Aug 26, 2024
The founder and head of the Telegram messenger, multimillionaire Pavel Durov
was detained by police immediately after arrival at Le Bourget airport. French
law enforcement have long been unhappy with Durov’s refusal to moderate content
and to cooperate with authorities in disclosing information about users
suspected of distributing drugs, child pornography, fraud and other criminal
activity. Moderation is nearly nonexistent on Telegram except the most severe
cases like islamist terrorism: usually banning their public channels.
However, Telegram did also cooperate with Putin's Russia authorities in banning
Navalny's "smart voting." Durov's own explanation for this was that "it is better
to ban Navalny than ban Telegram in Russia." This is clearly a deceit because a
few years before that, Russian authorities have demonstrated their inability to
block Telegram.
Durov is positioning himself as a hardcore libertarian protecting all kinds of
freedoms, especially the freedom of speech and expression (against evil state).
Many believe it is true, hence the wave of public support: #FreePavel
.
![Du Rove Du Rove](images/durov.png)
The real picture is, however, quite different. Apart from the very extravagant
personality of Pavel Durov (many still remember as he threw rouble banknotes
from his St. Petersburg head office balcony for personal amusement), neither
the Telegram platform nor the company in fact have anything in common with
protecting liberties. Telegram is quite a standard commercial walled garden
platform with the main aim to monetize its growing user base. "Privacy" for
Telegram is nothing more than a marketing ploy.
Telegram is advertised as "secure" and "private" although it has from the
beginning been devised as a centralized platform aimed to get exclusive control
over its users' communication. There is no end-to-end encryption by default.
The MTProto protocol used by Telegram is a home-made thing, never seriously
audited by cryptography experts. The Telegram client is open source (and is
even available in blob-free open source version on
F-Droid), but the
server is not. So nothing is known about what actually happens with the user's
communication data and metadata. This is not a minor thing because Telegram
keeps all the data on its cloud servers for user's "convenience." This means
that all the messages are unencrypted (for Telegram), and potentially
accessible to the third parties.
Fun, soon after Durov's detention in Paris, bureaucrats from the administration
of the president in Russia, the ministry of defence and large state owned
corporations were instructed to delete their Telegram communications. No, this
won't help if everything is kept on the cloud servers. It is well known that
Telegram has a reputation of "inaccessible to FSB" and therefore widely used by
a range of Russian governmental and military users. These people have been
reluctant to use the official "safe" and "encrypted" tools that have full FSB
certification because they believe (quite reasonably) that these are all
wiretapped. Telegram is also the common communication tool for Russian troops
attacking Ukraine. Now it is easy to guess how confused and scared they are!
Every user of Telegram is identified with and linked to the mobile number,
which is really a mockery of privacy. Participants of Hong Kong protests were
able to verify this: the mobile numbers and therefore personal identity of many
of them were easily obtained from by the "private" Telegram by the mainland
Chinese police. To access the account of most users (two-step auth is not
enabled by default, there is no password for most users!) the attacker just
needs... access to the SMS, which is a trivial task for the mobile operator
and therefore the law enforcement (or in many cases even a hacker using social
engineering to reissue the SIM-card). Then the content is not encrypted, except
for the "secret chats" that only few actually use.
Some years ago, Russian authorities tried to access Telegram contents of quite
a few members of Putin's opposition by secretly coercing the mobile operators
to forward authentication codes sent by SMS. Admins of quite a few Russian and
Belorussian opposition chats and even regular subscribers were also identified.
There exist several OSINT tools that help identify Telegram chatters, some are
available for just everyone for a moderate price.
Not only privacy and security, but even data integrity of Telegram is
questionable. The company protocols of dealing with the data are questionable.
There are rumors that some years ago Durov himself deleted Telegram chats of
his personal rivals at will.
Telegram is "free" to users, but running it incurs huge costs. Who pays then?
The users actually pay for it with their ever accumulating private data (their
privacy), their increasing flock size, traffic and now also paid subscription
and the TON cryptocurrency.
Telegram has always been a secretive non-transparent company. There are rumors
that its major investors include Emirates' funds with the major beneficiaries
from Russia. Even though Durov usually denies any links with Russia, Telegram
very likely significantly depends on Russian oligarchs' money. But little is
still known about the financial affairs at Telegram. Also little is known about
the organizational structure of Telegram. Nonetheless, everything looks like a
single person--the CEO Pavel Durov--has the complete control over everything,
from technology to HR, finances and relations with investors.
It looks like Durov has created a platform advertised for "freedom" and
"privacy," inviting everyone for whatever purposes, even the most evil and
criminal ones. But Telegram was deliberately created as a single centralized
platform, apparently to benefit from the full control for profit. Full control,
however, involves full responsibility, including law enforcement access and
moderation.
"Guardians of internet freedoms" say that accusing Durov of complicity in
crimes the users do is equal to accusing the manufacturer of a hammer: everyone
can use it for nailing as well as for killing, all outside of the maker's
control or even knowledge. But this is not true. In the case of Telegram, the
instrument is not given to the users. Users do not possess it. They are just
allowed to hold it for a while. Durov's situation is equivalent to renting out
a hammer for securing profits, without asking if it is actually used for
nailing or killing. And even knowing that in many cases it is in fact used for
killing, breaking into houses and other criminal purposes. The purpose is
profit. Then, those who rent out the hammer are responsible for what their
paying users do with it. Any benefits obtained from criminal abuse of the
hammer are complicity, even if indirect.
The only way to protect liberties and freedom of speech and expression is
through decentralized or federated platforms. Then, the end user is the owner
of the decentralized unit and bears full responsibility for his/her own use.
Decentralized technology is not only safer and more secure, but also more
responsible.
Apr 15, 2024
Googles Android Play Store blir verre over tid. Det blir stadig mer strødd med ubrukelige apper som utelukkende tar sikte på å vise reklame. I navnet av "personvern" gjennomfører Google ytterligere hindringer for både utviklere og brukere, mens ekte skadelig programvare blomstrer på plattformen. Det ofte blir et mareritt for utviklere av åpne kilde programmer som er fokusert på personvern og sikkerhet. Den nylige de-listingen av Snikket—en sikker, personvernsentrert melding app—viser at personalet som er ansvarlig for applikasjonsvurdering på Googles side, er mentalt forsinket idioter. Sjekk ut hele historien her: https://snikket.org/blog/snikket-google-play-removal/.
Google, er det slik at ansatter med IQ<50 koster mindre? Eller alle mennesker på Google ble erstattet med en AI som mangler intelligens? Mange utviklere gir opp å slite med idioter på Googles applikasjonsvurdering og slutter å distribuere appene sine i Play Store (her kommer en annet eksempel).
Situasjonen kan være så absurd at åpne kilde Conversations appen som går ikke fri (NOK 47) på Google Play måtte forringe funksjonaliteten på denne distribusjonsplattformen. Den samme appen går gratis med fult funksjonalitet på F-Droid.
Men det er en løsning for alle Android-brukere: bare installer F-Droid, en appbutikk som publiserer åpne kilde programmer uten reklame, traking, datalekkasjer, skadevare og bakdører.
