is. There is a minimum and a maximum IP address your network can use. This is the scope or range of IP addresses for your network. We will need to provide IP addresses or a range of IP addresses to nmap, so we need to know what those values are.

Handily, Linux provides a command called ip and it has an option called addr (address). Type ip, a space, addr,  and press Enter.

ip addr

ip addr in a terminal window

In the bottom section of the output, you will find your ip address. It is preceded by the label “inet”.

output from ip address in a terminal window

The IP address of this computer is “192.168.4.25”. The “/24” means that there are three consecutive sets of eight 1’s in the subnet mask. (And 3 x 8 =24.)

In binary, the subnet mask is:

11111111.11111111.11111111.00000000

and in decimal, it is 255.255.255.0.

The subnet mask and the IP address are used to indicate which part of the IP address identifies the network, and which part identifies the device. This subnet mask informs the hardware that the first three numbers of the IP address will identify the network and the last part of the IP address identifies the individual devices. And because the largest number you can hold in an 8-bit binary number is 255, the IP address range for this network will be 192.168.4.0 through to 192.168.4.255.

All of that is encapsulated in the “/24”. Happily, nmap works with that notation, so we have what we need to start to use nmap.

Get Started with nmap

nmap is a network mapping tool. It works by sending various network messages to the IP addresses in the range we’re going to provide it with it. It can deduce a lot about the device it is probing by judging and interpreting the type of responses it gets.

Let’s kick off a simple scan with nmap. We’re going to use the -sn (scan no port) option. This tells nmap to not probe the ports on the devices for now. It will do a lightweight, quick scan.

Even so, it can take a little time for nmap to run. Of course, the more devices you have on the network, the longer it will take. It does all of its probing and reconnaissance work first and then presents its findings once the first phase is complete. Don’t be surprised when nothing visible happens for a minute or so.

The IP address we’re going to use is the one we obtained using the ip command earlier, but the final number is set to zero. That is the first possible IPAddress on this network. The “/24” tells nmap to scan the entire range of this network. The parameter “192.168.4.0/24” translates as “start at IP address 192.168.4.0 and work right through all IP addresses up to and including 192.168.4.255”.

Note we are using sudo.

sudo nmap -sn 192.168.4.0/24

sudo nmap -sn 192.168.4.0/24 in a terminal window

After a short wait, the output is written to the terminal window.

You can run this scan without using sudo, but using sudo ensures it can extract as much information as possible. Without sudo this scan would not return the manufacturer information, for example.

nmap output in a terminal window

The advantage of using the -sn option—as well as being a quick and lightweight scan—is it gives you a neat list of the live IP addresses. In other words, we have a list of the devices connected to the network, together with their IP address. And where possible, nmap has identified the manufacturer. That’s not bad for the first try.

Here’s the bottom of the list.

nmap output in a terminal window

We’ve established a list of the connected network devices, so we know how many of them there are. There are 15 devices switched on and connected to the network. We know the manufacturer for some of them. Or, as we shall see, we have what nmap has reported as the manufacturer, to the best of its ability.

When you look through your results, you will likely see devices that you recognize. There may well be some that you don’t. These are the ones we need to investigate further.

What some of these devices are is clear to me. Raspberry Pi Foundation is self-explanatory. The Amazon Technologies device will be my Echo Dot. The only Samsung device I have is a laser printer, so that narrows that one down. There’s a couple of devices listed as manufactured by Dell. Those are easy, that’s a PC and laptop. The Avaya device is a Voice Over IP phone that provides me with an extension on the telephone system at head office. It allows them to pester me at home more easily, so I’m well aware of that device.

But I’m still left with questions.

There are several devices with names that don’t mean anything to me all. Liteon technology and Elitegroup Computer systems, for example.

I have (way) more than one Raspberry PI. How many are connected to the network will always vary because they’re continually swapped in and out of duty as they get re-imaged and re-purposed. But definitely, there should be more than one showing up.

There are a couple of devices marked as Unknown. Obviously, they’ll need looking into.

Perform a Deeper Scan

If we remove the -sn option nmap will also try to probe the ports on the devices. Ports are numbered endpoints for network connections on devices. Consider an apartment block. All the apartments have the same street address (the equivalent of the IP address), but each apartment has its own number (the equivalent of the port).

