{"id":45,"date":"2005-08-07T23:02:20","date_gmt":"2005-08-08T06:02:20","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2005\/08\/07\/quick-guide-to-encryption\/"},"modified":"2005-08-10T13:16:45","modified_gmt":"2005-08-10T20:16:45","slug":"quick-guide-to-encryption","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2005\/08\/07\/quick-guide-to-encryption\/","title":{"rendered":"quick guide to encryption"},"content":{"rendered":"<p>I should qualify my comments from my prior blog entry and say that I&#8217;m appalled at <em>Service Providers<\/em> (not users) that continue to offer insecure services to their clients.  Users, however, should be asking their Providers for secure services.  Most don&#8217;t know to ask this, and that&#8217;s why I think the responsibility falls on the Provider.<\/p>\n<p>Here&#8217;s my crash-course in simple anti-sniffing techniques.<\/p>\n<ul>\n<li><strong>Evaluate your network<\/strong>: if you&#8217;re on open Wireless, any one interested can see all communications to\/from your computer.  Be paranoid.  If you&#8217;re on a wired network, your communications can still be seen, but it tends to be much less likely.<\/li>\n<li><strong>Evaluate your services<\/strong>: do you care about your various services?  Do you have a different password for each service?  Details below&#8230;<\/li>\n<\/ul>\n<p>Evaluating your services requires creating a short list of all the things you send over the network from your computer.  For basic anti-sniffing, there are two types of &#8220;encryption&#8221; available for most services:<\/p>\n<ul>\n<li><strong>Authentication<\/strong>: logging into anything.  Checking email, logging into IM, logging into websites, etc.  Some services offer &#8220;encrypted&#8221; authentication.  Modern AIM clients, &#8220;APOP&#8221; POP clients, etc.  If your authentication is encrypted people can&#8217;t just sniff your account\/password off the wire.<\/li>\n<li><strong>Communication<\/strong>: all the traffic to any site\/service.  All services have a fully encrypted counterpart.  Almost everything uses SSL for encryption, and appends an &#8220;S&#8221; to the protocol name.  HTTP has HTTPS, POP has POPS, IMAP has IMAPS, SMTP has a TLS mode, Jabber has an SSL mode, good IRC networks have an SSL mode, etc.  These SSL-protected services encrypt ALL of your communciation, including the username\/password authentication.<\/li>\n<\/ul>\n<p>It&#8217;s best to have fully encrypted communications, but if you can&#8217;t, just getting some kind of obfuscated authentication mechanism is better than nothing.  Just ask yourself any time you type in a username\/password, &#8220;How is this being sent to the remote server?&#8221;<\/p>\n<p>So, here are some specifics to various common services:<\/p>\n<ul>\n<li><strong>Receiving email<\/strong>: POP and IMAP have SSL modes that run on different ports.  See if your email Provider offers these services and switch your client to using those instead.  If that&#8217;s not available, see if POP or IMAP support other authentication modes besides the clear-text &#8220;Plain&#8221; and &#8220;Password&#8221;.  For example CRAM-MD5, Challenge\/Response.<\/li>\n<li><strong>Sending email<\/strong>: SMTP has an SSL mode too.  This is either called &#8220;STARTTLS&#8221; or &#8220;SSL&#8221;.  A good Provider will offer SMTP on port 587 with STARTTLS.  Hopefully your Provider requires you to authenticate before sending email.  Instead of SSL, like POP\/IMAP above, they may offer CRAM-MD5, etc.<\/li>\n<li><strong>Web sites<\/strong>: only use &#8220;http<strong>s<\/strong>:\/\/&#8221; for logging into websites.  If there isn&#8217;t a little lock in the corner of your browser, don&#8217;t log in.  The browser folks have done a lot to help folks with this part.  Ecommerce has caused a huge push to avoid in-the-clear authentication on websites.  Unfortunately, some sites will still let you log in without SSL.  (Like flickr, it seems.)<\/li>\n<li><strong>IM<\/strong>: I&#8217;m not sure about ICQ, MSN, etc, but Jabber offers a full SSL mode.  The &#8220;old&#8221; style runs on a separate port (5223).  The &#8220;new&#8221; style gets &#8220;turned on&#8221; during the initial jabber session setup.  This would give you fully encrypted communications.  I know AIM has both a Challenge\/Response and MD5 mechanism for logging in, so at the very least, use those.<\/li>\n<\/ul>\n<p>If you&#8217;re not sure if your communication is being encrypted or not, it&#8217;s very easy to install a network sniffer.  <a href=\"http:\/\/www.ethereal.com\/\">Ethereal<\/a> is available for almost every platform around, via the libpcap libraries.  Just start it capturing before you use a service, use the service, and then go find the traffic in the capture log.  Ethereal will identify almost all services by name (&#8220;HTTP&#8221;, &#8220;POP&#8221;, &#8220;IRC&#8221;, &#8220;AIM&#8221;, etc.)  To see the traffic, click on the &#8220;Analyze > Follow TCP Stream&#8221;.  This will show you all the communication for a given connection.  (Click on &#8220;Clear&#8221; in the Filter bar to see all your traffic again.)<\/p>\n<p>If you want to browse the traffic more easily, you can type in other filter terms.  For example, to make sure your POP password isn&#8217;t being sent in the clear, enter &#8220;pop.request&#8221; in the Filter, and click &#8220;Apply&#8221;.  Pick a packet, and select the &#8220;Request&#8221; section in the Packet Tree.  If you see:<\/p>\n<blockquote><p>\nRequest: USER omfg\n<\/p><\/blockquote>\n<blockquote><p>\nRequest: PASS intheclear\n<\/p><\/blockquote>\n<p>Then your &#8220;omfg&#8221; account is showing it&#8217;s password to the rest of the network.  :)<\/p>\n<p>Another alternative to all this pain is to have a VPN connection to some other network that you trust.  This is the easiest to configure on the <em>client<\/em> side.  If that&#8217;s not available, you can also tunnel all your traffic through an SSH connection.  This is easiest to configure on the <em>server<\/em> side (no config).  Here is an example of tunneling your POP service through SSH:<\/p>\n<blockquote><p>\nssh -L 2110:pop.example.com:110 account@example.com\n<\/p><\/blockquote>\n<p>That&#8217;ll set up a local port 2110 that gets forwarded to &#8220;pop.example.com&#8221; port 110 (POP) after logging you in to some SSH account.  This means you have to configure your POP client to use &#8220;localhost&#8221; port 2110 instead of &#8220;pop.example.com&#8221; on the regular POP port.  And then you can only POP when your SSH connection is up.<\/p>\n<p style='text-align:left'>&copy; 2005, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>I should qualify my comments from my prior blog entry and say that I&#8217;m appalled at Service Providers (not users) that continue to offer insecure services to their clients. Users, however, should be asking their Providers for secure services. Most don&#8217;t know to ask this, and that&#8217;s why I think the responsibility falls on the [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,6],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/45"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=45"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/45\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=45"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=45"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=45"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}