Den eneste garantien mot skadelig programvare er åpen kildekode som alle som helst kan sjekke og revidere: mange øyne oppdager problemer tidligere og bedre. F-Droid gjennomfører "reproducible builds" som sikrer at binær apk bloben er bygget av samme kildekoden som utvikler har publisert, så det finnes ikke noe uautorisert tilleg eller endringer (apk fra Google Play inkluderer Googles blober for reklame og tracking). Det anbefales å søke apper først på F-Droid og gå til Google Play kun når den ikke er tilgjengelig. Da skal Google Play brukes bare for apper som er klarert på forhånd, f.eks. banken.
Mar 19, 2024
I use NextGenTel with fibre broadband connection
as my home Internet provider. The connection line works fairly well with
no interruptions. I have been using a Mikrotik router
for nearly a year now and have experienced no single interruption.
No hanging internet, no problems at all. I nearly forgot that it is
here.
![Year traffic plot Year traffic plot](images/traff-yearly.gif)
![Mikrotik Mikrotik](images/mikrotik.jpg)
Why I love Mikrotik is the Router
OS, a
professional operating system with tons of configurability and
fine tuning. You can tweak any aspect and configure a variety of
services. For example VPNs with different protocols for connecting
into the local home network is easy to configure using the Mikrotik
documentation.
Queues are a nice
configuration feature to control and manage bandwidth given to
devices in the local network. There is also quite advanced
scripting that can
be used to do many interesting things. I do not recommend Mikrotik to an
average user, however, because Router OS has a professional interface with
too many options and details: you need to understand what you are doing.
Mikrotik is a Latvian company
that makes a lot of professional carrier-grade
equipment, all run the same OS.
The previous router provided by the NextGenTel was pure disaster. I in fact
used two
different
units of the same marque: Inteno.
![Intento shit router Intento shit router](images/router-ngt-inteno.jpg)
This shit router tended to hung up at least one or twice a week, leaving no
connection. The NextGenTel support was useless, with the routine advice to
reboot router. Rebooting helped indeed until the next hangup, maybe the
next day. It is not a solution to fix bad hardware. It is so weird that
they supply their users with this shit when the competition between
providers is so intense. Many people would not figure out that it is
the router that is so bad and will blame NextGenTel as a whole and
switch to another provider. Shame, NextGenTel.
But if you subscribe for the home telephone
line with NextGenTel, then you are out of luck because telephone is
served by the Inteno router which also includes a SIP
service via built in Asterisk server pre-configured
by the provioder. The only solution is then to torture NextGenTel with service
requests and replacing the router. (But, of course, a better alternative is
to set up your own asterisk-based SIP VoIP server with trunks from any of the
many available SIP providers; this will be much more flexible and
cost-effective solution).
Dec 31, 2023
Shit happens. Det er en triviell visdom. Ofte er det en direkte konsekvens
av en enkelt stupid ting. I mange tilfeller kan lite gjøres for å forhindre
det skal skje. Uansett, sannsynligheten antas veldig lav. Katastrofen er
uforutsigbar. Det er en ulykke, helt tilfeldig. Ikke sant?
![Den bærbare datamaskinens tastatur er dekket av kaffe (eller brus). Å shit... Den bærbare datamaskinens tastatur er dekket av kaffe (eller brus). Å shit...](images/spill-mac.jpg)
Det gjelder for en enkelt hendelse. Kanskje en enkelt hendelse
av dumhet eller klønete... Men hvis toskeskap gjentas (f.eks. hvis det er en
vane) er situasjonen en helt forskjellige. Sannsynligheten av shit som
skal skje er nå
![P(1|n)=1-(1-p)^n P(1|n)=1-(1-p)^n](images/eq-shit-01.svg)
her er P(1|n) sannsynligheten for at shit skjer minst én gang i en gruppe
av n hendelser; hver hendelse har sjansen p (veldig lav!) til å skje, og n
er antall hendelser.
For eksempel, hvis sjansen for en singel ulykke er så lavt som 0.01 og
antallet dumme handlinger er 365 (bare en gang om dagen i løpet av et år),
blir sjansen for at shit skjer i løpet av denne tiden
![1-(1-0.01)^365=0.97 1-(1-0.01)^365=0.97](images/eq-shit-02.svg)
Det er nesten sikkert at shit skjer minst én gang i løpet av et år.
-
Drikker du kaffe/brus/smoothie/vin på den bærbare datamaskinen til vanlig?
Forberede for å erstatte tastaturet. Det vil skje.
-
Vant til å sende sms mens du kjører? Har du en god forsikring?
-
Løper ofte over veien foran lastebil/buss/bil? Det er på tide å bestille
krykker (eller enda kiste) på forhånd.
Nov 05, 2023
Både voksne og barn blir stadig mer avhengige av smarttelefonene sine. Et
morsomt begrep for slike rusavhengige er smarttelefonzombie. Men dette er
ikke morsomt. Faktisk, smarttelefoner dreper. For eksempel har det
vært en økning i antall dødsfall hos barn fordi barna sitter klistret
til telefonene sine
Stadig flere barn nå eier smarttelefoner. Nesten alle ungdommer
eier en smarttelefon i Norge, Storbritannia, USA og mange andre
land. Smarttelefonavhengighet er en verdensomspennende plage (Olson et al.,
2022).
![Smartphone zombie sign Smartphone zombie sign](images/smartphone-zombie.jpg)
Imidlertid, forskning viser at smarttelefonavhengighet fører til en rekke
alvorlige psykologiske, helse- og velværeproblemer, inkludert nevrologiske
lidelser (e.g. Ratan et al., 2022;
Achangwa et al., 2023). Mange
undersøkelser viser at bruk av smarttelefoner påvirker
studentenes akademiske prestasjoner negativt (e.g. Amez &
Boert, 2020; Sapci
etal. 2021).
Smarttelefonen din er en dedikert spionenhet, men enda mer bekymringsfull
er det faktum at apper målrettet mot barn sporer, samler inn personlige
data og laster dem opp til ukjente tredjeparter (e.g.
Reyes et al., 2018).
Men det handler ikke bare om data og reklame. Smarttelefoner kan
direkte påvirke fysisk sikkerhet av barn. En russisk studie indikerte
at nesten 50% av barna får nye bekjentskaper i sosiale medier og 36%
av dem møter disse nye menneskene i virkeligheten etterpå (Kaspersky Lab,
2022).
Vi må løse en avveining mellom behovet for å kommunisere med barna våre,
men unngå avhengighet. Så hva er løsningen? Jeg tror det er en kombinasjon
av gammel stil (men ikke foreldet!) knapptelefon og et stort nettbrett.
Knappetelefoner er klassiske, men ikke udaterte!
![Cool buttonphone Cool buttonphone](images/buttonphone-ascii.svg)
Fordeler med knappetelefon, i tillegg til at det neppe forårsaker avhengighet,
inkludere
-
BATTERI fungerer lange eller veldig lange, ingen grunn til å tenke på
lading, det er liten risiko for å sitte igjen med en død, utladet telefon
i det mest uleilige øyeblikket. Batteriet dør ikke i kulden. Batteriet
er avtakbart og kan enkelt skiftes ut. Det er ingen risiko for at barnet
vil lade ut batteriet på grunn av intens spilling på telefonen. Det
vil ikke skje i verste øyeblikk, for eksempel når han eller hun trenger
hjelp fra foreldrene
-
SIKKERHET: det er ingen konstant tilkobling til Internett, viktige data,
passord, personlige dokumenter, kredittkortdata lagres ikke på telefonen:
det er ingen risiko for lekkasje eller hacking, selv om telefonen er mistet
eller stjålet. Plasseringen kan ikke spores og lekkes. Mange hackere og
sikkerhetseksperter bær ikke smarttelefoner. Men knappetelefonen tjener
sin hovedfunksjon, kommunikasjon, helt perfekt.
