Applied Paranoia

68 readers
1 users here now

Discussions of Paranoia, how to apply it in a digital ecosystem (Security, Privacy, Tools, Applications, Questions)

Rules

  1. Be nice
  2. Stay on topic
  3. Don’t farm rage
  4. Be respectful of others

founded 6 months ago
1
 
 

Any platform that says it's end to end (E2E) encrypted, but has spam detection, adult content detection, fraud detection, etc is being creative with the E2E concept

The only way these filters are possible are because

  • 1 A central service can view the messages
  • 2 A "agent" such as a LLM is running on every device scanning messages and phoning home to a central service when it's triggered.

In either scenario the message autonomy and self-agency has been removed from the End users. Having a point to point secure audio bridge is nice, but useless if every call has to be attended by a political officer.

If you care about end to end encryption please use a open source program that has been audited, doesn't have local tattle agents running on your device, and gives you control of your own data.

i.e. https://www.privacyguides.org/en/real-time-communication/

2
 
 

https://youtu.be/ERlHfeVmq6g

Call of Duty? More like Call of Hackers haha roasted.

momo5502.com/posts/2017-12-14-game-hacking-reinvented-a-poc-cod-hack

github.com/momo5502/cod-exploits/blob/master/huffman/src/Game/MW2/Exploit.cpp#L244

Great video by low level

3
 
 

I always like to remind folk, this is a wholly un-sponsored channel. I will disclose to you all that I was sent this unit as an evaluation piece, but Dirtyman had no editorial control over my thoughts and feedback here (as will become apparent with the insertion of nonsense like a Doctor Horrible joke and so forth) and they aren't paying me anything at all to do this. I even plan to offer to send them back the review unit once I'm done with this test.

With that out of the way, I think this item might potentially be useful for some folk. Yes, as I indicate toward the end of this video, you could make something similar yourself with enough time and effort. But if, like me, you are very busy and your time is valuable... having someone do the legwork of sourcing and fitting and sealing the parts and allowing you to purchase an all-in-one turnkey kit can be appealing.

Their site is pretty easy to find by googling, but in case you don't know how search engines work... dirtymansafe.com ...that's them on the internet. 😉

summerizer

Summary

The video introduces and reviews an unconventional type of safe known as the "Dirty Man Safe," which is a secure, steel canister designed to be buried underground for protecting valuables. Unlike traditional safes kept inside homes, this safe uses obscurity—being hidden underground—as a key element of security alongside its heavy-duty construction. The creator’s motivation partly stems from concerns about natural disasters like wildfires and floods that can destroy valuables stored in homes. The presenter explores the purpose, materials, and practicality of this buried safe, emphasizing its suitability for certain valuables such as cash, gold, jewels, alcohol, and tobacco rather than firearms, which may corrode underground.

The video discusses the setup and installation process, including the necessity of tools like an auger to dig the hole and special features like a retrieval line for quick access. The canister is designed to be weather-resistant but not completely waterproof, so it includes silica gel desiccants to reduce moisture. The presenter also tests the internal capacity and packing of the safe, finding some limitations regarding the size and types of items it can accommodate. While the idea is relatively low-tech and the product carries a modest price reflecting its materials and design, its value lies in providing a novel, hidden, and disaster-resilient storage option.

The review is tempered with cautious optimism, noting the need for a long-term test to assess performance over months, particularly regarding moisture protection. The presenter respects the innovative entrepreneurial spirit behind the product but refrains from full endorsement until results are observed. The video closes with a reminder about distributing valuables in diverse locations as a wise security practice.

Highlights

  • 🛡️ The Dirty Man Safe is a steel underground canister designed for hidden secure storage.
  • 🌍 Inspired by wildfire and disaster risks, it protects valuables from environmental destruction.
  • 🔒 Obscurity and physical durability combine to enhance security beyond traditional safes.
  • ⚠️ Not ideal for firearms due to moisture susceptibility; better for gold, cash, alcohol, and tobacco.
  • 🛠️ Requires an auger for digging and features a retrieval cable for easy access.
  • 💧 Includes silica gel desiccants to combat moisture ingress but is not fully waterproof.
  • 💡 Affordable and simple design with potential, but long-term effectiveness remains to be proven.

