NoGoolag – Telegram
NoGoolag
4.71K subscribers
20K photos
11.2K videos
785 files
20.1K links
Live free!

📡 @NoGoolag

FAQ:
http://t.me/NoGoolag/169

★Group:
https://news.1rj.ru/str/joinchat/nMOOE4YJPDFhZjZk

📡 @Libreware

📚 @SaveAlexandria

📡 @BallMemes

FORWARDS ARE NOT ENDORSEMENTS

💯 % satire OSINT
Download Telegram
NoGoolag
Stop Using Encrypted Email https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html Comments https://news.ycombinator.com/item?id=22368888 #email #encryption #why
tldr stop using pgp encryption for email because

1. because email uses plaintext by default, someone will inevitability reply in plaintext, and likely with a copy of the whole thread, this would not be the case with something like Signal where there is no plaintext option

2. metadata is leaked by default

3. there is no "disappearing messages" feature

Response:

1. nothing works if you use it wrong, also it wouldn't be hard to make an email client, or addon for an existing client, that forces the user to only send pgp encrypted messages

2. this is a good point but isn't a problem if one of the people messaging runs the server and can wipe the metadata from it

3. in free software messaging you can generally never verify that another person is using the same client as you, so you can never make sure their messages are disappearing, making this a moot point

The email server isn't the only entity that can store the metadata.

The article is basically just "X isn't perfect so don't use it at all", completely ignoring the fact that X is far better than the alternative.

Sure, signal is better but that doesn't mean I should just drop encrypted email.
Forwarded from cRyPtHoN INFOSEC (EN)
Hackers Were Inside Citrix for Five Months.

Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords.

Citrix provides software used by hundreds of thousands of clients worldwide, including most of the Fortune 100 companies. It is perhaps best known for selling virtual private networking (VPN) software that lets users remotely access networks and computers over an encrypted connection.

https://krebsonsecurity.com/2020/02/hackers-were-inside-citrix-for-five-months/

📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@NoGoolag
⚠️ Scam Alert: You've Been Selected for 'Like of the Year 2020' Cash Prizes

Cybersecurity researchers have discovered a large-scale ongoing fraud scheme that lures unsuspecting Russian Internet users with promises of financial rewards to steal their payment card information.

According to researchers at Group-IB, the multi-stage phishing attack exploited the credibility of Russian Internet portal Rambler to trick users into participating in a fictitious "Like of the Year 2020" contest.

The development is a reminder that rewards-based social engineering campaigns continue to be an effective means to scam users, not to mention the leveraging the collected data to their financial advantage.

Under the "Like of the Year" scheme, users were invited to win a large cash prize, telling them they've been randomly selected after liking a post on social media platforms such as VKontakte.

The invites were sent via an email blast by hacking the mail servers of a fiscal data operator, which refers to a legal entity created to aggregate, store and process fiscal data to serve the Federal Tax Service of Russia.

👉🏼 Read more:
https://thehackernews.com/2020/02/like-of-the-year-scam.html

https://www.group-ib.ru/media/like-2020/

#scam #phishing #alert #DeleteFacebook
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
Forwarded from cRyPtHoN INFOSEC (EN)
Google gobbling Fitbit is a major privacy risk, warns EU data protection advisor.

The European Data Protection Board (EDPB) has intervened to raise concerns about Google’s plan to scoop up the health and activity data of millions of Fitbit users — at a time when the company is under intense scrutiny over how extensively it tracks people online and for antitrust concerns.

Google confirmed its plan to acquire Fitbit last November, saying it would pay $7.35 per share for the wearable maker in an all-cash deal that valued Fitbit, and therefore the activity, health, sleep and location data it can hold on its more than 28M active users, at ~$2.1 billion.

https://techcrunch.com/2020/02/20/google-gobbling-fitbit-is-a-major-privacy-risk-warns-eu-data-protection-advisor/

Read Via Telegram

📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@NoGoolag
Forwarded from cRyPtHoN INFOSEC (EN)
New Mexico Sues Google for Mining Children's Data.

Google is facing a new lawsuit for allegedly using its Google for Education platform to gather the personal and private data from students under the age of thirteen.