Each program or service within a device has a port number. Network traffic is delivered to an IP address and a port, not just to an IP address. Some port numbers are preallocated, or reserved. They are always used to carry network traffic of a specific type. Port 22, for example, is reserved for SSH connections and port 80 is reserved for HTTP web traffic.

We are going to use nmap to scan the ports on each device and tells which ones are open.

nmap 192.168.4.0/24

nmap 192.168.4.0/24 in a terminal window

This time we’re getting a more detailed summary of each device. We’re told there are 13 active devices on the network. Wait a minute; we had 15 devices a moment ago.

The number of devices may well vary as you run these scans. It is likely due to mobile devices arriving and leaving the premises, or equipment being turned on and off. Also, be aware that when you switch on a device that has been powered off, it might not have the same IP address as it did the last time it was in use. it might, but it might not.

nmap output in a terminal window

There was a lot of output. Let’s do that again and capture it in a file.

nmap 192.168.4.0/24 > nmap-list.txt

nmap 192.168.4.0/24 > nmap-list.txt in a terminal window

And now we can list the file with less, and search through it if we wish.

less nmap-list.txt

less nmap-list.txt in a terminal window

As you scroll through the nmap report you’re looking for anything that you can’t explain or that seems unusual. When you review your list, make a note of the IP addresses of any devices that you wish to investigate further.

According to the list that we generated earlier, 192.168.4.10 is a Raspberry Pi. It will be running one Linux distribution or another. So what is using port 445? It is described as “microsoft-ds”. Microsoft, on a Pi running Linux? We’ll certainly be looking into that.

192.168.4.11 was tagged as “Unknown” in the earlier scan. It has a lot of ports open; we need to know what that is.

nmap output in a terminal window

192.168.4.18 was also identified as a Raspberry Pi. But that Pi and device 192.168.4.21 both have port 8888 open, which is described as being used by “sun-answerbook”. Sun AnswerBook is a many-years retired (elementary) documentation retrieval system. Needless to say, I don’t have that installed anywhere. That needs looking at.

nmap output in a terminal window

Device 192.168.4.22 was identified earlier as a Samsung printer, which is verified here by the tag that says “printer”. What caught my eye was the HTTP port 80 being present and open. This port is reserved for website traffic. Does my printer incorporate a website?

nmap results for a samsung printer in a terminal window

Device 192.168.4.31 is reportedly manufactured by a company called Elitegroup Computer Systems. I’ve never heard of them, and the device has a lot of ports open, so we’ll be looking into that.

The more ports a device has open, the more chances a cybercriminal has of getting into it—if it is exposed directly to the Internet that is. It’s like a house. The more doors and windows you have, the more potential points of entry a burglar has.

nmap output for an Intel NUC in a terminal window

We’ve Lined Up The Suspects; Let’s Make Them Talk

Device 192.168.4.10 is a Raspberry Pi that has port 445 open, which is described as “microsoft-ds.” A quick bit of Internet searching reveals that port 445 is usually associated with Samba. Samba is a free software implementation of Microsoft’s Server Message Block protocol (SMB). SMB is a means of sharing folders and files across a network.

This makes sense; I use that particular Pi as a sort of mini-Network Attached Storage device (NAS). It uses Samba so that I can connect to it from any computer on my network. Ok, that was easy. One down, several more to go.

Unknown Device With Many Open Ports

The device with IP Address 192.168.4.11 had an unknown manufacturer and a lot of ports open.

We can use nmap more aggressively to try to winkle more information out of the device. The -A (aggressive scan) option forces nmap to use operating system detection, version detection, script scanning, and traceroute detection.

The -T (timing template) option allows us to specify a value from 0 to 5. This sets one of the timing modes. The timing modes have great names: paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The lower the number, the less impact nmap will have on the bandwidth and other network users.

Note that we’re not providing nmap with an IP range. We’re focussing nmap on a single IP address, which is the IP address of the device in question.

sudo nmap -A -T4 192.168.4.11

sudo nmap -A -T4 192.168.4.11 in a terminal window

On the machine used to research this article, it took nine minutes for nmap to execute that command. Don’t be surprised if you have to wait a while before you see any output.

nmap output in a terminal window

Unfortunately, in this case, the output doesn’t give us the easy answers we’d hoped for.