Key Insights

  • 🔍 Obscurity as a Security Strategy: Traditional safes often rely on strong locks and robust construction, but the Dirty Man Safe elevates "security through obscurity" by hiding valuables underground. This capitalizes on the principle that difficult discovery reduces theft risk, augmenting physical security measures. For individuals who desire covert storage, this method introduces a compelling alternative or complement to home safes and offsite lockers.

  • 🌪️ Disaster-Resilience Motivation: The product’s concept is rooted in recent challenges posed by extreme weather events and wildfires, which have rendered many traditional home safes ineffective by physically destroying them or making valuables irrecoverable. By burying valuables underground, the safe claims to keep them away from fires and floods, offering an extra layer of protection amid increasing climate unpredictability.

  • 🔧 Material and Construction Choices: The safe uses ABS pipe with welded joints and screw-on caps sealed with Teflon tape. While ABS is durable and offers good welding compatibility, it is less weather resistant than PVC, raising questions about long-term impact from ground moisture and temperature fluctuations. The inclusion of white silica gel (as opposed to color-indicating variants) in the kit suggests some attention to moisture control, but the presenter wisely plans to supplement with his own desiccants to better monitor conditions over time.

  • 🚫 Limitations Regarding Firearms and Size: Although the safe can fit small items like cash, gold coins, cigars, or tiny liquor bottles, it is not intended as a gun safe. The materials inside may corrode firearms if left for extended periods underground due to moisture content that the safe cannot fully block. This emphasizes that user expectations must align with the safe’s design purpose: protection of certain valuables, not all types.

  • 🏗️ User Experience—Installation and Retrieval: A key innovation is the retrieval line system attached to a large cap on top, enabling someone familiar with the location to extract the safe quickly without digging extensively each time. This feature addresses a common inconvenience with buried containers but also depends heavily on knowing the exact burial spot. The presenter emphasizes the necessity of adequate digging tools like an auger for installation, as manual digging through hard soils would be impractical.

  • 💰 Economic Accessibility and Market Positioning: The product is priced in the low triple digits, roughly $170, which is reasonable for what it offers considering the cost of materials and manufacturing complexity. The ready-to-use package simplifies acquisition and installation compared to DIY solutions, adding value for customers unwilling or unable to source parts individually. It occupies a niche market suitable for enthusiasts, disaster preparedness communities, or those interested in alternative safe storage.

  • 🤔 The Importance of Diversification for Valuables: The presenter stresses the wisdom of distributing valuables among multiple safes or locations, including friends’ houses and different types of safes. The Dirty Man Safe fits into such a diversified strategy, adding hidden underground storage to reduce the risk of single-point loss scenarios in disasters or theft. This multifaceted approach exemplifies best practices in personal asset security.

  • 📆 Need for Long-Term Testing for Practical Use: As ingenious as it sounds, the ultimate test will be time passing—how well the safe keeps moisture out, how the materials respond to seasonal changes, and whether the retrieval mechanisms remain functional after months underground. The presenter’s commitment to revisit the safe in six months offers a realistic and responsible approach to product evaluation, highlighting prudent consumer caution when adopting new security technologies.

Overall Impression

The Dirty Man Safe is an inventive, low-tech approach that creatively harnesses concealment and underground durability for valuables storage, targeting a niche but valid problem, especially given growing climate-related risks. While it is not a universal or perfect solution—particularly for firearms or larger items—its design thoughtfully addresses retrieval convenience and moisture mitigation in ways that warrant further observation. For users willing to try less conventional security methods and incorporate buried safes into a diversified asset protection plan, this product offers a viable option at a reasonable price. The video effectively balances enthusiasm for innovation with a realistic appraisal of limitations and encourages patience to confirm its efficacy over time.

4
 
 

When your traveling - How do you prepare a travel phone?

  • What information do you sync over?

  • Do you login to accounts before you travel?

  • What is your method of securing your data for cross border traveling?