-
PRIS telefonen er billig, ikke bry deg om det, den er lett å erstatte hvis
den er ødelagt, mistet eller druknet. Men dette er spesielt viktig siden du
alltid har telefonen med deg. Barn er ofte uforsiktige og kan bryte ned ting.
-
FYSISK STYRKE: En liten skjerm, sterk telefon, går ikke i stykker med
det minste fall, mindre utsatt for vann. Jeg har erfaring med at en telefon
ble vasket i vaskemaskin og fortsatte å virke etterpå.
-
FYSISK KNAPPER er fortsatt et av de beste
brukergrensesnittene,
praktisk å bruke. Du kan konfigurere ett-tasts hurtigvalg. Knapper er
også lettere å bruke med hansker i kaldt vær.
-
STØRRELSE en liten telefon passer lett i lommen. Det er bare praktisk.
-
IKKE FORELDET en trykkknapptelefon kan betraktes som en "fysisk
app" som ikke blir foreldet og rett og slett alltid fungerer uten
å kreve konstante "oppdateringer."
Knappetelefon blir ofte sett på som noe enkelt og kjedelig, selv om det ikke
er helt utdatert. Men det finnes noen få moderne, elegante, designertelefoner,
for eksempel Punkt (overpriset!).
Nettbrett gir mye bedre brukeropplevelse
Men vi kan ikke frata barna våre internett, spillkommunikasjon med venner
og alt annet som en smarttelefon gir! Riktig nok, men det finnes et bedre
enhet enn smarttelefon: nettbrett
![Tablet for a young Tablet for the young](images/tablet-ynge.png)
-
STOR SKJERM: nettbrettet har en stor skjerm som gir mye bedre
brukeropplevelse for alle bruksområder: Internett, video, spill, tegning,
skriving og til og med lydsamtaler. En stor skjerm kan bare ikke sammenlignes
med den lille skjermstubb på typisk smarttelefon. Det er mye bedre for
alle slags kreative aktiviteter.
-
LAVERE ER BEDRE: Det er ikke så lett å ta en tablett med deg hele
tiden. Med andre ord er tilgjengeligheten lavere og det er noen små
kostnader forbundet med bruken. Faktisk må du gå til laderen eller et
bord, ta nettbrettet og først deretter bruke det. Det er ganske stor
forskjell fra smarttelefonen som ofte alltid ligger i lommen. Dette gjør
det mindre sannsynlig at du blir avhengig av et nettbrett.
-
STOR OG MERKBAR: Bruk av nettbrett er lettere å legge merke til. Dette
gjør det også lettere for foreldrene å overvåke og kontrollere barnas
nettbrettbruk.
Konklusjon
Konklusjonen er denne: i stedet for en smarttelefon, er det tilrådelig
å gi en grunnleggende knappetelefon til barnet ditt å bære med seg. Men
de bør også eie et nettbrett hjemme for å bruke til internett, videoer,
spill, studier og alt smarttelefonen som normalt brukes til.
Anbefalt lesing
- Gabrielsen, Bjørn (2020) Skjermslaver: hva skjermene har gjort med oss,
og hva vi kan gjøre med dem. Kagge (ISBN: 9788248925231).
Oppdatering: lenker
Oct 10, 2023
Messaging continues to be of rise. The new generation is more willing to
send texts than to call. Communicating with an instant messenger has an
unique advantage over the old good email: you can easily send replies
over replies quickly, resulting in a dialogue. But there is a serious problem:
many of the instant messengers are commercial products that work such that
their "users" are in fact the exploitable resource having no control or
choice.
Most corporations are fair providers of various products and services we
can buy. But not these "Big Tech" that offer "free applications," including
instant messengers. There is, obviously, nothing free on the Earth. Then,
if you do not pay, then you are the product not the customer. The Big
Tech corporations exploit the "end-users" to suck out private data,
often for further resale. Nearly all of these messengers have centralised
architecture and the user's account is linked to the telephone number,
completely destroying privacy. The link to the telephone number is also
very inconvenient because you cannot get several accounts easily, this
requires obtaining several mobile subscriptions. It's just illogical,
expensive and silly. Centralized architecture dictates that the
communication is kept on the corporate servers
so theoretically many employees can read
messages by abuse.
Some of the products are advertised as end-to-end encrypted. But nearly
all of them are closed source so there is no way to check how this is
implemented and if and when the service owner can have access to private
messages content. Moreover, we have evidence for the opposite. Many
so called "end-to-end encrypted" messages are actually read by AI and human
contractors.
Even if communication is technically end-to-end encrypted, the company owns
and fully controls the server, the client application and network traffic, so
a man-in-the-middle attack by silently changing certificates is possible
(e.g. in the context of lawful intercept, or unlawful abuse). Metadata
(technical information information about all aspects of communication,
including the addressees, their locations, IP addresses, telephone number
etc.) is always accessible to the service. But metadata is often even
more informative than the message content. How such metadata is used is
typically unclear. The user has no authority here at all.
Nearly all of these messengering systems have closed proprietary protocol. This
means that how you use the product is completely controlled by the owner
company. The only way to use the product is with the official application.
You cannot just choose for yourself which application program to use. This
is cardinally different from the email, for example, where you can use the
provider's web interface, its mobile app or any of the many available email
applications such as Thunderbird or
K-9 Mail. With such a third-party application you
can easily consolidate several email accounts in one place and easily make
use of the functionality the provider does not offer, such as end-to-end
encryption. Another
major problem is monopoly and lack of interoperability. The "users" (in
reality, the exploited resource) are completely restricted to the owner's
platform and are unable to communicate with the other (especially competing)
platforms (e.g. Facebook to Snapchat) as a way to keep users within the silo.
This is as if you were unable to call/send sms across different mobile
operators. And this is silly. To break down monopoly, ensure fairer
competition and interoperability across the services, the EU has developed
the Digital Markets Act (DMA) regulation.
This is a big step, but it does not solve many of the problems with
centralization, privacy and regular security flaws.
Take back your freedom, privacy and security
So, why use the restricted, inconvenient, monopolistic, insecure and non-private platforms for
the trivial task of sending instant messages? There are several ways
to configure one's own privately controlled instant messaging system:
XMPP and Matrix. XMPP is
lightweight and more private, yet covers all the typical instant communication
purposes: text, file share and voice. Moreover, XMPP servers are by default
federated:
it is easy to send messages across the different servers like in the
email. There are many different applications for all operating systems and
platforms the user can choose.
It is very easy to set up one's own XMPP server for a small group,
company,
the family or just an individual. You will need
two things:
-
Server that will be the central hub for the communication network running
24x7. This can be anything, from a Rasberry PI in a cupboard to a Virtual
Private Server
(VPS) somewhere in a data centre or just an old PC running in your
basement. A small scale VPS useful for an XMPP server can be very cheap,
up to a three Euro per month. There exist even cheaper options, such as
EUR 6 per year. There are also dedicated search engines
to help locate cheap VPS, e.g. LowendBox
and ServerHunter.