One extra thing we have learned is that it is running a version of Linux. On my network that isn’t a great surprise, but this version of Linux is odd. It seems to be quite old. Linux is used within almost all of the Internet of Things devices, so that might be a clue.

Further down in the output nmap gave us the Media Access Control address (MAC address)  of the device.  This is a unique reference that is assigned to network interfaces.

The first three bytes of the MAC address is known as the Organizationally Unique Identifier (OUI). This can be used to identify the vendor or manufacturer of the network interface. If you happen to be a geek who has put together a database of 35,909 of them, that is.

ms lookup for mac address of Google device in a terminal window

My utility says it belongs to Google. With the earlier question about the peculiar version of Linux and the suspicion that it might be an Internet of Things device, this points the finger fairly and squarely at my Google Home mini smart speaker.

You can do the same sort of OUI lookup online, using the Wireshark Manufacturer Lookup page.

Wireshark MAC address lookup web page

Encouragingly, that matches my results.

One way to be certain about the id of a device is to perform a scan, turn the device off and scan again. The IP address that is now missing from the second set of results will be the device you just powered off.

Sun AnswerBook?

The next mystery was the “sun-answerbook” description for the Raspberry Pi with IP address 192.168.4.18. The same “sun-answerbook” description was showing up for the device at 192.168.4.21. Device 192.168.4.21 is a Linux desktop computer.

nmap makes its best guess at the use of a port from a list of known software associations. Of course, if any of these port associations are no longer applicable—perhaps the software is no longer in use and has gone end of life—you can get misleading port descriptions in your scan results. That was likely the case here, the Sun AnswerBook system dates back to the early 1990’s, and is nothing more than a distant memory—to those who’ve even heard of it.

So, if it isn’t some ancient Sun Microsystems software, so what could these two devices, the Raspberry Pi and the desktop, have in common?

Internet searches didn’t bring anything back that was useful. There were a lot of hits. It seems anything with a web interface that doesn’t want to use port 80 seems to opt for port 8888 as a fallback. So the next logical step was to try to connect to that port using a browser.

I used 192.168.4.18:8888 as an address in my browser. This is the format to specify an IP address and a port in a browser. Use a colon : to separate the IP address from the port number.

Resilio sync portal in a browser

A web site did indeed open up.

It is the admin portal for any devices that are running Resilio Sync.

I always use the command line, so I’d completely forgotten about this facility. So the Sun AnswerBook entry listing was a complete red herring, and the service behind port 8888 had been identified.

A Hidden Web Server

The next issue I’d recorded to take a look at was the HTTP port 80 on my printer. Again, I took the IP address from the nmap results and used it as an address in my browser. I didn’t need to provide the port; the browser would default to port 80.

Samsung printer embedded web server in a browser window

Lo and behold; my printer does have an embedded web server in it.

Now I can see the number of pages that have been through it, the level of toner, and other useful or interesting information.

Another Unknown Device

The device at 192.168.4.24 didn’t reveal anything to any of the nmap scans we’ve tried so far.

I added in the -Pn (no ping) option. This causes nmap to assume the target device is up and to proceed with the other scans. This can be useful for devices that don’t react as expected and confuse nmap into thinking they are off-line.

sudo nmap -A -T4 -Pn 192.168.4.24

sudo nmap -A -T4 -Pn 192.168.4.24 in a terminal window

This did retrieve a dump of information, but there was nothing that identified the device.

It was reported to be running a Linux kernel from Mandriva Linux. Mandriva Linux was a distribution that was discontinued back in 2011. It lives on with a new community supporting it, as OpenMandriva.

Another Internet of Things device, possibly? probably not—I only have two, and they’ve both been accounted for.

nmap output in a terminal window

A room by room walk-through and a physical device count gained me nothing. Let’s look up the MAC address.

MAC address lookup on Huawei phone

So, it turns out it was my mobile phone.

Remember that you can do these lookups online, using the Wireshark Manufacturer Lookup page.

Elitegroup Computer Systems

The last two questions I had were about the two devices with manufacturer names that I didn’t recognize, namely Liteon and Elitegroup Computer Systems.

Let’s change tack. Another command that is useful in pinning down the identity of the devices on your network is arp.  arp is used to work with the Address Resolution Protocol table in your Linux computer. It is used to translate from an IP address (or network name) to a MAC address.

If arp is not installed on your computer, you can install it like this.

On Ubuntu, use apt-get :

sudo apt-get install net-tools

sudo apt-get install net-tools in a terminal window

On Fedora use dnf :

sudo dnf install net-tools

sudo dnf install net-tools in a terminal window

On Manjaro use pacman :

sudo pacman -Syu net-tools

sudo pacman -Syu net-tools in a terminal window

To get a list of the devices and their network names—if they’ve been assigned one—just type arp and press Enter.

This is the output from my research machine:

arp output in a terminal window

The names in the first column are the machine names (also called hostnames or network names) that have been assigned to the devices. Some of them I have set (Nostromo, Cloudbase, and Marineville, for example) and some have been set by the manufacturer (such as Vigor.router).

The output gives us two means of cross-referencing it with the output from nmap. Because the MAC addresses for the devices are listed, we can refer to the output from nmap to further identify the devices.

Also, because you can use a machine name with ping and because ping displays the underlying IP address, you can cross-reference machine names to IP addresses by using ping on each name in turn.

For example, let’s ping Nostromo.local and find out what its IP address is. Note that machine names are case-insensitive.

ping nostromo.local

ping nostromo.local in a terminal window

You must use Ctrl+C to stop ping.

ping output in a terminal window

The output shows us that its Ip address is 192.168.4.15. And that happens to be the device that showed up in the first nmap scan with Liteon as the manufacturer.

The Liteon company makes computer components that are used by a great many computer manufacturers. In this case, it is a Liteon Wi-Fi card inside an Asus laptop. So, as we noted earlier, the name of the manufacturer that is returned by nmap is just its best guess. How was nmap to know the Liteon Wi-Fi card was fitted to an Asus laptop?

And finally. The MAC address for the device manufactured by Elitegroup Computer Systems matches the one in the arp listing for the device I have named LibreELEC.local.

This is an Intel NUC, running the LibreELEC media player. So this NUC has a motherboard from the Elitegroup Computer Systems company.

And there we are, all mysteries solved.

All Accounted For

We have verified that there are no inexplicable devices on this network. You can use the techniques described here to investigate your network either. You may do this out of interest—to satisfy your inner geek—or to satisfy yourself that everything connected to your network has a right to be there.

Remember that connected devices come in all shapes and sizes. I spent some time going around in circles and trying to track down a strange device before realizing that it was, in fact, the smartwatch on my wrist.

[mai mult...]

How to Use Google Chrome to Generate Secure Passwords

Google Chrome logo.

Google Chrome offers to save passwords for all your online accounts. It then stores and syncs them to your Google account as part of the Smart Lock feature. Chrome also has a built-in password generator that automatically creates strong passwords at the click of a button.

How to Generate Secure Passwords

First, make sure password saving is enabled (it should be on by default). To check, click on your profile picture in the top-right corner, and then click on “Passwords.” You can also type chrome://settings/passwords into the Omnibox and hit Enter.

Click your profile picture, and then click "Passwords."

Toggle the switch labeled “Offer to Save Passwords” to the on position (if it isn’t already).

Toggle the "Offer to Save Passwords" option on.

Next, jump to a website where you want to create an account. When you click on the password field, a pop-up will suggest a strong one for you. Click “Use Suggested Password.”

In the Password field, click "Use Suggested Password."

If the prompt doesn’t appear, right-click on the password field, and then click “Suggest Password.” This will force the pop-up to show below the field with a new, strong password suggestion.

Right-click the empty password field, and then click "Suggest Password."

That’s it! Finish the registration process. After you complete it, Google saves and stores the password for you, so you don’t have to remember anything.

The "Password Saved" notification that appears after you save your new password.

How to Change an Existing Password

If you didn’t know about this feature when you created an account, you could still use it to change the password on an existing account and make it more secure.

