Collaborate Disseminate
My understanding is that a strict definition of anonymity means that defeating the security mechanism is logically impossible or mathematically infeasible, and therefore so is deducing the identity. (An example would be blind… Continue reading What category of anonymity do onion routing and blockchains afford?
Given that I trust my VPN provider more than my coffee shop, I still see two potential issues with relying on a VPN (tunnel) service to secure communications over a public hotspot:
Bootstrapping. I need to sign into a capti… Continue reading How does a VPN protect me on public WiFi?
One fingerprinting element is the browser’s user-agent string. If we consider one browser, Firefox, we can see that it has different strings across different OSes, distros, forks (Tor, IceCat) and versions. Some of these populations would … Continue reading Is there a coordinated Firefox user-agent for anonymous browsing?
The Guardian Project recently detailed how they drop personally identifiable information (PII) from Apache logs before they are written to disk:
…this site will be configured to store [logs], but only information that i… Continue reading How do I configure Nginx to drop PII from written logs? [migrated]
I want to provide a user with remote contact list (address book) that they can access and update from arbitrary clients on multiple devices. But I want to have zero knowledge of those contacts. Existing mechanisms (eg XMPP roster, CardDAV)… Continue reading How can I store user contacts (address book) with zero knowledge?
When I’m developing a webapp, let’s say a Django site, I run it locally and typically access it at http://localhost.
I thought this was inherently secure because I assumed that localhost can only be accessed locally. However… Continue reading How can I securely develop a local webapp at a coffee shop?
I am setting up a new webserver. In addition to TLS/HTTPS, I’m considering implementing Strict-Transport-Security and other HTTPS-enforcement mechanisms.
These all seem to be based on the assumption that I am serving http://… Continue reading Why should I offer HTTP in addition to HTTPS?