Grepular

I've had a few emails, and a few contacts over Matrix over the years. Barely any though. My email and matrix id are both on my front page at https://www.grepular.com. I recently added a "Like" button at various places throughout the site, front page, end of articles etc, so a click, followed by typing an optional message and another click is all it would take. I've been wondering if people ignore it due to assuming it is somehow connected to social media.

> My email and matrix id are both on my front page at https://www.grepular.com I've been tempted to put my email address directly on my personal site but just assumed I'd be flooded with automated spam. How have you found it?

Apparently https://www.grepular.com/ is from UK. Wonder how feels if people start blaming him for colonialism. Govt proscribing access by law is something, but I cannot imagine a guy going out of the way to put ipblocks.

On the incoming email encryption - yeah, that's in the MTA not the webmail software - having said that, I'm basing what I'm doing off this: https://grepular.com/Automatically_Encrypting_all_Incoming_Email at least partly because Perl is my goto hack-shit-together langiage, I could _easily_ imagine a lot of my cow-orkers choosing to do that in php. And yeah, I hadn't followed your links, and made poor assumptions about your project. I just briefly skimmed through some of them and I've got a question - have you got a way to protect the passphrase from ending up somewhere the browser can see it? (or, if the decryption is "passphraseless" from the browsers point of view, how do you ensure rogue javascript could pass encrypted data in and retrieve cleartext?)

Easily my favorite interface for throw away emails. Ironically, it allows a lot of tracking through (https://grepular.com/email_privacy_tester)

Another VPS user here. Linode and Digital Ocean offer great guides to get started. I've basically moved two domains off of the formerly free Google Apps accounts onto my own servers. Overall things have gone well. I like being able to set my own file attachment size limits. As others have said, a 'clean' IP seems quite important. I've had emails disappear into Google's spam filters despite working previously, as reported by many here[0]. Was tempted by Virtualmin but went with the manual config in the end. Am receiving multiple domains on one server, so it has been a learning curve. Not convinced I've 'learned' a great deal particularly. At least a slightly clearer understanding of the moving parts involved. That's Postfix, Dovecot and Spamassassin, btw. All served over SSL/TLS only, i.e. only IMAPS is enabled in Dovecot. Tempted to start encrypting all mail as it arrives on the server with GPG, as per Mike Cardwell's advice[1], although I'd have to use mailgate[2,3] with Postfix instead of Mike's Perl script for Exim. I'm also not sure how that would work with search, spam and such. Perhaps it's better to delete mail regularly, saving any files and details needed locally. Had a slight edge-case issue arise recently - my phone battery died and I didn't have my machine so my mail was inaccessible until home. I've refrained from enabling webmail and think I'll keep it that way for now. Just make sure I have 'a device' with the credentials saved on it on my person when…

> the real answer to this Alternatively, I like the concept of Tor onion services, where the "domains" are acquired in a permissionless fashion. Names are just randomly generated ed25519 strings so there's no squatting and your address never expires. If you want a vanity domain, you just commit compute time to brute force something human-readable. [1] The obvious drawback is that you have to be a Tor client, but if you manage your own DNS, you could use Tor's DNSPort mode as a kind of forwarding target for non-Tor clients on your lan. [2] 1: https://www.jamieweb.net/blog/onionv3-vanity-address/ 2: https://www.grepular.com/Transparent_Access_to_Tor_Hidden_Services

https://grepular.com/An_NFC_PGP_SmartCard_For_Android I believe you would still have to write most of the software involved yourself. A discussion of smart card login with SSH as of five years ago: https://grepular.com/Smart_Cards_and_SSH_Authentication And a useful discussion on SSH and 2FA last year here on HN: https://news.ycombinator.com/item?id=10885654

You can also configure it to encrypt incoming mail: https://grepular.com/Automatically_Encrypting_all_Incoming_Email

This is pretty weak, IMHO. You should at least use on-the-fly PGP encryption like Mike Cardwell detailed: https://grepular.com/Automatically_Encrypting_all_Incoming_Email. You basically just add the public keys to the exim account and it uses a transport filter to look them up and encrypt automatically. With a properly configured client, you'll never have decrypted data on disk.