A typical operating system running on the server is Linux (very secure,
highly configurable, free and open source).
-
Domain name that needs to be used to connect to the XMPP server. Domain
can be registered to the user (e.g. myname.no
), which costs about
30 Euro yearly. But a sub-domain can be obtained for free using the
https://freedns.afraid.org or similar
"free DNS" services. In the later case you might have something like
myownchat.mooo.com
or myownchat.ptchat.net
. It is possible to run the
XMPP server purely on IP address even without domain name, but it is much
less convenient (e.g. then federation with other servers is lost).
Given you have got a server (VPS or dedicated machine) and the domain,
configuring an XMPP server can be done on 1-2-3. There exist several Linux
variants (distributives) with different management commands (usually for
installing software). I assume Debian Linux
is used below (the same commands also work for Ubuntu and other Debian-based
Linux systems).
1. Install XMPP server software
Login. When you have got a server of any kind, you need tologin
to it, typically with ssh
:
here the user name on the server is debian
and the server ip
is 1.2.3.4
. Typically, you may need to create the ssh key and
upload it to the server to authenticate (refer the server documentation, e.g.
this).
I assume logging-in is not a problem.
Prepare server. First of all, update the software on the new server
sudo apt update -y && sudo apt-get upgrade -y
Install some useful monitoring and security-enhancing utilities
sudo apt install -y mc htop atop nload nmon tree zip pwgen fail2ban dnsutils iptables-persistent locate unattended-upgrades
Install certbot, a system that manages the
TLS certificates
for secure connection
sudo apt -y install certbot
Install the ejabberd server, which is is very
reliable and light on resources
sudo apt install ejabberd
Firewall. To allow incoming network access to this server by the XMPP
clients and also third-party servers, the server needs to configure
the firewall rules. This can be done differently in different
installations. For example, some VPS may do this using a friendly web
interface. The standard Linux firewall is done via iptables
.
The XMPP system requires incoming acces via ports 5222, 5223, 5269, 5443,
5280, 3478. To determine the ports refer to the listen section of the XMPP
configuration file below.
sudo iptables -A INPUT -p tcp --dport 5222 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5223 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5269 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5280 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# STUN is over udp
sudo iptables -A INPUT -p udp --dport 3478 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
The port 7777 is used for a proxy for peer-to-peer (bytestream) file
transfer. If peer-to-peer file sharing is intended for use, an additional
rule should be set allowing incoming connections:
sudo iptables -A INPUT -p tcp --dport 7777 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
To see what firewall rules are in effect issue this:
iptables -L --line-numbers
It makes sense to save the iptables rules so they are automatically get in
effect after reboot
iptables-save > /etc/iptables/rules.v4
2. Configure your XMPP server
Secure connection certificate. Get a free
Let's Encrypt
TLS certificate.
I assume you have got a free domain myownchat.ptchat.net
from
https://freedns.afraid.org.
Note that ejabberd can manage (issue and update) TLS certificates on its
own, but this needs some configuration as described in the
acme
configuration option:
https://docs.ejabberd.im/admin/configuration/basic/#acme.
An advantage of the standalone certificate management system (as here) is
that it is slightly less tricky and can easily be used with a
web server on the same machine.
Why not also configure a web server for a small static web site here?
Ejabberd is very lightweight and will happily coexist with many other
servers running on the same machine.
sudo certbot --standalone certonly -d myownchat.ptchat.net
This command will ask a few questions and issue a TLS certificate. This process
is done over http so http port 80 must allow incoming connections. If this is
not so, use the following command:
sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
Do not forget to save iptables rules with the iptables-save
as above.
The certificate files are located in
/etc/letsencrypt/live/myownchat.ptchat.net/fullchain.pem
directory.
For the sake of security, the certificate directories have by default no
access to anyone except the admin (root) user. But this precludes the XMPP
server ejabberd to access the certificate. This can be easily fixed with the
following commands
First, add ejabberd to the root group
sudo adduser ejabberd root
Second, allow access to the certificate directories to the group
sudo chmod g+rx /etc/letsencrypt/live/myownchat.ptchat.net
sudo chmod g+rx /etc/letsencrypt/live
sudo chmod g+rx /etc/letsencrypt/
Configure ejabberd. Once the preparations are done, it is time to
configure the ejabberd messaging server. Edit the configuration file
(assuming the mcedit text editor is used)
sudo mcedit /etc/ejabberd/ejabberd.yml
This is a long configuration file that may look scary. But in fact only a few
changes are required to make the server running with the default options. But
note that the indents are important, try to keep them as in the original file.
Any line starting with #
is considered a comment, this can be easily used
to disable specific options by "commenting them out."
First, set up the host name that is used for the server, it is the same as
the domain:
hosts:
- myownchat.ptchat.net
Second, configure the location of the TLS certificates that are used by the
server:
certfiles:
- "/etc/letsencrypt/live/myownchat.ptchat.net/fullchain.pem"
- "/etc/letsencrypt/live/myownchat.ptchat.net/privkey.pem"
Configure the admin users who can manage the XMPP server:
acl:
admin:
user:
- ""
- "myname": "myownchat.ptchat.net"
Then, add configuration for http-file-upload module that will allow file
sharing (sending files):
mod_http_upload:
put_url: https://@HOST@:5443/upload
custom_headers:
"Access-Control-Allow-Origin": "https://@HOST@"
"Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
"Access-Control-Allow-Headers": "Content-Type"
It is convenient to keep the latest messages on the server, it is done with
the "mam" module:
mod_mam:
assume_mam_usage: true
default: always
Ejabberd supports several other communication protocols in addition to
XMPP. For example, it also works with MQTT that is
typically used for IoT devices. If this functionality is not used,
just comment out the MQTT module to disable it.
The STUN and TURN protocol is mainly used for voice calls and needs the
actual IP address of the server (replace with your server IP addfress)
-
port: 3478
ip: "::"
transport: udp
module: ejabberd_stun
use_turn: true
## The server's public IPv4 address:
turn_ipv4_address: "1.2.3.4"
An important issue is wether to allow anonymous registrations of new users.
I strongly recommend not allowing this for security reasons. For a small
private server, you will normally add users manually and set them initial
passwords. Every user can then change password within the client program. So,
you need to disable the mod_register
by commenting it out:
# mod_register:
# ## Only accept registration requests from the "trusted"
# ## network (see access_rules section above).
# ## Think twice before enabling registration from any
# ## address. See the Jabber SPAM Manifesto for details:
# ## https://github.com/ge0rg/jabber-spam-fighting-manifesto
# ip_access: trusted_network
Start server! And that's all minimal configuration. Now it's time to
start the server:
sudo systemctl start ejabberd
If there are any errors and the server fails to start, Linux logs can be
inspected with this command:
or logs for only ejabberd:
sudo journalctl -xe --unit ejabberd
Additional stuff. The above is enough to make the XMPP server running for
text. If voice is required, you need to configure the DNS as described here:
https://www.process-one.net/blog/how-to-set-up-ejabberd-video-voice-calling/.
DNS is normally configured using the control panel of the domain registrar.
