Privacy -information security

[Rstan]

I'm interested to use secondlife site, VPN communication  to safety communication with my foreign friends using this site.

How can I made my communication more anonimize, crypto-safe and others. Maybe I can use extra services for it? I live in a country where privacy isn't  safe from State department and I want to hide my privacy from it.

[nikita Jefferson]

I use this

https://www.anonymizer.com

It runs SL through an encrypted tunnel that goes from your computer to their server, your IP address is their server IP address so you cannot be traced.

I have used it on SL although i did nt get for SL, it works well unless you race a car

 

That link seems to say "page not found, perhaps you can manually put the url in,

or when you land on that "page not found" click where it says "click here" and it takes you to the correct page which is anonymizer

[Jenni Darkwatch]

It's worth noting that communication _within_ SL isn't encrypted and obviously neither is this forum. If you need true end-to-end encryption you'll need to use some chat or communication method that uses private key encryption mechanisms. The trick then is to get the key safely to your friend...

[Rstan]

I can't use extra services to use this end to end encryption mechanism here in SL communication, can you?

[Jenni Darkwatch]

In SL there's no true end-to-end encryption. Neither on the forums nor in SL. There _used_ to be clients with built-in chat encryption but I don't know if they're still around.

I guess what I'm saying is: If you need to privately, securely chat with your friends you will need to use something other than SL. There's fully-encrypted IRC clients for example. A VPN would probably still be convenient to hide _what_ you're doing, though the mere use of a VPN can be detected as well and may very well flag you with authorities.

[nikita Jefferson]

If you use the product i mentioned in the second post, everything you do on SL is encrypted and cannot be viewed by anyone,your IM s cannot be read chat cannot be read, everything you do on SL cannot be seen by anyone beacause everything is encrypted, your IP address cannot be seen, it all goes through the server of anonymizer

[nikita Jefferson]

Yes i agree if his internet provider would deem encrypted data going through their servers as suspicious then it would be a red flag

[Perrie Juran]

---

nikita Jefferson wrote:

If you use the product i mentioned in the second post, everything you do on SL is encrypted and cannot be viewed by anyone,your IM s cannot be read chat cannot be read, everything you do on SL cannot be seen by anyone beacause everything is encrypted, your IP address cannot be seen, it all goes through the server of

anonymizer

---

I am slightly confused here.  If everything is encrypted, how do the SL Servers know what to do with the Data?

A VPN does not as far as I understand depend upon encryption to work.

 

 

[Rstan]

that's very interesting quesition, but unfortunately I live in Russia, and my privacy here isn't as seem me enough. So, to avoid red flag for authourity, I would like to communicate just using SL for instance but inside using cryptography technologies, maybe stenography which looks like as a graphic objects here.

That's strange here I see using https protocol for this forum - but I don't see any sertificate for it and connection is not encrypted.

[Jenni Darkwatch]

A VPN can - but doesn't have to - encrypt the traffic going through it. If all you need/want to do is get out of Russia without people knowing what you do and where you go, a VPN is a good idea.

However: Unless the chat sent from your client to the SL server is encrypted, the message can _still_ be spied upon by anyone who happens to have the means to intercept the message _after_ it leaves the VPN.

To elaborate: Let's presume authorities knock on your door and find out through forensic analysis that your SL username is "Rstan". All they'd need to do is go to the forums and see what you posted.

Simply put, _encryption_ should happen on your PC and everything should _stay_ encrypted until your friends decrypt it on _their_ computer. Then, presuming that your PCs hard drive is fully encrypted and preferably your friends is too, you're safe from prying eyes.

Unfortunately the whole process can easily make you a suspect to your government simply by using encryption. It's possible to check whether images have embedded hidden messages, steganography isn't exactly safe by itself. On the network level it's possible to find "unusual" traffic patterns, and very easily find anyone who's using standard VPNs (be it IPsec, Tor or anything else). Even using a common port like 443 (HTTPS) doesn't help because the traffic pattern of for example SL use doesn't match normal HTTPS traffic.