If the server's capable to decrypt the data, unless you use a trusted HSM that keeps an audit trail, it generally doesn't make sense to encrypt in the first place. Especially with anything resource-intensive. When the server has everything to decrypt the data, the encryption only does the obfuscation, not any strong protection. Otherwise, if we talk about - just for example - a receiving mail server (MDA) that has encrypted mailbox storage like [1], then it really depends on how much mail you receive. For a typical personal mailbox, where the steady rate is less than an email-per-minute (and usual email size is some kilobytes, not megabytes), encryption overhead is negligible. Such server would sleep most of time anyway. [1]: https://grepular.com/Automatically_Encrypting_all_Incoming_Email

It's all possible with HTTP statuses according to a link[1] posted above. [1] https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Infor…

If you don't care about metadata then imho the approach presented in a blog post[1] linked in your firespotting thread is most reasonable. Most importantly the private key never touches the mail-server. If you do care about metadata then you could do some lavabitesque tricks in addition to encrypting the message bodies. [1] https://grepular.com/Automatically_Encrypting_all_Incoming_Email_Part_…

I am not sophisticated enough to critically assess these documents, but here are two sources: For a basic overview of Linux security: Red Hat Enterprise Linux 6 Security Guide https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_… Here is a blog post by someone who is protecting his laptop, for each security measure he says what and why: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated… HN Discussion: https://news.ycombinator.com/item?id=4018426

I find it hard to trust a closed source app with all my passwords. Also: https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details

Seems, the author has already documented this. For those interested: https://grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail

Yes, here is an example of an address that doesn't exist: https://grepular.com/email_privacy_tester/lookup?code=gapz72l9ox3l95p7… If the address exists in Gmail, you get a response on "DNS Prefetch - Anchor", so it could be used to determine whether to send an email or not. I'm not a mail administrator but I can imagine how it might be useful to a spammer, e.g to stop mass bounce replies.

The highly-upvoted mail-bug testing site in comments says gmail isn't vulnerable to bgsound - https://grepular.com/email_privacy_tester/

Couple this with the unencrypted metadata on mobile problem: https://grepular.com/Dropbox_Mobile_Less_Secure_Than_Dropbox_Desktop And how their "encryption" on the server side is basically a lie, as they do dedupe on data: http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-user-privac… I'm stunned that anyone would use them for anything for ephemeral data you wouldn't mind posting in public.

Technical details here: https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Infor… The trick is to identify GET requests that will succeed only if the victim is logged into $SITE_OF_INTEREST, and bury them in an <img src="https://SITE_OF_INTEREST/more/stuff/here" onload="is_logged_in()" onerror="not_logged_in()" ...> If $SITE_OF_INTEREST doesn't have decent CSRF protection, this is an easy way for a rogue website to not only make a request, but observe the result.

I haven't done it, but some years ago a Mike... C.? published a description of how he did email, then. Public/private keypairs. Inbound email would arrive at his server and immediately be encrypted using a public key. It would sit on his server encrypted. When he pulled it off, he would decrypt it at his client using the private key. If the server was compromised, at that point in time, all the adversary would get would be a bunch of encrypted messages to which the relevant key for decryption was not present on the server. Just to be clear, this was his keypair, used to keep incoming email at rest on his server encrypted with no local means to decrypt. Irrespective of whether the sender did or didn't use encryption when sending the email to him. I presume one would want some sort of canary to warn of compromise with respect to further messaging that might arrive or be sent. Outbound, I presume he was not retaining copies on the server and was using whatever degree of encryption the recipient could handle and the situation warranted. P.S. I realize this doesn't solve your "you're SPAM" labeling by an ever more differentiating Internet email network. P.P.S. I'm pretty sure this is it. Site/page design may have been redone a bit. Just if and as this interests anybody -- I haven't taken the time to reread it, right now. https://www.grepular.com/Automatically_Encrypting_all_Incoming_Email

I can't imagine how you could build a foolproof (or more importantly, state-sponsored-team-of-experts-proof) time-limited system. Assuming the file is digital, and can be accessed freely, you can make infinite bit-identical copies and fiddle your system clocks to make it work. You'd need some sort of physical real-time clock combined with the memory storing the material, which wipes it after a given time. Maybe even a physical medium which degrades over time[3] could work, but that could be foiled by controlling the environmental conditions (inert gas atmosphere to avoid oxidation, cold temps to slow electron migration, etc). There's a couple of interesting physical-security related links in a comment of mine from the other week: http://news.ycombinator.com/item?id=2932492 My personal approach would be something like providing an incredibly locked-down laptop/netbook (https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated… would be a good start), but with additional physical security improvements (battery/big caps wired directly to HDD and RAM via a set of tamper switches[1], disabling all IO ports in software and filling them with epoxy / disconnecting internally) You could then wire in an RTC to the same system, as well as perhaps using a GPS receiver to verify the time (Yes, you could jam/spoof GPS signals if you knew to expect them, but that's still raising the bar). One final approach would be to have some other trusted party/system which…

This is a pretty good question - mostly because the heart of good security, good airline safety and good surgery is a checklist. And I don't think I have a checklist thats uptodate, even the one in my head. ShowHN: using HN as my personal todo list cos I actually look at my threads list daily... https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated… https://help.ubuntu.com/community/Security https://news.ycombinator.com/item?id=4018426 http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.ht… http://www.freebsd.org/doc/handbook/security.html That site on secondary GPGkeys I keep failing to find