5
 
 

This is a story that my friend Mike was telling me about a particularly memorable job he was on in his career as a safe technician. I am often heard both extolling the virtues of this work and also expressing concern about who will be the next generation that takes on this work as current owners and field technicians continue to age and even retire. Mike is fortunate to have a gifted and talented family who is interested in this field and offspring who appreciate the satisfaction of this work, but not every shop out there does.

I share stories like this to hopefully help both educate and inspire younger folk who would like to be a part of an essential field which is in need of individuals who can think critically, apply their skills to unique problems, and stick with a project until it is completed properly. If this sort of work sounds interesting to you and you would like to develop in this career path, I always encourage folk to reach out to groups like Lockmasters or MBA or the Taylor Family...

summerizer

Summary

This video transcript revolves around a fascinating locksmith story shared at the Sava Safe Tech event, highlighting a unique challenge involving an antique safe from Portugal. The safe, originally installed in a 1940s Portuguese bank, had been converted into a humidor by its owner — a wealthy and charitable gentleman in the U.S. During a gathering, the humidor safe was accidentally locked, and the key went missing, prompting a desperate search. The locksmith, along with his partner, was called in to open the safe without damaging its intricately refinished facade and maintaining its historic value.

After determining that the high-security key lock and decorative lettered dials were integral parts of the locking mechanism, the locksmiths used drilling and an inspection scope to analyze the bolt work because no manuals or code existed for the rare safe. Ultimately, they discovered the dials, which the owner claimed were decorative, were actually functional, and spelled out the word “CUBA.” By manipulating the dials to the correct combination, they successfully opened the safe, finding the keys inside and realizing the safe had never truly been locked by the key mechanism. The story underscores the importance of exploring all possibilities in problem-solving, questioning customer assumptions, and preserving the integrity of valuable items through care and expertise. The locksmith ultimately replaced the lock with a modern high-security one, restored the safe’s exterior, and pleased the client.

Highlights 🔐 Antique 1940s Portuguese safe converted into a luxury humidor 🔑 Client accidentally locked the safe during a social event and lost the key 🕵️‍♂️ Locksmiths faced a rare, undocumented lock with no blueprints or templates 🔎 Use of drilling, inspection scopes, and skilled manipulation to open the safe 🔠 Decorative dials on the safe actually spelled “CUBA” and were part of the lock 🛠 Safe opened without visible damage; lock replaced with modern security system 🤝 Story highlights the value of expertise, patience, and challenging assumptions Key Insights 🔑 Historic safes present unique challenges: Working on antique safes with unknown mechanisms requires creative problem-solving and specialized tools, emphasizing the need for locksmiths to be versatile and adaptive rather than relying on manuals or databases. 🎯 Customer assumptions can mislead: The client was certain the dials were only decorative, which almost delayed the solution. This highlights how locksmiths must trust their instincts and verify all parts of a locking system rather than fully relying on client information. 🔍 Advanced surveillance and diagnostic tools are vital: Utilizing a scope and drilling at multiple angles allowed the locksmith to understand the lock’s internal structure without unnecessary damage—critical when dealing with valuable or irreplaceable items. 🧩 Patience and tactile skills trump technology at times: The locksmith’s ability to manipulate the dials physically and detect resistance led to the discovery of the true locking mechanism, proving that experience and “by-feel” skills remain important in a modern high-tech world. 🛡 Preserving integrity while repairing: The priority to not mark or damage the safe meant the locksmiths had to carefully patch the drilling hole and refit the escutcheon plate, demonstrating respect for the item’s historical and sentimental value. 🔄 Modern replacement enhances security: Installing a high-security block lock after opening maintained the safe’s functionality and offered better future servicing options, combining modern technology with historical preservation. 🌟 Trade stories inspire and teach: Sharing detailed service experiences not only inspires future locksmiths but educates customers and professionals about the complexities of the trade and the value of experienced craftsmanship.

This account blends technical locksmith expertise with a human story, emphasizing problem-solving, respect for craftsmanship, and continuous learning.

6
 
 

This video demonstrates how to install apps on a Google Pixel running GrapheneOS, detailing a setup refined over three years. The presenter emphasizes starting users should use the standard Play Store before transitioning to a more complex app installation system for enhanced privacy and control. The process involves using multiple app sources, setting up user profiles for separation, and maintaining security through methods like Orbot and anonymous Google accounts.