As part of the Google for Education platform, United States schools are offered free Google Chromebooks and access to the G Suite for Education service.

https://www.bleepingcomputer.com/news/legal/new-mexico-sues-google-for-mining-childrens-data/

Read Via Telegram

📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@NoGoolag
National Counterintelligence Strategy of the United States of America 2020-2022

"Hacktivists, activists, and whistle-blowers pose serious threats"

The new intelligence report "National Counterintelligence Strategy 2020-2022" has it all and sees threats everywhere

Last week, the National Counterintelligence and Security Center (NCSC), which reports to the Office of the Director of National Intelligence (ODNI), published the National Counterintelligence Strategy 2020-2022, which sets out a new approach to counterintelligence to combat threats that have emerged after 2016, when the last report was published.

What is new is that the activities of the American and enemy intelligence services are no longer focused solely on politics and the military, but ultimately the entire civilian structure of a country has become a target. The following are named as targets: the critical infrastructure, main US supply chains, the US economy, American democratic institutions and cyber and technical operations. The NCSC therefore works not only with all the authorities, but also with the private sector, universities and foreign partners.

👉🏼 PDF:
https://www.dni.gov/files/NCSC/documents/features/20200205-National_CI_Strategy_2020_2022.pdf

#hacktivists #activists #whistleblowers #counterintelligence #USA #pdf
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
Open Note Scanner + PDF Converter

A full FLOSS alternative to document scanner apps like CamScanner

https://f-droid.org/app/com.todobom.opennotescanner
https://f-droid.org/app/swati4star.createpdf

(Open Note Scanner requires you to download OpenCV manager from GitHub or Play)


📡 @NoGoolag 📡 @Libreware
#apps #opennotesscanner #pdf #converter #notes #scanner #pdf #camscanner
Session

A Signal protocol fork with decentralized servers and no need for a phone number


Session is a cross-platform, anonymous and decentralized messaging application. You don't need a phone number or email address to make an account.

Session uses the Loki Service Node network to route the data, for which the nodes are rewarded with $LOKI. The Loki Network itself is made up of some ~1000 community operated Service Nodes where 44% of the supply is held in the SNs - about US$7.5 million at the moment.

I love Signal, but I don't love the attached phone numbers or central servers, but I know there's a challenge in allowing an altruistic intention over a financial incentive for the node operators - Sybil resistance. By using Loki's Service Node network, the crypto-economics is designed in a way that a bad actor would drive the price exponentially up while trying to accumulate enough Loki to be able to perform any traffic analysis on the routed data.

Think of it as a Signal fork meets a Monero fork meets an incentivized TOR network.

Web: getsession.org

FAQ: getsession.org/faq

Whitepaper:
https://getsession.org/wp-content/uploads/2020/02/Session-Whitepaper.pdf

Sources: github.com/Loki-project

Comments:
http://old.reddit.com/r/Android/comments/f4yt7z/session_a_signal_protocol_fork_with_decentralized/


📡 @NoGoolag 📡 @Libreware
#session #signal #decentralized #im #instant #messaging #alternatives
Forwarded from cRyPtHoN INFOSEC (EN)
Marchers support Assange ahead of London extradition hearing.

LONDON (AP) — Hundreds of supporters of Julian Assange marched through London on Saturday to pressure the U.K. government into refusing to extradite the WikiLeaks founder to the United States to face spying charges.

Famous Britons, including Pink Floyd’s Roger Waters, Pretenders singer Chrissie Hynde and fashion designer Vivienne Westwood joined the crowd protesting the U.S. espionage charges against the founder of the secret-spilling website. An extradition hearing for Assange is due to begin in a London court on Monday.

https://apnews.com/bb8d93bb1c1510b70b0f2c71e93879ca

Read Via Telegram

📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@NoGoolag
Forwarded from Aurora OSS
AuroraStore_3.1.9.apk
4.1 MB
Changelog : v3.1.9
• Update translations
• Bug fixes and improvements
Forwarded from cRyPtHoN INFOSEC (EN)
Google to put a muzzle on Android apps accessing location data in the background.

Google will also update Android's location access permission prompt (again).

Google has announced this week plans to crack down on Android apps that abuse the OS permissions system and request access to user geo-location data when the app is not in use.

