[hemmerling] Data Privacy - Encryption, Passwords, Trust

Related pages:

• Cryptography.
• Legal Matters.
• Security.

• My first PGP certificate is of 1998-03-16, created with “PGPfreeware 5.0i” .

• On March 15, 2023, my email account was hacked and the hacker created 2 filter rules :
  1. Email priority is “normal” ⇒ Delete email immediately
  2. All new emails ⇒ Forward email to the hacker's E-Mail @ gmx.com.
• Although I noticed that I had to reset my password on 2023-02-15, but that a hacker had logged in with the e-mail account password that was otherwise rarely used elsewhere, if at all, in order to simply create new filter rules, I had missed it. A new password wouldn't have changed anything .
• It wasn't until 2024-02-20 that I noticed that I only had new emails in the GMX spam folder, but no normal new emails, and that a test sending of emails to my account didn't result in this that they were in the normal email folder .
• So I just changed the password and deleted the filter rules .
• I now noticed that I had also used the GMX password for (ex-eBay) Kleinanzeigen.de, and that Kleinanzeigen.de notified me of a change in the password by email on 2024-02-15. I was unable to reset my Kleinanzeigen.de password (?).

• Hasso-Plattner-Institut "Identity Leak Checker".

• The free service Anonymouse - “Nur die VIP-Version von Anonymouse unterstützt verschlüsselte Verbindungen!” .

• Invisible Internet Project (I2P) - “The Invisible Internet Project (I2P) is a fully encrypted private network layer. It protects your activity and location”.
  • Download I2P for Windows.
    • “The default I2P installer requires Java to be installed” .
    • “Easy Install Bundle For Windows (Beta). It is now possible to install all I2P components using a single package (No Java required)... This bundle can also be used to configure a Firefox Profile. It will not interfere with an existing I2P installation if one exists” .
• Tor - “A free software and an open network that helps you defend against a form of network surveillance”-
  • “Tor Browser Bundle” for WinXP, Vista, Win7, Win8.
  • “Tor Expert Bundle” for Win98SE, W2k, WinXP, Vista, Win7, Win8.
    • C:\Documents and Settings\Administrator\Application Data\Tor” or C:\Documents and Settings\xxxxxx\Application Data\Tor” ( with “xxxxxx” = username ) respectively is the configuration directory.
  • Tor Archive.
  • The discontinued CHIP Online "Torbutton 1.4.6.3", just for legacy Firefox browsers .
• Test video YouTube "Unfortunately, this SME music-content is not available in Germany because GEMA has not granted the respective music publishing rights".

• Aquamathe - Sample website with popup window “Die EU-Richtlinie 2009/136/EG (E-Privacy) regelt die Verwendung von Cookies. Durch die Nutzung dieser Website erklären Sie sich mit der Speicherung und dem Zugriff von Cookies auf Ihr Gerät einverstanden”.

• HTTPS Everywhere.
• Adblock.
  • EN.Wikipedia "AdBlock (Chrome)".
• Mozilla Firefox Addon "".
• Adblock Plus.
  • Mozilla Firefox Addon "Adblock Plus", Google Chrome Webstore "Adblock Plus".
  • Facebook "Adblock Plus".
  • Hypercritical research results by XING "Sascha Pallenberg", LinkedIn "Sascha Pallenberg", Google+ "Sascha Pallenberg".
    • Sascha Pallenberg, Mobile Geeks "Adblock Plus Undercover – Einblicke in ein mafioeses Werbenetzwerk", 2013-06-23.
    • Sascha Pallenberg, Mobile Geeks "Adblock Plus Reloaded – Fake Community, Intransparenz und Guerilla Marketing", 2013-07-01.
    • Sascha Pallenberg, Mobile Geeks "Adblock Plus Finale – Tacheles, Reaktionen, weitere Ergebnisse", 2013-07-08.
    • Blog article "Adblock Plus and (a little) more", Article "#pallengate: Warum Sascha Pallenberg bewusst lügt. 2013-07-01 08:36 by Till Faida".
  • EN.Wikipedia "Adblock Plus", DE.Wikipedia "Adblock Plus".
• The commercial AD Muncher.
• Mozilla Firefox Addon "Ghostery" (Firefox).
• Google Chrome Webstore "Ghostery" (Chrome).
• Mozilla Firefox Addon "Better Privacy" (Firefox).
• Google Chrome Webstore "Forget Me" (Chrome).
• Mozilla Firefox Addon "Cookie Monster" (Firefox).
• Mozilla Firefox Addon "NoScript" (Firefox).
• Google Chrome Webstore "NotScripts" (Chrome).