Key Points

Setup Disclaimer

The presenter advises beginners to initially use the standard Play Store for easy app access and to adapt more smoothly before attempting the outlined complex setup.

User Profiles

After installing GrapheneOS, users operate under an owner profile and can create additional profiles to separate app usage, enhancing privacy.

Using Orbot

Orbot, a free proxy service, is installed to route all traffic over the Tor network, ensuring user anonymity when accessing the Play Store and downloading updates.

App Sources

The video outlines three primary sources for app installation: the default GrapheneOS app store, Crescent (an actively developed alternative app store), and Obtainium for open source apps. Each source plays a role in the app search process.

Creating Anonymous Google Accounts

For accessing the Google Play Store, the presenter suggests creating an anonymous account using temporary phone numbers to maintain privacy without linking back to personal identities.

Disabling Apps in Owner Profile

The installed apps are disabled in the owner profile to prevent accidental access, subsequently allowing users to install apps in a separate daily user profile where the apps are actually used.

Maintaining App Updates

Apps installed in the owner profile are updated across all user profiles, allowing for convenient management of applications without needing to update each profile separately.

Privacy Measures

The presenter discusses the importance of maintaining app permissions diligently and offers a solution for potential issues regarding the use of temporary phone numbers.

7
2
Writing C For Curl (daniel.haxx.se)
submitted 3 months ago* (last edited 3 months ago) by jet@hackertalks.com to c/applied_paranoia@dubvee.org
 
 

It is a somewhat common question to me: how do we write C in curl to make it safe and secure for billions of installations? Some precautions we take and decisions we make. There is no silver bullet, just guidelines. As I think you can see for yourself below they are also neither strange nor surprising.

The ‘c’ in curl does not and never did stand for the C programming language, it stands for client. ...

This is a excellent read, and If you work on a multi-person project, I highly recommend going through it.

8
 
 

Do you have a go bag?

Where do you keep it?

What is inside of it?

9
 
 

Build Your Own Darknet

Discover the simplest way to re-enter independent computing with our framework. Placing control directly at your fingertips.

Features of Clan

  • Full-Stack System Deployment: Utilize Clan’s toolkit alongside Nix's reliability to build and manage systems effortlessly.
  • Overlay Networks: Secure, private communication channels between devices.
  • Virtual Machine Integration: Seamless operation of VM applications within the main operating system.
  • Robust Backup Management: Long-term, self-hosted data preservation.
  • Intuitive Secret Management: Simplified encryption and password management processes.

https://clan.lol/

https://git.clan.lol/clan/clan-core/

10
 
 

During our previous research on Android File-Based encryption, we studied the boot chain of some Samsung devices based on Mediatek system on chips. Our objective was to exploit a known boot ROM vulnerability to bypass the secure boot and ultimately retrieve the required ingredients to brute force the user credentials. Once we became familiar with this boot chain, we decided to take a closer look at a component coming later in the process: the Little Kernel bootloader (LK, also called BL3-3)....

By: Maxime Rossi Bellom & Raphael Neveu Additional Contributors: Damiano Melotti & Gabrielle Viala

Full Abstract and Presentation Materials: blackhat.com/us-24/briefings/schedule/#attacking-samsung-galaxy-a-boot-chain-and-beyond-38526

11
 
 

The security architecture of modern operating systems is intricate and layered. To effectively challenge these defenses, attackers must extensively audit the security policies of the operating system across various dimensions. In July 2023, the speaker redirected their focus from Android and IoT vulnerabilities to those within macOS. This transition was motivated by an intent to adapt methodologies typically employed by Android security researchers for use in macOS environments, which subsequently led to the identification of numerous vulnerabilities.

In this presentation, the speaker will introduce a generic method for escaping macOS application sandboxes.

Additionally, the speaker will discuss a permission granting mechanism on macOS

Moreover, macOS 14.0 introduced new TCC protections, preventing non-sandboxed apps from accessing the private container folders of sandboxed apps. Previously, executing a malicious non-sandboxed app could leak sensitive data from sandboxed apps like WeChat, Slack, and WhatsApp. However, this is no longer possible on macOS due to the new TCC protections. The speaker will explain how macOS implements these new TCC protections, which are complex and involve multiple high-privilege system processes and Sandbox.kext. If abused, there is potential to gain access to arbitrary files.