Starting with May, the OS maker plans to show warnings in the Play Store backend to all Android app developers about the need to update their apps.

Google plans to review its own apps as well, the company said in a blog post this week.

https://www.zdnet.com/article/google-to-put-a-muzzle-on-android-apps-accessing-location-data-in-the-background/

📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@NoGoolag
UNLP + MicroG Q location fix

A rough fix for the location issue on Q has been found (thanks to tragedypoet on github) and implemented in the NoGoolag fork here.

Not been tested yet, if anybody wants to be brave, please go compile it and tell us if it worked for you.

(Also I just brought a 2-year old fork with diverging commits up to date in like 15 minutes, so there's a chance you may encounter some minor compilation errors)

github.com/nogoolag
Search engine alternatives

♦️ DuckDuckGo
-> https://duckduckgo.com
-> http://3g2upl4pq6kufc4m.onion
- US based (EU servers for EU, though).
- Mostly Bing, Yahoo and own crawler results
- Issues: Proprietary, some components are free
- ToS;DR: https://tosdr.org/#duckduckgo
- Criticism here
-- https://gitlab.com/prism-break/prism-break/issues/2143
-- https://redd.it/aqz3q8

♦️ SearX
-> https://searx.xyz
-> https://searx.xyz/tor.html
-> searx.space for other instances
- Instance of the open source metasearch engine
- You can choose which search engine to use for the results.
- Issues: No privacy policy, some public instances use Cloudflare, ads or may log IP addresses/searches.

♦️ Qwant
-> https://www.qwant.com
- French based
- Own crawlers and Bing results.
- Issues: "French law makes it mandatory to keep some connection data for one year"
- Privacy Policy: https://about.qwant.com/legal/privacy
- ToS;DR: https://tosdr.org/#qwant
- Criticism:
-- https://www.reddit.com/r/privacy/comments/bstxms/qwants_future_regarding_ethics
-- https://forum.vivaldi.net/topic/35097/ethics-a-heavy-suspicion-towards-the-qwant-search-engine

♦️ MetaGer
-> https://metager.org
- Open-source metasearch engine
- Based in Germany
- Stores some information temporarily: https://metager.org/datenschutz

♦️ YaCy
-> https://yacy.net
- Distributed self hosted search engine, built on P2P networks

♦️ Mojeek
-> https://www.mojeek.com
- Uses its own crawlers

♦️ Whoogle
https://github.com/benbusby/whoogle-search

Others:

♦️ List of search engines:
-> https://en.m.wikipedia.org/wiki/List_of_search_engines

♦️ Startpage
-> startpage.com
- Startpage CEO interview
- uses Goolag search

♦️ Ecosia
-> https://www.ecosia.org
- A bing frontend
- Criticism:
-- https://info.ecosia.org/privacy#privacy-faq-item-6

♦️Gigablast
-> https://gigablast.com
- Fails SSL at Mozilla observatory
-- https://observatory.mozilla.org/analyze/www.gigablast.com

♦️ Yippy
-> yippy.com
- Uses Goolag ads

♦️ SwissCows
-> swisscows.ch

♦️ Disconnect
-> search.disconnect.me
- Connects to Amazon

♦️ Wolfram Alpha
-> www.wolframalpha.com
- Doesn't even work without JavaScript

♦️ Oscobk
-> oscobo.co.ukk

♦️ Lukol
-> www.lukol.com
- Shares data with Goolag
- Privacy policy: https://lukol.com/privacy.php


📡 @NoGoolag 📡 @Libreware
#searchengines #search #alternatives
Forwarded from cRyPtHoN INFOSEC (EN)
Facebook will pay for users' voice recordings after it was caught listening to and transcribing private Messenger chats to improve its speech recognition software.

🌀 The platform will pay up to $5 via PayPal for various voice recordings

🌀 Recordings include phrases like 'Hey Portal' and first names of Facebook friends

🌀 Facebook says that it won't link the recordings to one's account

🌀 The policy follows reports from last year that it was listening to audio recordings

🌀 Facebook paid third-party contractors to analyze recordings for accuracy

https://www.dailymail.co.uk/sciencetech/article-8029495/Facebook-pay-users-voice-recordings-caught-listening-Messenger-chats.html

📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@NoGoolag