• LeineLab "LeineLab-CryptoParty 2".
• DE.Wikipedia "HTTP-Cookie".
• DE.Wikipedia "Do Not Track".

• Enigmail: A simple interface for OpenPGP email security, a plugin for the Mozilla Thunderbird E-Mail client.
  • Enigmail 1.4.2 ( Standard encryption = RSA 2048 Bit. Maxium encryption = RSA 4096 Bits ) is for Mozilla Thunderbird 12, the latest edition which runs on W2k.
  • Enigmail: Thunderbird “OpenPGP / Generate OpenPGP Key / Advanced” : Key size = 2048 Bits or 4096 Bits.
• The OpenSource GnuPG.org - The GNU Privacy Guard.
  • The OpenSource Gpg4Win for Windows ( Gpg4Win 2.1.0 → Standard encryption = RSA 2048 Bit. Maxium encryption = RSA 3072 Bits ).
• “PGP Freeware” and successors.
  • “PGP Freeware (was Pretty Good Privacy)” (PGP) by “PGP Corporation”.
    • The latest version of “PGP Freeware” is “PGP Freeware 8.1” ( PGP810-PF-W.zip ) for Win98, W2k and WinXP.
  • Symantec Corporation - Encryption Family. Powered by PGP Technology.
    • Symantec Desktop Email Encryption. End-to-End email encryption software for laptops and desktops.
      • The commercial trialware software “Symantec Encryption Desktop Corporate 10.3”.

1. pool.sks-keyservers.net → “pool.sks-keyservers.net”.
2. subkeys.pgp.net → “subkeys.pgp.net”.
3. sks.mit.edu → “sks.mit.edu”.
4. certserver.pgp.com → ldap://certserver.pgp.com, certserver.pgp.com.

• Crypto für alle – kostenlose OpenPGP-Schulungen.

• EN.Wikipedia "Personal identification number", DE.Wikipedia "Persönliche Identifikationsnummer" ( PIN ).
• EN.Wikipedia "Personal unblocking code", DE.Wikipedia "Personal Unblocking Key" - “Cellular phone users are therefore advised by most providers to keep their PUC written down in a safe place separate from the device. The PUC (PUK) is a SIM-specific code assigned and provided by the service provider”.

• The OpenSource SourceForge "Ophcrack", SourceForge "Ophcrack". The software is booted from a CD/DVD.
  • I run it successfully on a WinXP PC with Pentium-1, 256 MB RAM, IDE harddisk, IDE CD-ROM, by selecting the configuration “Ophcrack Graphics Mode - low RAM” .
  • *Operation failed on a WinXP PC with Pentium-1, 128 MB RAM, by the error message: “Unpacking initramfs. . . <0> Kernel panic - no syncing: Out of memory and no killable processes”
• The OpenSource PC Login Now. The software is booted from a CD/DVD.
  • Operation failed on a WinXP PC with Pentium-1, 256 MB RAM, by the error message: “Kernel panic - no syncing: Attempted to kill init!”
• The commercial Kon-Boot & the outdated free Kon-Boot V2.0. Operation failed on a german WinXP PC with Pentium-1, 256 MB RAM, IDE harddisk, IDE CD-ROM, by the german WinXP error message:

Windows NT hat nicht genügend Erweiterungsspeicher gefunden. Zur Ausführung von Windows NT werden 7 MB Erweiterungsspeicher benötigt. Sie müssen evtl. Ihren Computer aufrüsten oder ein Konfigurationsprogramm des Herstellers ausführen.
Speichertabelle
00000000 - 0008E00

• The OpenSource Offline NT Password & Registry Editor. The software is booted from a CD/DVD or a floppy disk. Operation failed on a WinXP PC with Pentium-1, 256 MB RAM, IDE harddisk, IDE CD-ROM by the error message: “Boot failed: please change disks and press a key to continue”.

• I was told by experts in 2023-11 & 2024-09, that the “Passkey” technology is implemented in Windows11.
• FIDO Alliance.
  • FIDO Alliance "What is FIDO?" - “FIDO Authentication is the answer to the global password problem”.
• EN.Wikipedia "FIDO Alliance", DE.Wikipedia "FIDO2".
• EN.Wikipedia "Passkey (authentication)".
• EN.Wikipedia "WebAuthn", DE.Wikipedia "WebAuthn".