By: Zhongquan Li | Senior Security Researcher, Dawn Security Lab, JD.com Qidan He | Director, Chief Researcher, Dawn Security Lab, JD.com

12
 
 

Location-based dating (LBD) apps enable users to meet new people nearby and online by browsing others' profiles, which often contain very personal and sensitive data. We systematically analyze 15 LBD apps on the prevalence of privacy risks that can result in abuse by adversarial users who want to stalk, harass, or harm others. Through a systematic manual analysis of these apps, we assess which personal and sensitive data is shared with other users, both as (intended) data exposure and as inadvertent yet powerful leaks in API traffic that is otherwise hidden from a user, violating their mental model of what they share on LBD apps.

As one finding of our research, 6 apps allow for pinpointing a victim's exact location, enabling physical threats to users' personal safety. All these data exposures and leaks—supported by easy account creation—enable targeted or large-scale, long-term, and stealthy profiling and tracking of LBD app users. While privacy policies acknowledge personal data processing, and a tension exists between app functionality and user privacy, significant data privacy risks remain. We recommend user control, data minimization, and API hardening as countermeasures to protect users' privacy.

By: Karel Dhondt | Researcher Victor Le Pochat | Postdoctoral Researcher, DistriNet, KU Leuven

Full Abstract and Presentation Materials: blackhat.com/us-24/briefings/schedule/#swipe-left-for-identity-theft-an-analysis-of-user-data-privacy-risks-on-location-based-dating-apps-39007

White Paper http://i.blackhat.com/BH-US-24/Presentations/US24-Dhondt-Swipe-Left-for-Identity-Theft-wp.pdf

13
1
Comparison of Payment Methods (eylenburg.github.io)
submitted 6 months ago* (last edited 6 months ago) by jet@hackertalks.com to c/applied_paranoia@dubvee.org
 
 

I love evelynburg.github.io

This is comparison of various payment methods. In my opinion the most important aspects are: (1) privacy, (2) fungibility and resilience to censorship and expropriation, (3) day-to-day convenience and acceptance.

14
3
submitted 6 months ago* (last edited 6 months ago) by jet@hackertalks.com to c/applied_paranoia@dubvee.org
 
 

Hacking backdoor backdoors by taking over abandoned C&C domains

Writeup - https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/)

Youtube review - Low Level https://youtu.be/ST1frnx-5Nw

15
 
 

Ideal for archiving important data, such as password vault keys, in case of death information, swiss bank accounts, etc. The key can be distributed amongst trusted parties, so no single person can access, but if they cooperate it could be resurrected.

paperback is a paper-based backup scheme that is secure and easy-to-use. Backups are encrypted, and the secret key is split into numerous "key shards" which can be stored separately (by different individuals), removing the need for any individual to memorise a secret passphrase.

16
 
 

A hardware secure token that requires a fingerprint to unlock adds another factor to your secure authentication.

  • Something you have
  • Something you are

Even if the key falls out of your control, the fingerprint reader would render it useless

yubico

I'm a big fan of yubikeys, they have the bio series with built in fingerprint reader, and now the multi-protocol edition is not only webauthn fido2, it acts as a smartcard/PIV (i.e. ssh keys) Tech Details

The one annoying thing is the multi-protocol version isn't generally available, the fido2 edition is available

feitian

also provides fingerprint fido2 keys, but I'm not familiar with their security reputation https://shop.ftsafe.us/collections/fido-security-key-biometric

others

Any other biometric key options?

17
 
 

BusKill - A clip on device that when disconnected from a computer will trigger a fail safe event on the computer, such as locking the computer, shutting down, or any script you care for. Totally open source, both hardware and software.

If your a digital nomad or use a computer in public, this might be of interest.

https://www.buskill.in/ https://github.com/BusKill

You can even build it yourself

https://docs.buskill.in/buskill-app/en/stable/hardware_dev/bom.html

If you want to purchase a prebuilt model, they do accept crypto!