The TLS certificate that is managed by certbot
is updated each 90 days. This is an automatic process, but the ejabberd
server must know when certificate is changed. This can be done using the
deploy hook. Just create the hook file reloadxmpp.sh
(the file name can be
anything):
sudo mcedit /etc/letsencrypt/renewal-hooks/deploy/reloadxmpp.sh
and add the following commands:
#!/bin/sh
ejabberdctl reload_config
This file must be executable, so issue this command:
sudo chmod ugo+x /etc/letsencrypt/renewal-hooks/deploy/reloadxmpp.sh
The last note on the server is that it should be regularly updated for
bug fixes and security updates. This is done automatically by installing
unattended-upgrades
above. Yet, it is a good practice to log in regularly
over the ssh, check logs and update the system:
sudo apt update -y && sudo apt-get upgrade -y
3. Configure the XMPP users and client application
Register new users. First, you need to register the XMPP users. The
quickest method is to use the command line on the server, the command
ejabberdctl
has advanced functions.
A secure random password can be generated withy pwgen
, e.g. the following
generates passwords with 18 symbols:
It normally generates an array of possible passwords to choose from.
Now, to register the user myname
, It is the admin user configured in the main
configuration file /etc/ejabberd/ejabberd.yml
above.
# user domain password
sudo ejabberdctl register myname myownchat.ptchat.net pee8chogh9Heel6hei
Other users can be configured similarly. Note that the full user name for XMPP
has the same format se email: myname@myownchat.ptchat.net
. This is due to
the federated nature of both systems: you need to know both the user and
the server with whom to communicate.
For this example let's register two additional users:
sudo ejabberdctl register john.dow myownchat.ptchat.net ohyeeLeefo9yief4gu
sudo ejabberdctl register anna.karenina myownchat.ptchat.net hejo7phiy2iFeW9She
Use! The final step is configure the client program on the
user's device. The biggest difficulty at this step is the plenty
of choice. For any major platform, one can choose any of the many
available XMPP client programs. Some email
programs, e.g. Thunderbird also support
XMPP (although only a limited subset of features). Check out the
https://xmpp.org. The configuration for the client
is simple:
-
Server: your server, in the example above it is myownchat.ptchat.net
-
User name: your user name. In the example we used above, it can be
myname
Note that the option to create new account must NOT be enabled as
long as the account has already been created on the sever and the in-band
registration (mod_register
, see above) is disabled for
security.
![Conversations configuration Conversations configuration](images/xmpp-123-convers.png)
Some programs accept the full user name without specifying user and domain
separately. Then the user is just myname@myownchat.ptchat.net
. If you
plan to use the peer-to-peer (bytestream) file transfer (but
this is not mandatory), you should also find where the file transfer proxy is
configured and set it with the proxy
subdomain, for our example it should be
proxy.myownchat.ptchat.net
. And that is all for basic client configuration.
I recommend the Blabber XMPP application for
devices running Android. Yaxim is the best option for
minimalists, it is notoriously miniature (only a few megabytes) and works great
even on the oldest and weakest devices. Miranda NG
is a powerful XMPP client program for Windows. There are also a few
web-based clients: https://conversejs.org/ and
https://web.xabber.com/ that you can try right
away without installing anything.
The final step is to fill the contact list (called roster) with the addresses
of the people (or maybe devices, because XMPP can be easily configured for
bots accepting commands). Just remember that the address is full name as in
email: user@server.domain
. One useful option is so called Shared roster
groups: then you can configure
a group of contacts without the need to add them manually.
Happy chatting!
Further
There are many advanced options and possibilities in ejabberd. Just check
the documentation at the official web site: https://www.ejabberd.im/
and documentation https://docs.ejabberd.im/.
There are also a few useful tutorials, e.g.
https://www.process-one.net/blog/how-to-move-the-office-to-real-time-im-on-ejabberd/
Feb 06, 2023
Forskjellige meldingssystemer ble populær de siste tiårene. Den
meste kjente eksempler er Whatsapp, Facebook Messenger, Snapchat eller
Discord. Mange bruker dem uten å tenke bare fordi de ser praktiske ut og er
gratis. Kostnadene er imidlertid alvorlig: den er personvernkatastrofe.
Brukere har ingen egenkontroll, så eieren kan endre alle funksjoner uten
at brukerne vilje. Disse tjenstene (platformene) er laget og fullstendig
kontrollert av store monopoler fokuserte på å suge alle slags av
brukerdata. Personvernkostnaden til store kommersielle direktmeldingssystemer
av er mye høyere enn brukervennligheten. De er bevisst laget for å være
gjensidig uforenlige. En bruker av Whatsapp kan ikke sende en melding til
noen på Telegram eller Facebook. Bare se for deg at du hadde Telenor men kunne
ikke sende sms til noen på Telia, kun til sin eget system Telenor. Eller
se hvis du kunne ikke sende en epost fra Gmail til Yahoo. Det er helt dumt.
Nå, blant de populære systemene er det bare epost det eneste systemet på
internett som har ikke vært monopolisert. Og det er fortsett fordi epost
ikke er en plattform (eller 'ecosystem'), men åpen og federert protokoll
etter eget design. Alle kan konfigurere og kjøre egen mailserver og meldinger
skal sendes mellom evt. Alle kan velge mellom mange epost apper. Alle kan
legge til ytterligere funksjonalitet, slik at ende-til-ende kryptering, men
interoperabilitet opprettholdes.
Protokoll betyr et sett med regler og konvensjoner for interoperabilitet,
ikke et enkelt komplett produkt.
![XMPP logo xmpp logo](images/xmpp-logo.svg)
Men, det finnes en direktemeldingssystem som er like enkel å bruke
som Whatsapp, men mangler de fleste av problemene. Faktisk, er det
XMPP. Det er en åpen og federert protokoller
som epost. Alle kan ha egen server, så kan ha kontakt med noen på alle
serverer som helst, akkurat som epost eller mobil. I tillegg, kan alle også
velge mellom ulike app etter vilje: foretrekker du funksjonalitet,
eller skjønnhet eller bare det å være veldig lett... Det finnes også
flere XMPP serverer programvare å velge mellom, de fleste er gratis og
åpen kildekode. Med XMPP kan du få alt: direktemeldinger, filer, tale,
video, gruppechat, flere enheter. Det er også flere typer av
ende-til-ende kryptering
(OMEMO, GPG,
OTR) og mye mer. Det finnes enda en XMPP-basert
sosialnettverk: Movim.
XMPP er ikke alene. Det finnes også en alternativ åpen og
federert protokoll: Matrix. Men
sammenlignet med XMPP, har den flere mangler: (a) problemer med
personvern
(selv om mange ikke bryr seg om det), (b) alvorlige ytelsesproblemer:
mens XMPP fungerer fint selv på den minste og billigste
VPS, Matrix
server krever mange gigabyter med RAM og stor diskplass, på denne grunn
er det dyrere i drift, også krever Matrix mye mer oppmerksomhet (f.eks. se
her). Det kan være berettiget
i bedrifts- eller stororganisasjonsbruk, men ikke i hjemmebruk.
