Security
On security matters, mostly digital.
A utility for disabling Windows 10
While there may be people who actually like Windows 10, there are also many people who aren’t interested in fully exposing every part of their digital life to for-profit mining as means of offsetting Microsoft’s declining profits in the desktop OS business, and if you’re one of those, fighting Microsoft’s truly viral (and malware) marketing techniques is quite a hassle. It appears there may be an easier way.
Micrsoft has finally provided an “easy” way for people to turn off windows OS update (e.g. from 7.x or 8.x to 10) from happening automatically and without user intervention (and frequently in outright defiance of clear user intent because profits first!)
The short form for people who are comfortable with some of the internal workings of Windows is:
Search for "edit group policy" and open the editor then follow the selection cascade as: Local Computer Policy -> Computer Configuration -> Administrative Templates -> windows Components -> Windows Update ->> Turn off the upgrade to the latest version... ->> [x] enabled
The longer instructions are at this link: https://support.microsoft.com/en-us/kb/3080351
Easy, no?
I suggest doing this and then downloading and installing the following program. It will pretty much do the same thing but it also checks to see if Microsoft has already kindly filled your hard disk with malware without your permission and offers to delete it:
https://www.grc.com/never10.htm
Note that my previous posts about removing specific “updates” are still relevant. The above should prevent windows 10 from auto-updating but Microsoft has been pushing updates with “telemetry” to Win 7 and Win 8, which are also spyware and are tracking you and reporting your usage patterns back to Microsoft without telling you or asking you.
Welcome to the new economy: you’re the product.
Turn off windows update now!
If you haven’t already, turn off Windows update now. Microsoft has recently started installing Windows 10 spyware without consent. A good friend of mine had a bunch of systems at the company where he runs IT hacked by Microsoft over the weekend, which broke the certificate store for WPA-2 and thus their wifi connections.
To be clear, Windows 10 is spyware. Microsoft has changed their business model from selling a product to selling data – your data – to whoever they want. Windows 10 comes with a EULA that gives them the right to steal everything on your computer – your email, your private pictures, your home movies, your love letters, your medical records, your financial records – anything they want without telling you. “If you’re not paying for the product, you are the product.”
If this happens to you, I suggest contacting your state attorney general and filing a complaint against Microsoft. Hopefully a crushing class action suit or perhaps jail time for the executives that dreamed up this massive heist will help deter future corporate data thieves, though that’s certainly irrational optimism.
I wish I could recommend switching to Linux for everyone, but there’s a lot of software that still depends on Windows and a lot of users that will have a hard time migrating (developers: please stop developing for Microsoft). Apple seems unequivocally better in refusing to act as key player in bringing about Total Information Awareness. I’m not a huge fan of their walled garden and computers as overpriced fashion accessories approach, but it is far better than outright theft. For those that are slightly computer savvy, there’s Linux Mint, which is quite usable and genuinely free.
These instructions might help prevent that disaster of an update being visited upon you (and possibly law enforcement visits to come after Microsoft starts sifting through all your datas and forwarding on whatever they find). The latest reports suggest they aren’t enough, but it is the best I have found other than isolating your windows box from the internet completely.
PGP Usability Regression thanks to Enigmail
The latest auto update to Enigmail, the essential plugin for Thunderbird for encrypted mail, is a fairly dynamic project that occasionally makes UI and usability decisions that not everyone agrees with.
The latest is a problem for me. I use K9 for mobile mail and K9 doesn’t support PGP/MIME, but Enigmail just:
Why? OK – PGP/MIME leaks less metainformation than inline PGP, but at the expense of compatibility. K9 should support PGP/MIME, but it doesn’t. Enigmail should have synchronized with K9 and released PGP/MIME when mobile users could use it.
But encryption people often insist that the only use case that matters is some edge case they think is critical. They like to say that nobody should read encrypted mail on a mobile device because the baseband of the device is intrinsically insecure (all cell phones are intrinsically insecure – phones should treat the data radio as a serial modem and the OS and the data modem should interact only over a very simple command set – indeed, the radio should be a replaceable module, but that gets beyond this particular issue).
For now, make sure your default encoding is Inline-PGP or you’ll break encryption. Encryption only works if it is easy to use and universally available. When people can’t read their messages, they just stop using it. This isn’t security, this is a mistake.
Signal Desktop: Probably a good thing
Signal is an easy to use chat tool that competes (effectively) with What’sApp or Viber. They’ve just released a desktop version which is being “preview released/buzz generating released.” It is developed by a guy with some cred in the open source and crypto movement, Moxie Marlinspike. I use it, but do not entirely trust it.
I’m not completely on board with Signal. It is open source, and so in theory we can verify the code. But there’s some history I find disquieting. So while I recommend it as the best, easiest to use, (probably) most secure messaging tool available, I do so with some reservations.
- It originally handled encrypted SMS messages. There is a long argument about why they broke SMS support on the mailing lists. I find all of the arguments Whisper Systems made specious and unconvincing and cannot ignore the fact that the SMS tool sent messages through the local carrier (Asiacell, Korek, or Zain here). Breaking that meant secure messages only go through Whisper Systems’ Google-managed servers where all metadata is captured and accessible to the USG. Since it was open source, that version has been forked and is still developed, I use the SMSSecure fork myself
- Signal has captured all the USG funding for messaging systems. Alternatives are not getting funds. This may make sense from a purely managerial point of view, but also creates a single point of infiltration. It is far easier to compromise a single project if there aren’t competing projects. Part of the strength of Open Source is only achieved when competing development teams are trying to one up each other and expose each other’s flaws (FreeBSD and OpenBSD for example). In a monoculture, the checks and balances are weaker.
- Signal has grown more intimate with Google over time. The desktop version sign up uses your “google ID” to get you in the queue. Google is the largest commercial spy agency in the world, collecting more data on more people than any other organization except probably the NSA. They’re currently an advertising company and make their money selling your data to advertisers, something they’re quite disingenuous about, but the data trove they’ve built is regularly mined by organizations with more nefarious aims than merely fleecing you.
What to do? Well, I use signal. I’m pretty confident the encryption is good, or at least as good as anything else available. I know my metadata is being collected and shared, but until Jake convinces Moxie to use anonymous identifiers for accounts and message through Tor hidden nodes, you have to be very tech savvy to get around that and there’s no Civil Society grants going to any other messaging services using, for example, an open standard like a Jabber server on a hidden node with OTR.
For now, take a half step up the security ladder and stop using commercial faux security (or unverifiable security, which is the same thing) and give Signal a try.
Maybe at some later date I’ll write up an easy to follow guide on setting up your own jabber server as a tor hidden service and federating it so you can message securely, anonymously, and keep your data (meta and otherwise) on your own hardware in your own house, where it still has at least a little legal protection.