• SourceForge "OpenSSH for Windows", SourceForge "OpenSSH for Windows" - “Before starting the OpenSSH service you MUST edit the C:\Program Files (x86)\OpenSSH\etc\passwd file. If you don't do this, you will not be able to log in through the SSH server. Please read the readme.txt or quickstart.txt file for information regarding proper setup of the passwd file”.

• Aspera "Manipulating ssh keys files in Linux and Windows Environments".
• GitHub Help "Working with SSH key passphrases".
• Google - Search for "delete password phrase".
• LAMPish tidbits "Remove Passphrase from SSH Key" - “openssl rsa -in private_key_with_pass_phrase -out private_key_without_pass_phrase”.
• nixCraft. Linux and Unix tutorials for new and seasoned sysadmin "OpenSSH Change a Passphrase With ssh-keygen command".
• Thinkplexx "Remove passphrase (password) from private RSA key".
• StackExchange "How to avoid being asked passphrase each time I push to Bitbucket".
• StackOverflow "How do I remove the passphrase for the SSH key without having to create a new key?".

• EN.Wikipedia "Secure Shell", DE.Wikipedia "Secure Shell" ( SSH ).

• CAcert - “FREE digital certificates for everyone”.
  • CAcert Wiki.
  • CAcert "CACert Root Certifcates".
• certifi.ca - “The secure OpenID identity provider”.
  • certifi.ca "Get a certificate" - “Special companies called certificate authorities or CAs give out SSL certificates for browsers, either for free or for a small fee”.
• StartCom Free SSL Certification Authority.

• DigiCert Inc.
  • EN.Wikipedia "DigiCert", DE.Wikipedia "DigiCert".
  • Experts told me, that the “Windows Security Certificates” for Windows Server are accepted by Microsoft .

• Barracuda Central.
  • Barracuda Central "ip=212.227.17.21".
    • Sorry, your email was blocked. We are sorry you have reached this page because an email was blocked based on its originating IP address having a “poor” reputation. The “poor” reputation may have been caused by one of the following reasons:
      • Your email server contains a virus and has been sending out spam.
      • Your email server may be misconfigured.
      • Your PC may be infected with a virus or botnet software program.
      • Someone in your organization may have a PC infected with a virus or botnet program.
      • You may be utilizing a dynamic IP address which was previously utilized by a known spammer.
      • Your marketing department may be sending out bulk emails that do not comply with the CAN-SPAM Act.
      • You may have an insecure wireless network which is allowing unknown users to use your network to send spam.
      • In some rare cases, your recipient's Barracuda Spam Firewall may be misconfigured.

• Expert told me in 2024-03:
  • “Zero-trust network access” ( ZTNA ) and “Security Service Edge” ( SSE ) are the successors of VPN.
  • Problems but which can be solved: Server-initiated traffic, as standard with voice-over-IP telephony & video calls: A user connect to a server, but the server initiates it's own connection back to the client(s).
    • Example with a SIP phone call: A user asks the server to connect to another user, but the server itself initiates a data stream between both users.
• Google - Search for "zero trust network access".
• DE.Wikipedia "Zero trust security model", DE.Wikipedia "Zero Trust Security".

• Book David Kahn "The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet".
  • EN.Wikipedia "The Codebreakers".
• The free PDF book makeuseof.com "The Password Management Guide" by Mohammed Al-Marhoon.
• Book Markus Beckedahl, Andre Meister: "Überwachtes Netz: Edward Snowden und der größte Überwachungsskandal der Geschichte".
  • A free PDF and e-book edition is available at netzpolitik.org "Buch zu verschenken: Bereits 60.000 Downloads von 'Überwachtes Netz'".

• Booleo "DSVGO (Datenschutzgrundverordnung) startet ab 25. Mai. Bitte dringend umsetzen!".