Så XMPP er ideell for å lage et helt privat kommunikasjonssystem
for et familie. Du trenger bare dette: (a) en server: billigste
VPS eller enda
en Rasberry Pi boks vil fungere fint (f.eks ejabberd skal støtte
hundrevis brukere med dette nivå); (b) server programvare
som kjøres alt: sjekke ut flere og velge selv, de mest populære er
ejabberd og Prosody;
(c) domenenavn slik at brukere kan konnektere til: domenenavn er også
en del av brukernavn, som i epost, f. eks alexander@johansson.me
(enkelt DNS
oppsett
trenges for å støtte tale og video); (d) hver bruker kan velge hvilken
klientapp som skal brukes (f. eks
Monal eller Siskin IM på
iPhone). Og det er det.
Nå må serveren konfigureres. Så kontrollerer du systemet fullt
ut! Du kan registrere så mange brukere at du trenger, men for en
familieserver anbefaler jeg ikke å tillate åpen registrering av alle som
helst. For eksempel du kan registrere flere kontoer for en enkelt bruker
hvis nyttig (å bruke med forskjellige formål). Ingen mobilnummer kreves:
f.eks. trenger du ikke fem SIM-korter for fem brukere, faktisk ingen er
nødvendig. Det også anbefales å konfigurere ‘Shared roster group’
(delt brukerliste) for å unngå å legge til familiekontakter manuelt for
alle familiemedlemmer. Ende-til-ende kryptering er ikke avgjørende
for din egen private server fordi transportkryptering (TLS) brukes alltid;
men det er lettere å konfigurere hvis du bruker flere enheter (mobil,
nettbrett, desktop, laptop, web-basert). Men det er bedre og sikrere å
bruke ende-til-ende kryptering til å kommunisere med noen på andre
offentlige servere.
Og nå, når flere grupper har sine egne private servere, kan de
kommunisere fritt og sikkert. For eksempel, det er nå lett
for pappa@johansson.me
å sende melding (eller video-ringe) til
mattias@johansson.me
(samme familier og på samme privat server) eller
til en venn john@dowfamily.info
eller enda alle som bruker hundrevis av
åpne gratis offentlige serverer f. eks maria@jabber.no
(på Jabber Norge), christian@jabber.de
,
oyvindharaldsson@tigase.org
eller nikolaibode@riseup.net
.
![Federated network Federated network](images/federated.svg)
Se her for litt mer informasjon
om XMPP.
Lenker
Nov 01, 2022
Jeg hadde en intervju med studenter av St Paul
gymnas. Her er noen svar.
Hvordan å praktisere religionen?
Å praktisere religionen betyr at du leve med Gud i hjertet ditt. Først,
det er viktig å bare være god i livet og unngå noe som er dårlig. Unngå
synd og dårlige ting som er enda uten av synd. Men det er ikke nok å bare
ikke gjøre noe. Det er viktigste å gjøre god ting i livet for God hjelper
oss når vi gjøre det som er godt. Jeg tror det er den Guds ligning:
![](https://latex.codecogs.com/svg.image?\large&space;E&space;=&space;i&space;\times&space;&space;G)
her E er effekt som vi får, i er menneskers innsats og G er Gods nåde. Hvis
innsats er null, helt effekt er null selv når Gud er enig å hjelpe den
største (f.eks. G = 1,000,000). Tå eksempel av Jesus og følge Kristus i
hverdagen aktivt. Tenke om dette: I velkjente miraklet tok Kristus få brød
og fisk fra folk og multipliserte dem til flere tusen. Det var i stedet av å
skape brød ut av ingenting. Den hovedbetingelsen for miraklet var en gratis
gave og samarbeid fra få enkle mennesker. Vi vet ikke hvor mange mirakler
som ikke skjedde fordi noen bestemte seg å gjøre ingenting. Den G-leddet i
den formelen er det viktigst del. Så vi kan ikke gjøre mye uten av Kristus
nåde. Det betyr at vi trenger sakramenter og be å få den G-ledder. Vi
lever i verden og Gud er transcendent, Jesus er i himmelen, ikke her med
oss nå. Det betyr vi ikke får direkte opplevelse av Gud og kan ikke se,
spørre og kjenne hva er som Guds vill. Men vi har masse informasjon i
skriften og den hellige tradisjon. Kirken får det i kirkelige dokumenter,
Codex juris, og mange teologiske og filosofiske verk. Vi kan lære mye av
dette hellige vitenskap ved hjelp av vår egen sunn fornuft.
Kort fortalt: å praktisere religionen inkluderer dette: (1) å få Guds
nåde ved sakrament og be, (2) lære hva er som god og Guds vilje ved
hellige vitenskap og rasjonalitet, (3) vare aktivt å følge det som er god
i hverdagen.
Hvilke sakramenter påvirker ditt liv mest og hvordan?
Nattverd, Eukaristen, er den sakrament vi kan få og har oftest. Det er
også det sakramentet som forbinder oss med Gud fysisk. Det er den eneste
sakrament som tillater oss å se på Gud, streife på Gud og akseptere Gud
fysisk. Men det er også den vanskeligste sakrament vi har.
Det kan være vanskelig å forstå hvordan et lite stykke brød kan være
Kristi legeme. Men tenk om enkelt ting, f.eks. så enkle ting som en stol
vi seter på. Det kan vare laget av tre, eller jern eller plastikk eller
glass. Men hva vi se som materialet er helt uviktig. Hvordan vi behandler
og bruker stolen er helt uavhengig av materialet, men bare faktum at det er
an stol. Å forstå hva stolen er og av hvilken grunn det brukes og hva det
brukes, må vi resonnere ved hjelp av kognisjonen og abstraksjonen vår. Det
trenger litt høyere nivå av tenking enn bare se på det ytre utseende. Men
vi hittil ikke forvirrer en tre stol med vedtre. Nå tenke om en dyr som ikke
får slik abstraksjonsevnen. En fly eller maur som seter på en tre stol og
etterpå har en opplevelse av en plastikk stol skal tenke at denne er helt
forskjellige ting og har ingenting til felles. Men vi kan få det rart:
vi finner det helt åpenbart at denne to objekter tilhører til samme kategori.
Samme skjer med hvordan kan vi se på Eukaristen. Gud er transcendent og ikke
en del av denne verden. Så vi selv kunne ikke se på, eller på annen måte
oppleve Gud. Vi selv kan ikke ha denne kapasiteten. Men Kristus kommer til
oss i denne sakrament fysisk, bruker den vanligste ting som er en del av vår
verden, så vi kan vi kan kommunisere og enda forene med transcendent. Men
for dette, vi ikke har vårt eget konsept og må abstrahere å forstå.
Å vare et menneske betyr å forstå hva er den naturen av verden og tinger
vi lever med. Hvordan vi forstår det påvirker hvordan vi lever livet vart.
Hvis gud er allmektig, hvorfor tror du det er så mye ondt i verden?
Nøkkelen å forstå dette er frie vilje av mennesker.
Det var en metafor av Gud som skaper, i ekstrem form Gud som urmaker. Her
Gods allmakt og allvitenhet kunne se ut til å peke at verden som Gud skapte
er idealt som en maskin. Da er det Gud som er den eneste skuespilleren. Dette
synet blir spesielt populært da mennesker utviklet enkelt fysiske vitenskap,
Newtons fysikk som er basert på streng årsak og virkning. Tenke om dette:
årsaken A forårsaker B. Her A bare styrer en fiksert og helt bestemt effekt
B, men B ikke har noe rolle. Da Gud er tenkt som den første og hovedårsaken
av alle ting i verden. Konsekvens av dette er at Gud tar alt ansvar. Så bare
faktum at det ar noe galt i verden betyr det er Gud som har forårsaket dette.