Log in to the account with the password you want to change and go to the section where you can change/reset your password. After you click in the “New Password” field, a prompt should appear with a strong password suggestion. Click “Use Suggested Password.”

Click "Use Suggested Password" to change or reset an existing password on any account.

If you don’t see the prompt, right-click in the password field, and then click “Suggest Password.”

Right-click in the password field, and then click "Suggest Password."

Click “Use Suggested Password” when the prompt appears this time.

Click "Use Suggested Password."

Click “Save Changes” to change your password.

Click "Save Changes."

One caveat of using this feature to change an existing account’s password is that it may not automatically update it in Chrome, in which case, you’ll need to do it manually. This isn’t difficult, though. After saving the new password, before you leave the website, click the key icon in the Omnibox, enter the username for that site, and then click “Update Password.”

Click the key icon in the Omnibox, enter the username for the account on that website, and then click "Update Password."

Understandably, not everyone is thrilled at the idea of Google handling their passwords. But Smart Lock for Passwords is a handy, free alternative for those who don’t want to pay for a password manager or download extra software.

[mai mult...]

How to Turn on Two-Factor Authentication for LinkedIn

LinkedIn Logo

Two-factor authentication (2FA) is a great security tool, and we always recommend it. Most apps make it pretty easy to turn on 2FA, and LinkedIn is no exception. Here’s how to enable it and make yourself safer.

You can turn on two-factor authentication from either the LinkedIn website or the mobile app, but either way, you’ll need to be logged in to your LinkedIn account. Go ahead and do this first.

Click on your avatar in the top-right corner of the LinkedIn website. In the menu that opens, click the “Settings & Privacy” option.

The "Settings & Privacy" menu option.

Click on the Account tab, scroll down to the “Two-Step Verification” section, and then click the “Change” link.

The Account tab, and the "Two-step verification" option.

The section will expand. Click the “Turn On” button.

The "Two-step verification" option with "Turn on" highlighted.

You can choose whether to use an authenticator app to generate a code for you or to receive SMS (text) messages with the code. We strongly recommend using an authenticator app as it’s more secure, but two-factor authentication using SMS is still much safer than not using two-factor authentication at all.

Choose your method—we’re going to use an authenticator app—and then click the “Continue” button.

The verification method dropdown.

Enter your password in the prompt that appears and then click “Done.”

The Password entry field and the Done button.

The instructions for adding an account to your authenticator app are displayed. Add a new account in your authenticator app, scan the QR code using your phone’s camera, and once the account is created, enter the six-digit code from the authenticator app into the text box in LinkedIn and click “Continue.”

LinkedIn's instructions for adding the account to an authenticator app.

Two-factor authentication is now turned on. Click on “Recovery Codes” to display the backup codes, so you can still get in if you ever lose your phone.

The "Two-step verification" settings, with "recovery codes" highlighted.

Click “Copy Codes” and save them somewhere secure. You’ll need them to get into your LinkedIn account if you ever lose or wipe your phone.

The recovery codes, with "Copy codes" highlighted.

Now that you’ve turned on two-factor authentication, you’ll need to log in again through any other devices you use, such as your phone.

Turn on Two-Factor Authentication in the LinkedIn App

Turning on two-factor authentication in the mobile app is the same on the iPhone, iPad, and Android. Open the app and tap your profile picture.

LinkedIn's Profile button.

Then select the “View Profile” link.

The "View Profile" option.

Tap on the Settings gear in the top-right corner.

The Settings cog.

Open the “Privacy” tab, scroll down, and then tap “Two-Step Verification.”

The Privacy tab, with the "Two-step verification" option highighted.

Select the “Set Up” button.

The two-step verification "Set up" button.

You can choose whether to use an authenticator app to generate a code for you or to receive SMS (text) messages with the code. We strongly recommend using an authenticator app as it’s more secure, but two-factor authentication using SMS is still much safer than not using two-factor authentication at all.

Choose your method—we’re going to use an authenticator app—and tap “Continue.”

The verification method dropdown.

Enter your password in the prompt that appears and then tap the “Submit” button.

The Password entry field and the Submit button.

