Patrick’s development blog

Encrypt chat conversations in Pidgin using pidgin-otr

Posted in Articles, Security by Patrick on March 17, 2009

Pidgin is an excellent “chat client” or instant messaging client. I’ve even replaced the MSN client on my Windows system with Pidgin. It’s open source and has support for many different chat networks like MSN, ICQ…

There’s a plugin called pidgin-otr (Off-the-Record messaging) which allows you to encrypt your conversations (assuming the other part also has pidgin-otr installed). Regretfully, people never seems to care about encryption even if they seem to get close to crazy if someone invades their privacy, quite the paradox… Well that’s just another story which i’m not going to post here, as i’m just spreading the word about everything that’s good : )

The Off-the-Record messaging plugin uses public and private keys. It’s very easy to use. Just download the plugin, activate it in the Pidgin add-on menu and generate a key. In the conversation window, a button will appear that makes it easy to toggle encryption on/off.

Download Pidgin from: http://www.pidgin.im/download/
Download Pidgin-otr from: http://www.cypherpunks.ca/otr/index.php#downloads

Encrypting mail in Thunderbird using GnuPG and Enigmail

Posted in Articles, Security by Patrick on March 17, 2009

Thunderbird is a mail user agent developed by Mozilla. GnuPG is an encryption program (free software) that uses the standard OpenPGP. This standard is based on encryption using a private and public key. The private key is used to decrypt the data while the public key is used to encrypt the data.

The Thunderbird add-on Enigmail, provides an “back-end” interface to GnuPG so the user can use Thunderbird to encrypt/decrypt mail. After installing Enigmail, generate a keypair. This will create a public and private key for the current account. The public key is meant to be distributed so other people can send mail encrypted to you. The private key however, is important NOT to distribute. Since it is used to encrypt the messages sent to you with your public key. The public key is usually uploaded to a keyserver.

It’s possible to search for public keys on the keyservers and add public keys into a local list and configure Thunderbird to encrypt all messages by default (supposing the public key to the person in question is added into your key list). Both Thunderbird, GnuPG and Enigmail, are very useful indeed : )

For more information about GnuPG and Enigmail:
http://www.gnupg.org/
http://enigmail.mozdev.org/home/index.php

become anonymous on the internet using Tor

Posted in Articles, Security by Patrick on July 23, 2008

Tor is a platform independent program that protects you from traffic analysis. Traffic analysis is a form of surveillance of your network traffic which is a threat to your personal integrity. Tor is usually used to surf anonymously, but can also be used with for example instant-messaging applications.

How Tor works
When using Tor, your communication with the internet is protected by distributing it trough a network of different relays trough the world which are run by volunteers. The communication is also encrypted so no one can see what you’re doing or learn your location.

I recommend using the Firefox add-on Torbutton which provides an easy way to disable/enable Tor in Firefox. This way, you don’t have to configure your browser either.

Pitfalls with Tor
Watch out for cookies, flash files, java applets and similiar web applications. They can reveal your IP-address even if you use Tor. Using Add-ons for Mozilla Firefox like No Script and Flash Block can prevent this. Be sure that you don’t fall for things like this.

Even if Tor encrypts your traffic inside the Tor-network and makes you anonymous. The last relay you are connected to, which is directly communication with the webserver can still see your traffic. Don’t use Tor if you do things that can expose your identity, for example logging in to your webmail (if you truly want to be anonymous that is). Using an encrypted protocol like HTTPS prevents this though.

Read more about potential pitfalls here: http://www.torproject.org/download.html.en#Warning

To sum it up
If you want to surf anonymously, this is a very useful program as it also hides your IP-address. But remember that web apps like Flash can still expose your IP. A lot of people believes that installing Tor will automagically make them anonymous. That’s wrong however. You have to configure the application correctly you want to use with Tor. If you’re using Firefox, the Torbutton add-on makes this automatically.

A good idea might be to install a portable browser which you use only when you want to be anonymous. Configure this browser so it doesn’t accept cookies and install a flash blocker, block java and other “media” that could expose your IP-address. It’s recommended to only use services like webmail if the site uses SSL or another secure connection.

There is a portable version of Firefox called Firefoxportable.
Tor’s official website: http://www.torproject.org/

Useful free software to optimize and secure your system

Posted in Security by Patrick on June 28, 2008

Here’s a list of useful programs in different categories. Most of these programs are for Windows, but some of them are also open source and works for Linux. I only list programs that are free. I might update this post over time.

———————————————

Mozilla Firefox
The web-browser Firefox, has optional add-ons that you can install which makes it possible to extends the browsers functionality. I’ve picked out three add-ons that I find very useful. They speed up the browser and adds more security.

NoScript
It blocks all Javascript, Java and other malicious code from sites you don’t trust. Ever since I installed this, i’ve never had any spywares on my XP computer at all. A most have for people who wants a secure browser. My favorite add-on.

AdBlock Plus
Get rid of all those annoying banners and ads on websites.

Flash Block
Blocks all flash animations on all websites. If you want to play a certain flash animation though, just click on it, that’s what I like most about this add-on.

———————————————

Security
Zonealarm Firewall – A free version of the popular firewall Zonealarm. This software also has program control and port stealthing for example.

AVG Anti-Virus Free Edition – Free anti-virus program, that is easy to use, provides high level of detection capability and doesn’t use so much system resources.

Ad-Aware 2008 – Scan for spywares, data-mining, advertising, and tracking components in general.

Spybot Search & Destroy – Spyware cleaner that also has real time protection.

TrueCrypt – Open Source encryption software. Can encrypt partitions, make virtual drives and encrypt harddrives completely.

———————————————

Optimize and cleaning software
JkDefrag – Free disk defragmenter program. Optimizes your harddrive.

CCleaner – System optimization tool which cleans registry and removes temporary files. It’s very fast.