Men God som bare skaper eller urmaker er en feil metafor. Dessuten, motsier
det det bibelske synet. I bibelen Gud er tenkt om som en far. Noen kan tror
det er et utdatert og primitivt syn, ikke vitenskapelig som vi nå trenger. Men
konsept av faren, den forelderen, tar den eneste essensen av Guds rolle.
En urmaker lager maskinen for et bestemt formål. Maskinen gjør kun det som
er urmakers formål, ingenting mer. Maskinen er ikke en uavhengig "agent"
med egen aktivitet. Det også finnes ikke en rolle av kjærlighet.
Forelderen er helt motsatt av det synet. Forelderen føder ut av kjærlighet,
ikke for en funksjon. Barnet er ikke en programmert robot, men en uavhengig
agent som bare lever sitt eget liv. Det betyr at barnet har egen frie vilje
som forelderen skal respektere og helt verdsette. Det også betyr at barnet har
lov til å feile og lære av sine feil. Dessuten, barnet har likt lov å ikke
lære av sine feil og enda å gå helt galt. Forelderen kan ikke gjøre har,
men gi råd og kanskje lide over barnets feil. Fordi barnet har frie vilje,
det kan ikke fikses, kun kureres.
På samme måte, Gud lar oss å leve vårt eget liv slik vi bestemmer
selv. Det betyr våre feil har lov til å være enorme. Men det at vi har
fri vilje skaper vår verdi som mennesker. En programmert robot med liten
selvstendighet og kreativitet er en helt kjedelig og dumt skapning.
En del av frie vilje er ikke en ting Gud har gatt oss mennesker. Hele
verden er skapt til å være uavhengig, ikke som en klokke eller noe andre
maskin. Verden er ikke skapt som en endelig ideell ting, men det kan utvikle
seg selvstendig. Det finnes eksempler i kvantefysikk: elementærpartikler
kan fungere uten noe streng årsakssammenheng. Men den beste eksempel
er Darwins evolusjon. Her levende former utvikler seg kreativt uten Guds
kontroll. Uavhengighet og fri vilje er Guds plan og gaven, men det er også
et tungt ansvar.
Apr 22, 2022
The old good email remains the most critical digital communication tool.
What makes the venerable email so useful and sustainable
over the long time is its openness and standardization. Email is radically
different from the modern "apps" which integrate all pieces of technology--the
server, the client, and the protocol--by a single monopolist provider. With
email, we are free to choose the server (provider) and client with any
combination. It provides enormous flexibility, added privacy and
security. Indeed, the provider does not control my client and cannot add
backdoors; there is no monoculture of client software with all the related
security risks (any security vulnerability is global). Email is one of
the few pieces of technology that is very resistant against internet
censorship. Repressive state can easily block a web site and even force
an app store to remove an app
(as the Navalny's "Smart Voting").
Also, an app store can delete it for any other bizarre reason. But it
is much more difficult to block a mailing list: it is easy to redeploy and
recreate it on a different server (without the users even noticing anything).
Furthermore, The user can easily create several different email-based
identities (e.g. a separate one for politically sensitive activity) which
adds anonymity. And anonymity means physical security in some countries.
It is not surprising that many internet services use the email address
to register users, authenticate, restore password and other similar
purposes. Open, standardized and decentralized email is one of the most
critical technology everything else depends on. After all, the flexibility
offered by the email technology--the freedom to choose all pieces (provider,
client etc.) is just very very handy, at least for an advanced user (you
can add new features on top of what the provider realized, even against the
provider's will--isn't it convenient?).
The whole email technology is build around open protocols rather than a
centralized platform. This facilitates competition, makes for better and
fairer service and reduce possible impacts of malicious monopolists
(Masnick, 2019).
Google's Gmail has long been one of the main pillars of email, millions used
to rely upon every day. We should praise Google for popularising email
as the basic mainstream technology among the masses. I started using Gmail
many years ago when it was in its "beta" and available only by invitation.
At that time Gmail openness and unrestricted nature was just blazing. The
web interface was lightweight and not really cluttered with ugly banners,
unlike other email providers. There were ads but they were small and
unobtrusive. Gmail had long supported all the basic protocols (POP, IMAP,
SMTP) that allowed to use any standard compliant client software, and that
was available for free (some other providers were more greedy and allowed
this only on paid plans). Google's POP, IMAP and SMTP implementations
have been (and still remain!) quite idiosyncratic, incomplete and not
really standard-compliant which caused various glitches (e.g. message
deletion and default sorting are weird, I always hated Gmail's labels). But
this was bearable.
The serious privacy problems and threats of Gmail,
such as user email scanning for context-specific advertising
(until 2017)
or
AI tool
which could provide access to some pieces of data to third-party
developers.
That is nearly a disaster that cannot be fixed because spying on the user's
data is at the heart of Google's business model. But who cares as long as
it is free! I have long been using and promoting PGP encryption which
could fix many of the privacy (and security) problems.
Yes, PGP is crucial for individuals and businesses
and yes, a motivated user can encrypt.
Gmail still remained free and relatively open while an alternative of
deploying private email server is time-consuming and tedious (e.g. ensuring
that emails from a tiny private server don't end up in spam folders of
intended recipients). I used to pay with some of my privacy to get the
usability and stability of Gmail.
But over time I became increasingly concerned about the clear trend taken
by Google to make the open email more and more difficult to use outside of
the Google monopolistic ecosystem. There are signs of the famous
embrace, extend, and extinguish
strategy. Gmail API is featureful and powerful... but only if
you really need the complexity and like to play with the Google rules. If
you don't like to see ads, for example, and for this use a standard IMAP
mail client of your choice, your must suffer. If you need full PGP support on
a mobile client, never offered by Google, you are out of luck and have to
use an IMAP-based mobile app like Android K-9 Mail
that requires sacrificing some usability.
Google tends to draw its users by all means into its browser, its
own apps and APIs to get more user's private data and show ads. For
that matter, Google's security usability has become just terrible. The
intrusive access-blocks when a mobile user with an IMAP client moves across
IP addresses can drive anyone crazy... Access can be blocked even if the
user switches just to the next IP address within the same provider's IP
pool.
![Google security alert Google security alert](images/google-security-block.png)
I have to use VPN with fixed IP address to avoid these stupid blocks!
To help keep your account secure, Google will no longer support the use
of third-party apps or devices which ask you to sign in to your Google
Account using only your username and password. Instead, you’ll need
to sign in using Sign in with Google.
The Google's insistence on rather complicated and heavyweight
OAuth2
mechanism
for basic email client access (remember, most email programs do not require
you to enter your password every time, diminishing the risk of phishing)
is understandable only as a means to limit all uncontrollable third-party
clients. Yes, OAuth2 is logical for complex workflows of data access delegation
across multiple web-based services with different login/password combinations
(the "Auth" stands for authorization, not
authentication).
Whenever I need access to my own emails I need to authenticate
my identity granting full access. But isn't OAuth2 client secret kept
on the device just as the username/password combination? Yet, limiting the
(power) users access to their own data provides just an illusion of
security at a large cost to usability and compatibility.