The instructions for adding an account to your authenticator app are displayed. Add a new account in your authenticator app and then tap “Continue.”

LinkedIn's instructions for adding the account to an authenticator app.

Enter the six-digit code from the authenticator app into the text box in LinkedIn and tap “Verify.”

The entry field for the verification code.

Two-factor authentication is now turned on. You won’t have to enter the two-factor code on your phone, although you will have to enter it if you access LinkedIn on any other device.

Tap the “Recovery Codes” link to display the backup codes, so you can still get in if you ever lose your phone.

The "Two-step verification" settings, with "recovery codes" highlighted.

Tap “Copy Codes” and save them somewhere secure. You’ll need them to get into your LinkedIn account if you ever lose or wipe your phone.

The recovery codes, with "Copy Codes" highlighted.

Now that you’ve turned on two-factor authentication, you’ll need to log in again on any other devices you own using the two-factor code.

[mai mult...]

How a Password Manager Protects You From Phishing Scams

Password managers make it easy to use strong, unique passwords everywhere. That’s one significant benefit to using them, but there’s another: Your password manager helps protect you from imposter websites trying to “phish” your password.

What Is Phishing, and How Does It Work?

Phishing is designed to trick you into giving your password or other information to an imposter.

For example, let’s say you get an email claiming to be from your bank. The email says your account may be compromised, and you should click this link to take action. You click the link in the email and end up on a site that looks just like your bank’s real website. In a rush to secure your account, you type your password and possibly other details like your credit card number. Boom, you’ve been phished. The attacker now has your bank account’s username and password, as well as any other information you provided. That wasn’t your bank’s real website. You got an email from a scammer.

Security professionals recommend against clicking links in emails like this. Instead, go to your bank account’s website directly and sign in. Similarly, if someone claiming to be from your bank calls you on the phone, it’s a good idea to hang up and call your bank’s customer service number directly to see if the call is legitimate.

You could end up on a phishing site in many other ways. Maybe you click a link to buy something on the web and end up at what looks like Amazon.com or another legitimate store, for example. Perhaps you click a link to email someone and end up on what appears to be a Google login screen for your Gmail account.

It’s All in the URL

There’s one thing you can do to spot phishing sites: Examine the URL, which is the address of the web page. For example, if you bank with Chase, you’d look to verify you were on chase.com. But phishing sites could be clever—for example, a phishing site might use the domain “secure.chase.com.example.com/onlinebanking/login”.

If you understand URLs, you’ll realize that that particular URL is actually hosted on “example.com” and not “chase.com”.

Similarly, some phishing websites will use characters that look similar to other characters. It’s all part of making the URL look similar to the real one. After all, many people likely don’t examine the URL at all. Even people who do may just be trained to look for something like “chase.com.” Not everyone understands how to decode that line of text.

How a Password Manager Helps Protect You

If you use a password manager, you have additional protection. This is true as long as your password manager can automatically fill your credentials, whether it’s 1Password, LastPass, Dashlane, Bitwarden, or even the password-saving feature built right into your web browser.

If you save a login for a website like Chase.com or Amazon.com, your password manager will remember it and offer to automatically fill it in for you when you’re on Chase.com or Amazon.com. If you end up on a different website, your password manager won’t offer to enter your credentials—after all, you’re on a different website. Your password manager doesn’t fall for the disguised URL.

This protection isn’t fancy, and you won’t see a big red “warning” message pop up. But you will quickly notice that wait a minute; your password manager isn’t offering to sign you in on this website. Why is that? Once you’ve noticed something is amiss, you might quickly discover you’re not on the website you thought you were on.

Peace of Mind When Logging In

Your password manager doesn’t just make it faster to enter your credentials while browsing the web. It gives you peace of mind while it goes about its job.

If you’re signing into your email online, you don’t need to double-check the domain before typing your username and password. You know that, if your password manager is offering to fill your credentials automatically, it’s already checked that the domain is a match with the one saved in your database.

This Works on Smartphones, Too

Of course, the same features are available when you use a password manager on a mobile device like an iPhone, iPad, or Android phone. Use your password manager to enter credentials, and you’ll be protected from phishing on the mobile web, too.

[mai mult...]