There's graduations with discoverability insofar as any point-to-point VPN is easy to locate: It has two defined endpoints. One of them is you.

Specialty networks like TOR get around this by bouncing the traffic around a bit before sending it out, making it exponentially harder to find the true origin of any given traffic. In essence the government could not know if you were actually doing anything or if you were just a TOR node relaying data for others. For some governments this is enough to convict you, for most others it's not. You can't really effectively use SL through TOR though, it consumes too much bandwidth.

This kind of stuff is part of my day job. With expert knowledge it's possible to become very hard (but not impossible!) to track, but SL is very poorly suited to that because of it's relatively high traffic requirements. Likewise unsuitable are most public forums.

I could get into more detail but I think it'd just bore everyone to death.

TL;DR summary: Can you get in trouble just for using any kind of encryption? If yes, you need much better tools and need to seriously rethink your approach. If merely denying the government proof of what you're doing is enough to be safe, all you need to do is dissociate your RL identity with your online identity. That just requires care and some good anonymizing services. A VPN would be sufficient in this case.

[Perrie Juran]

---

Rstan wrote:

that's very interesting quesition, but unfortunately I live in Russia, and my privacy here isn't as seem me enough. So, to avoid red flag for authourity, I would like to communicate just using SL for instance but inside using cryptography technologies, maybe stenography which looks like as a graphic objects here.

---

If both you and the individual on the other end have the ability, you could Mod your viewers so your chats were encrypted, But that is way outside my ability.

 

---

Rstan wrote:

 

That's strange here I see using https protocol for this forum - but I don't see any sertificate for it and connection is not encrypted.

---

That is because the Forum is publically viewable.  But you need to log in to post.  That is what is secured.

 

 

[nikita Jefferson]

Thanks for the info, it was very interesting and .no not boring at all if you had gone into more detail.

Twas very educational

[mehllama]

I know this is like a four year old thread but it still looks open, so I'll share some thoughts and see if they post.

I found an interesting article a while back on the topic of stenography and other tools used in virtual environments like SL for the purpose of, among other things, allowing dissidents to communicate without as much fear or harassment or persecution by their governments (e.g., Iran, Communist China, Russia, Venezuela), or for espionage, terrorism or other nefarious activity. Like all tools, it can be used for good or evil. Anyway, the article (from the US Defense Technical Information Center) is a bit dated (2008) but covers some interesting issues. Page 13 discusses stenography specifically.  http://www.dtic.mil/dtic/tr/fulltext/u2/a488794.pdf

Programs like Adobe Fireworks (no longer available) used to the .png file format to layer images, which made it a popular stenography tool because many people would assume those images were flat. The thing with pngs uploaded to SL, however, is that they do actually get flattened, so hidden layers become cast in stone, as anyone who's uploaded a texture for a piece of clothing and then tried to share it with a friend to edit would find. 

[Callum Meriman]

15 hours ago, mehllama said:

I know this is like a four year old thread but it still looks open, so I'll share some thoughts and see if they post.

I found an interesting article a while back on the topic of stenography and other tools used in virtual environments like SL for the purpose of, among other things, allowing dissidents to communicate without as much fear or harassment or persecution by their governments (e.g., Iran, Communist China, Russia, Venezuela), or for espionage, terrorism or other nefarious activity. Like all tools, it can be used for good or evil. Anyway, the article (from the US Defense Technical Information Center) is a bit dated (2008) but covers some interesting issues. Page 13 discusses stenography specifically.  http://www.dtic.mil/dtic/tr/fulltext/u2/a488794.pdf

Programs like Adobe Fireworks (no longer available) used to the .png file format to layer images, which made it a popular stenography tool because many people would assume those images were flat. The thing with pngs uploaded to SL, however, is that they do actually get flattened, so hidden layers become cast in stone, as anyone who's uploaded a texture for a piece of clothing and then tried to share it with a friend to edit would find. 

This thread, and the information you necroed it for are very dated.

Steganography, not stenography, is now fairly trivial to statistically detect in an image, it's likely the least useful way to hide something.

These days there are far better methods of hiding one's communications.