The Google's move to OAuth2 authorization seem to point that
the Gmail-hosted emails do not belong to me any more. My emails are now
owned by Google, who just "authorizes" (delegates) me access to some of
the data without trusting me. This is not what I need from my private
communication. Does Google pretend to "zero-trust" any third-party
apps? Maybe it doesn't trust its users (the owners of their data),
assuming they are all idiots?
If you think your users are idiots, only idiots will use it [your service]. ---
Linus Torvalds
And there is another side effect: as Google increasingly deployed more and
more heavyweight frameworks and technologies, Gmail became very sluggish
and bloated. It is cluttered and confusing, especially to those who don't
use it often enough to remember all the idiosyncrasies. And it's still poorly
adaptable to the user's needs. How can I get a fixed-width font for my plain
text message? Where is my favourite basic (and very fast) HTML web interface?
Enough is enough. I now go away from Gmail, and primarily not because of
big privacy concerns (which is quite expectable) but because of deteriorating
usability and growing incompatibility. It looks like the people at Google have
forgotten their old motto "Don't be evil." While I have been paying Google
with my privacy currency in the past to get functionality and usability,
the benefits of Gmail continuously went lower and now reached an unprofitable
level.
Migadu is my choice
There are many hosted email providers, some are focused on privacy and
security. For example, Protonmail is a fantastic
project that makes it nearly trivial to use PGP even for an uninitiated. But
its drawbacks are that it is non-standard and has too high publicity making
it quite undesirable in certain authoritarian countries. Simply said, if
you use Protonmail in some countries you may be suspected; Protonmail can
be blocked by the authorities, and worse still,
blocked in quite idiosyncratic way.
Some services may also reject registration
using this service.
What I have finally chosen is Migadu. It is not
yet another standard email hosting provider. It is a domain-based service. Once
you have got your own domain name (domains are now cheap), you can make your
own email service for your domain. That simple. This makes it super useful
for companies, families, groups and NGOs without large budgets. For a
reasonable price you get nearly your own mail server with many configurable
features (any custom mailboxes, aliases, forwarding, regexp, webmail,
etc.) but without the need to maintain all this complex system.
If you have a web site, you necessarily get a domain name for it. Now it's
easy to get your own email identity. True that some hosting providers also
do host email. But if you decide to switch to a different hosting it will
create a trouble: you need to move also email and this fact strongly limits
your next choice. Having a completely indpendent email system for your
existing domain avoids such hoster lock-in and makes life much easier.
By the way, the Migadu standard webmail interface
is sleek and very simple. Looks modern but lightweight and quite fast. No
bloat whatsoever, only the most crucial functionality. I am not big fan
of web-based email, but use it from time to time. And there is even some
very basic support for PGP! (But remember that web-based PGP is
not a very secure solution.)
I found the mail server configuration (including more esoteric stuff like
DNS setup and DKIM signatures) very easy. In my view you do not need an
IT degree to configure your email server with full functionality. I like the
admin panel, it is minimalist and easy to use, no stupid and distracting
visual effects. And Migadu is advertised as
fully open standard compliant service without proprietary glitches and
limitations. So any standard (open source or closed source) software is very
likely to be fully usable. This freedom is very important. And they are also
clear and honest about the
limitations and drawbacks.
Finally, goodbye Gmail.
PS: Disclaimer: I have no links with Migadu.
This post is also published on
Substack
and Medium
Nov 10, 2021
Cisco AnyConect is an unethical software. First, it is proprietary and
closed source code, although the nature of its functioning makes it capable
to control all the user's network traffic. Even worse, Cisco AnyConnect
implements controversial functionality making it technically a kind of malware:
the so called "posture" (HostScan) service is scanning the user's device and
(steals?) sends various information out (Cisco said this is done "to improve
security," e.g. to avoid non-certified and unauthorized devices), Cisco VPN
client can officially download and install spyware trojan on the user's device
(Cisco also advertises the trojan as a tool to "improve security"). Also,
the VPN client can reroute the network settings in arbitrary way without the
user's consent and knowledge. All this is a serious security and privacy
threat. (And Cisco products have a bad history of serious security flaws
that look like backdoors.)
It can be justified to run Cisco AnyConnect on a corporate-owned
machine (understanding the consequences for the user's privacy and
security). But installing it on the user's owned private
devices should be avoided.
Openconnect
Openconnect is an open source SSL VPN client that supports several protocols
including Cisco AnyConnect. It can be used as an alternative to proprietary
Cisco software that may in some installation include controversial and
undesirable functions such as uncontrollable network re-routing, proprietary
scanning module, installable spyware trojan etc.
For more information go to the Opeconnect web site: https://www.infradead.org/openconnect/.
Install openconnect from the standard Linux repository, e.g. in case of
Ubuntu/Debian use:
apt install openconnect network-manager-openconnect \
network-manager-openconnect-gnome
Server settings
To connect to the vpn, go to the network configuration entry, then add a
new VPN connection, choosing Cisco AnyConnect Compatible VPN (openconnect)
in the list.
To connect to the UiB VPN one needs this:
- Server gateway:
vpn3.uib.no
- UiB username (short name, in the following examples
zzz000
)
Basic connect using command line
The simplest command to connect to UiB network is:
sudo openconnect --user zzz000 vpn3.uib.no
Note that sudo
is required to set up the tun
device (It is, however,
possible to configure openconnect to run as unprivileged user, see
http://www.infradead.org/openconnect/nonroot.html).
There are also a few useful options:
--background
run openconnect at the background
--syslog
send messages to the system log
--pid-file /var/run/openconnect.pid
use specific pid file, then it is
easy to switch off the background vpn using this command:
kill $(cat /var/run/openconnect.pid)
assuming process pid is saved to
/var/run/openconnect.pid
These options result in this command:
sudo openconnect --background --syslog --pid-file /var/run/openconnect.pid \
--user zzz000 vpn3.uib.no
![command line example running on terminal](images/oconn-img1.png)
Connect using graphical user interface
Most Linux desktop environments (e.g. Gnome, xfce etc ) have graphical
utility that is accessible in the system tray. To configure it use:
- VPN protocol: Cisco AnyConnect
- Software token authentication: TOTP
![GUI example GUI step 1](images/oconn-img2.png)
Other options should be left intact.
At login, the GUI program will ask the University user name and password. Enter
and press Login
![GUI example GUI step 2](images/oconn-img3.png)
Then, Microsoft authentication code will be sent via SMS on the mobile phone.
![GUI example GUI step 3](images/oconn-img4.png)
There may be a caveat: DNS might not work with the default configuration
(web sites are inaccessible by their http names). If this is the case,
go to IPv4 settings and manually configure DNS servers, such as Google DNS
8.8.8.8
and 8.8.4.4
![GUI example GUI step 4](images/oconn-img5.png)
and then to IPv6 settings and enter DNS servers manually, e.g. Google DNS
2001:4860:4860::8888, 2001:4860:4860::8844
![GUI example GUI step 4](images/oconn-img6.png)
Now UiB VPN should work in a private way. Openconnect turns out to be a
useful tool to connect to the UiB network in a simple and straightforward way.
Microsoft Windows
Openconnect also works on Microsoft Windows. If you are
using Chocolatey
then there is a port that can installed
be using this command:
choco install openconnect-gui
Disclaimer: I did not try it.
References