• CASPIAN - Consumers Against Supermarket Privacy Invasion and Numbering.
• The Data Liberation Front → “Google watch”.
• EUROPE versus FACEBOOK ( europe-v-facebook.org ).
  • crowd4privacy.org.
• Facebook “I like”.
  • heise Security "Das Like-Problem", 2011-04-20.
  • heise Online "2 Klicks für mehr Datenschutz", 2011-09-01 → Free HTML/Javascript code to fix Facebook's violation of data privacy.
  • heise Online "Facebook beschwert sich über datenschutzfreundlichen 2-Klick-Button [2. Update]", 2011-09-01.
• FoeBuD e.V. / digitalcourage e.V..
  • FoeBuD e.V. - Stoppt die Vorratsdatenspeicherung! - “Gegen die totale Protokollierung von Telefon, Handy, E-Mail und Internet”.
  • FoeBuD e.V. - AK Vorrat - Wiki.
• Data privacy with Google Analytics:
  • Google "Vertrag zur Auftragsdatenverarbeitung" ( PDF ).
  • Google Developers "Advanced Configuration - Web Tracking (analytics.js)".
  • Datenschutzbeauftragter.Info - Informationen zum Datenschutz "Google Analytics datenschutzkonform einsetzen".
• mrtopf.
  • EtherPad "jmstvcamp".
• Rigo Wenning.
• VDI Nachrichten "Webseitenbetreiber müssen Facebook-Dienste deaktivieren", 2011-08-26.
• “Safe Harbour” & “Privacy Shield”.
  • E-Recht24 "Weitreichendes Urteil: EuGH erklärt Privacy-Shield-Abkommen für ungültig", 2020-09-07.

• PGP does not crypt the “subject” of an E-Mail message .
• With Thunderbird E-Mail client, messages sent as crypted messagen, are just stored encrypted. I.e. you can´t search for contents in the body of such E-Mails. It does not help to enter the passphrase.
• Eric Howes' Privacy & Security Page. Protecting Your Privacy & Security.
• The International PGP Home Page.
  • The International PGP Home Page "Freeware PGP versions" for Windows, Linux,..
• Thunderbird Mail DE "Enigmail OpenPGP".
• Thunderbird Mail DE "Add-ons".
• EN.Wikipedia "Off-the-Record Messaging", DE.Wikipedia "Off-the-Record Messaging".
• EN.Wikipedia "Pretty Good Privacy", DE.Wikipedia "Pretty Good Privacy".
• EN.Wikipedia "TrueCrypt", DE.Wikipedia "TrueCrypt".

• Bundesbeauftragter für den Datenschutz und die Informationsfreiheit "EU-US Privacy Shield und Datenübermittlungen in die USA", Germany.
• Datenschutzbehörde Republik Österreich "EU-US Privacy Shield".
  • “Was bedeutet das für mich und mein Unternehmen? Wurde ein US-Unternehmen zertifiziert, ist der Datenfluss an dieses Unternehmen gemäß Art. 45 DSGVO ohne Genehmigung zulässig”.
• EN.Wikipedia "EU–US Privacy Shield", DE.Wikipedia "EU-US Privacy Shield".

• About.com "7 Free Windows Password Recovery Tools".
• ComputerBILD - COMPUTER BILD-Sicherheits-Center "Jeder Dritte vergisst jährlich ein Passwort", 2010-11-02.
• BILD "Kompliziert und leicht zu merken So bekommen Sie bombensichere Passwörter", 2011-01-11.
• Bundesamt für Sicherheit in der Informationstechnik "BSI-Sicherheitstest", 2014 - “Bei der Analyse von Botnetzen wurden 16 Millionen gestohlene digitale Identitäten entdeckt. Online-Kriminelle betreiben Botnetze, den Zusammenschluss unzähliger gekaperter Rechner von Privatanwendern, insbesondere auch mit dem Ziel des Identitätdiebstahls. Bei den digitalen Identitäten handelt es sich jeweils um E-Mail-Adresse und Passwort. E-Mail-Adresse und Passwort werden als Zugangsdaten für Mail-Accounts, oft aber auch für Online-Shops oder andere Internetdienste genutzt. Die zugehörigen E-Mail-Adressen wurden dem Bundesamt für Sicherheit in der Informationstechnik (BSI) übergeben....Hier können Sie überprüfen, ob Sie betroffen sind”.
• Marcus Janke, Peter Laackmann "Eurocheque-Karten: Sicherheitsmängel des ec-PIN-Verfahrens", Card Forum, 9, 1997, S. 39-47.

• Google Groups "de.org.ccc".

• OpenDirectory "Top: Computers: Security: Internet: Privacy".
• OpenDirectory "Top: Computers: Internet: E-mail: Encryption.
• OpenDirectory "Top: Computers: Software: Freeware: Encryption.
• OpenDirectory "Top: Computers: Security: Products and Tools: Cryptography".
• OpenDirectory "Top: Computers: Security: Products and Tools: Cryptography: PGP".