Passwords being the same? No, passwords being a word of some kind? No. All the passwords I use are a mix of upper / lower mixed letters, numbers and special characters. Brute forcing doesn't work worth a shit unless the admin of the server is an idiot and doesn't enforce complicated passwords. Even WPA2 can be cracked with simple keys, some of the best rainbow tables I have seen come from here: http://www.renderlab.net/projects/WPA-tables/ Also take a look at Gr-Security. I use hardened kernels, normal users can't list /home or directories like /etc, the root user can't modify log files without recompiling the kernel and rebooting the server. http://grsecurity.net/ On Fri, Dec 17, 2010 at 7:59 PM, Lisa Kachold wrote: > Oh, WAIT, let's be complete? > > > http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html > > and: > > If you are found accessing anything interesting (via various MAE-West, > Cable Company, Telco TAPS) from your so-called secure Squid Proxy in Dallas, > (or if your email origination address is tracked for anything related to > security and privacy [like this POST :( ], the government can trivially > gain access [I can, 2% if all security professionals in the field could > also, so why would the NSA/DHS not also be able to?]: > > > http://www.saintcorporation.com/cgi-bin/demo_tut.pl?tutorial_name=Squid_vulnerabilities.html&fact_color=&tag= > > Of course you also have SSH on in Dallas (on a "secret" port, right?) > http://www.madirish.net/?article=183 > > And you ARE using a password you use on ALL the OTHER logins, right? And > it's a WORD right? > > And you did just open and read this email didn't you? > http://unicode.org/reports/tr36/tr36-1.html > > [?] > > > > On Fri, Dec 17, 2010 at 7:35 PM, Lisa Kachold wrote: > >> You obviously have port 80/443 open? >> And probably 53? >> >> I didn't evaluate your email header for your source IP and nmap you but >> you might want to look at this: >> >> >> http://www.backtrack-linux.org/forums/backtrack-howtos/34939-my-metasploit-tutorial-thread-2.html >> >> >> >> On Fri, Dec 17, 2010 at 6:56 PM, Jordan Aberle wrote: >> >>> I prefer security at the router level, I drop packets from everywhere >>> except for a specific whitelist I created, if I need to go somewhere >>> (incoming/outgoing) I modify my protocol rules for specific addresses. It >>> is time consuming when you are starting from scratch but it's worth it in >>> the wrong run. I have windows boxes and linux boxes, my windows boxes have >>> never been infected since naturally all ad generated sites are blocked at >>> the router level. If I do online banking etc, I go one step further by >>> connecting through a secure squid proxy via a server I have setup at a >>> datacenter in Dallas. If the government ever wants to monitor me I'm sure >>> they can figure out a way but it's going to be a pain in the ass for them to >>> do so. Truecrypt is a very nice thing to have as well, it doesn't do it's >>> job if you don't have your system to be configured to lock after a certain >>> amount of idle time though. The point of truecrypt is to make a person >>> reboot the machine, at that point they are pretty screwed unless they are >>> very quick about freezing the ram to extract the keys. Even then, it's >>> unlikely to be successful. >>> >>> Jordan >>> >>> >>> On Fri, Dec 17, 2010 at 6:07 PM, keith smith wrote: >>> >>>> I wonder where we would be today id someone had told our founding >>>> fathers "get over it!" and they had said "Yeah your right." and had given >>>> in. The government is here for us not the other way around. >>>> >>>> >>>> ------------------------ >>>> Keith Smith >>>> >>>> --- On *Fri, 12/17/10, Lisa Kachold * wrote: >>>> >>>> >>>> From: Lisa Kachold >>>> Subject: Re: OpenBSD and the FBI >>>> >>>> To: "Main PLUG discussion list" >>>> Date: Friday, December 17, 2010, 5:13 PM >>>> >>>> >>>> >>>> >>>> On Fri, Dec 17, 2010 at 4:12 PM, keith smith >>>> > wrote: >>>> >>>> >>>> I would not doubt something like this could happen. Our rights are >>>> being eroded moment by moment. If this were to happen, this would clearly >>>> be a violation of our Fourth Amendment rights. >>>> >>>> I just read an article that for the first time since the government has >>>> been wiretapping everyone's calls a judge said a warrant was required for >>>> every wire tape. 3 judges prior sided with the government and rules no >>>> warrant required for a wiretap. >>>> >>>> Now back to OpenBSD. Why OpenBSD? Why not Linux? Or maybe Linux has >>>> been compromised too? At least there is the hope that some wiz kid will >>>> determine if this is true. >>>> >>>> I know this list runs the gamut when it comes to political beliefs. And >>>> I respect that. I think one thing we can agree on is we need to be free >>>> from unreasonable search and seizure. >>>> >>>> >>>> ------------------------ >>>> Keith Smith >>>> >>>> --- On *Fri, 12/17/10, Jordan Aberle >>>> >* wrote: >>>> >>>> >>>> From: Jordan Aberle >>>> > >>>> Subject: OpenBSD and the FBI >>>> To: "Main PLUG discussion list" >>>> > >>>> Date: Friday, December 17, 2010, 2:37 PM >>>> >>>> >>>> Interesting information: >>>> >>>> http://marc.info/?l=openbsd-tech&m=129236621626462&w=2 >>>> >>>> >>>> Jordan >>>> >>>> >>>> It's actually a great deal worse than you might think. I am sorry I am >>>> not at liberty to divulge the technical details but be advised that NSA and >>>> DHS "backdoor" access is available from IPSEC, JAVA, Microsoft Explorer and >>>> M$ Systems, and all of the various means for which a standard BACKTRACK user >>>> could gain access [i.e. everything] without consequences. >>>> >>>> Be advised that EVERYTHING you type or do on your systems regardless of >>>> your OS, when logged into ANY browser, is completely available to any >>>> government staff. >>>> >>>> There is no privacy or security; get over it! >>>> -- >>>> >>>> (503) 754-4452 >>>> (623) 688-3392 >>>> >>>> http://www.obnosis.com >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> -----Inline Attachment Follows----- >>>> >>>> >>>> --------------------------------------------------- >>>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >>>> To subscribe, unsubscribe, or to change your mail settings: >>>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >>>> >>>> >>>> >>>> --------------------------------------------------- >>>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >>>> To subscribe, unsubscribe, or to change your mail settings: >>>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >>>> >>> >>> >>> --------------------------------------------------- >>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >>> To subscribe, unsubscribe, or to change your mail settings: >>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >>> >> >> >> >> -- >> >> (503) 754-4452 >> (623) 688-3392 >> >> http://www.obnosis.com >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > > > -- > > (503) 754-4452 > (623) 688-3392 > > http://www.obnosis.com > > > > > > > > > > > > > > > > > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > To subscribe, unsubscribe, or to change your mail settings: > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >