How secure am I?

[KingdomCome]

I currently have the following:

- ISDN Internet service provider(only turns on when I need it)

- A D-link router. WPA2-AES encrypted(334 bits). Admin password is at maximum(96 bits). Maximum idle time of 7 minutes, turns off if idle for more than that. Currently employing MAC addresses and only allowing specific MAC addresses(2), also static I.P. addresses(2), I have limited my router to only give a maximum of 2 I.P. addresses. Transmit power is only at 12.5%. Latest router firmware. Permanent PING block. UPNP settings disabled. VPN pass through disabled. CURRENTLY have wireless radio as OFF permanently(only way in is manually inserting CAT5 cables in).

- Currently have the latest updates for Windows SP2. Disabled useless stuff like UPNP and remote access permanently. Latest browsers(IE7, FF2, Opera)

- Am not using a firewall yet as I am undecided as to whether I should use Zone Alarm S.S. or the latest OutPost Pro.

- Using GhostSurf Platinum edition to surf the web anonymously.



I have the following problems:

- It appears that numerous people are trying to do an Xmas port scan of my router. Before I reduced power transmit power to 12.5%, there were at least 10 times more than it is now.

- Can't decide on which firewall to use. Most are BLOAT-ware and take up valuable resource, and also require a lot of tweaking to work properly. I use GRC frequently and I have never gotten a perfect mark as of yet.

- GHOST SURF 2007. This "seems" to be working fine, HOWEVER the encryption is only 52 bits. I need to find out how to upgrade to 1024 bits to be most secured. It can also be buggy sometimes.



ANY positive input would be greatly appreciated.

[KingdomCome]

Anyone please?

[KingdomCome]

OH, I forgot to add in.

I keep my most important files in an encrypted TrueCrypt container.

[the Tester]

For the firewall try Comodo.
It's not dificult to set up and should get Tru Stealth at grc.com

[WSFuser]

There is a (free) download to upgrade GhostSurf to 1024-bit encryption. I forgot if its on the site or if you download it through the program.

[KingdomCome]

Originally Posted by WSFuser

There is a (free) download to upgrade GhostSurf to 1024-bit encryption. I forgot if its on the site or if you download it through the program.

Yeah I found out how to do it right after this post of yours.

What kind of crap is this? The strong encryption is only available to U.S. citizens? Since when was that part of U.S. law?

[KingdomCome]

Another reason why not to use U.S. products. I am quite sure that this is another attempt at U.S. propaganda("the grass is greener on the other side" etc.)

[WSFuser]

I read somewhere that there is some U.S. law(s) that prohibits exporting certain technology to countries or something like that.

I suppose encryption falls under that "certain technology". Im not entirely sure.

[KingdomCome]

Originally Posted by WSFuser

I read somewhere that there is some U.S. law(s) that prohibits exporting certain technology to countries or something like that.

I suppose encryption falls under that "certain technology". Im not entirely sure.

Yes, there is a disclaimer that cites U.S. laws before installing.

Anyways, like I said possible U.S. propaganda.

Why can't Canadian people make great programs and restrict it solely to Canada?

[Carver]

Originally Posted by WSFuser

I read somewhere that there is some U.S. law(s) that prohibits exporting certain technology to countries or something like that.

I suppose encryption falls under that "certain technology". Im not entirely sure.

Here you go http://rechten.uvt.nl/koops/cryptolaw/
http://www.bis.doc.gov/encryption/Pu...odeNofify.html

[KingdomCome]

Can we get back to the topic at hand please?

How secure would you say I am?

[WSFuser]

Well your router is secure for sure. Also remember that GRC will end up testing your router instead of your PC.

BTW, which AV do you use?

[KingdomCome]

Originally Posted by WSFuser

Well your router is secure for sure. Also remember that GRC will end up testing your router instead of your PC.

BTW, which AV do you use?

Wow, completely forgot that.

Using NOD32 and Kaspersky at the moment.

[argus tuft]

Both in real time?

[Climenole]

Hi KingdomCome

Originally Posted by KingdomCome

I currently have the following:

- ISDN Internet service provider(only turns on when I need it)

That's correct.

Originally Posted by KingdomCome

- A D-link router. WPA2-AES encrypted(334 bits). Admin password is at maximum(96 bits).

Ok.

Originally Posted by KingdomCome

Maximum idle time of 7 minutes, turns off if idle for more than that.

Only 7 minutes? Ok: that's your choice...

Originally Posted by KingdomCome

Currently employing MAC addresses and only allowing specific MAC addresses(2), also static I.P. addresses(2), I have limited my router to only give a maximum of 2 I.P. addresses. Transmit power is only at 12.5%. Latest router firmware. Permanent PING block. UPNP settings disabled. VPN pass through disabled. CURRENTLY have wireless radio as OFF permanently(only way in is manually inserting CAT5 cables in).

Very good setup.

Originally Posted by KingdomCome

- Currently have the latest updates for Windows SP2. Disabled useless stuff like UPNP and remote access permanently. Latest browsers(IE7, FF2, Opera)

OK (except for IE , any version: never use that crap)
With FF: install NoScript extension...

Originally Posted by KingdomCome

- Am not using a firewall yet as I am undecided as to whether I should use Zone Alarm S.S. or the latest OutPost Pro.

First of all: there's firewall built-in functions with your router.
Check these FW parameters then verify if your system is stealth at Gibson Research:

www.grc.com
Shields Up test
All service ports
Everythings must be "green" (stealth)

For a software FW Outpost may be a good choice: not ZA.

Originally Posted by KingdomCome

- Using GhostSurf Platinum edition to surf the web anonymously.

I check their web site: privacy, anti-spywares and other stuff.
Hard to believed... How that's work? Proprietary encrypted connection to their proxies or what?

1) First things first: stop to pay for "anonymous" soft like that one.

2) For encrypted stuff the best solution is always Open Source softwares ...
How can you trust a closed source encryption program?

3) Proxies (even with an encrypted connection to them) are (at least) partially "anonymous"...

Hmmmm... GhostSurf Platinum eh? May be, may be not...

Give a try to Tor instead: http://tor.eff.org
(With no false promises...)

Originally Posted by KingdomCome

I have the following problems:

- It appears that numerous people are trying to do an Xmas port scan of my router. Before I reduced power transmit power to 12.5%, there were at least 10 times more than it is now.

- Can't decide on which firewall to use. Most are BLOAT-ware and take up valuable resource, and also require a lot of tweaking to work properly. I use GRC frequently and I have never gotten a perfect mark as of yet.

- GHOST SURF 2007. This "seems" to be working fine, HOWEVER the encryption is only 52 bits. I need to find out how to upgrade to 1024 bits to be most secured. It can also be buggy sometimes.


ANY positive input would be greatly appreciated.

Xmas packets are blocked with no feed back (dropped) by the Router built-in FW: right?
If so, there is no problem. The Router FW do is job... No?

Originally Posted by KingdomCome

Using NOD32 and Kaspersky at the moment.

Only ONE AV. More than one is not more secure and create strange side effects.

Choose the one you prefer and uninstall the other one.

[KingdomCome]

Originally Posted by argus tuft

Both in real time?

No, I wish.

I use Nod32 real time as it usually leaves the smallest memory footstep for me.

Kaspersky is for once a week deep scans.

[KingdomCome]

Originally Posted by Climenole

Hi KingdomCome



That's correct.



Ok.



Only 7 minutes? Ok: that's your choice...



Very good setup.



OK (except for IE , any version: never use that crap)
With FF: install NoScript extension...



First of all: there's firewall built-in functions with your router.
Check these FW parameters then verify if your system is stealth at Gibson Research:

www.grc.com
Shields Up test
All service ports
Everythings must be "green" (stealth)

For a software FW Outpost may be a good choice: not ZA.




I check their web site: privacy, anti-spywares and other stuff.
Hard to believed... How that's work? Proprietary encrypted connection to their proxies or what?

1) First things first: stop to pay for "anonymous" soft like that one.

2) For encrypted stuff the best solution is always Open Source softwares ...
How can you trust a closed source encryption program?

3) Proxies (even with an encrypted connection to them) are (at least) partially "anonymous"...

Hmmmm... GhostSurf Platinum eh? May be, may be not...

Give a try to Tor instead: http://tor.eff.org
(With no false promises...)



Xmas packets are blocked with no feed back (dropped) by the Router built-in FW: right?
If so, there is no problem. The Router FW do is job... No?



Only ONE AV. More than one is not more secure and create strange side effects.

Choose the one you prefer and uninstall the other one.

Unless I am wrong, idle time is how long the connection can be idle before disconnected automatically. IMHO, it is a good security precaution to make it a low number. Considering that I have a Bell Sympatico as my ISP my I.P. number never stays the same, so everytime a d/c-connect happens, I have a new address.

Router firewalls are extremely good at doing their jobs, but I want a mixture of hardware and software firewalls for maximum thoroughness. Router firewall is never fully stealthed, ports like 0 always manage to stay on.

I've thought about the proprietary encryption GhostSurf uses, I'm not fond of the fact that I don't know what cipher they are using but nonetheless I have the software all fully paid for legitimately, so might as well stick with it until it expires. Will use Tor in the future, hopefully connection is not bad while on it.

The router is doing it's job extremely well. In the beginning the amount of people that would try to scan my ports were ridiculously high. Not it is just a couple every so often.

I do not run two AVs at the same time. I use one mainly and then use the other as a backup.

[Climenole]

Hi KingdomCome

Originally Posted by KingdomCome

Unless I am wrong, idle time is how long the connection can be idle before disconnected automatically. IMHO, it is a good security precaution to make it a low number. Considering that I have a Bell Sympatico as my ISP my I.P. number never stays the same, so everytime a d/c-connect happens, I have a new address.

That's correct.

Originally Posted by KingdomCome

Router firewalls are extremely good at doing their jobs, but I want a mixture of hardware and software firewalls for maximum thoroughness. Router firewall is never fully stealthed, ports like 0 always manage to stay on.

Not stealth on port 0? Can you confirm this by checking at grc.com (shields up test)? May be there's somethings wrong in the router setup. Is it some ICMP responses to external scan or what ?

If the router do not stealth your computer I don't believe that a software firewall fix that problem...

Originally Posted by KingdomCome

The router is doing it's job extremely well. In the beginning the amount of people that would try to scan my ports were ridiculously high. Not it is just a couple every so often.

There's a lot of strange incommings packets but most of them are not scans.
When you received a new Ip addr. from Bell Sympatico this IP address was used by somebody else.

Often there is remaining packets from the previous connection under this IP addr. BitTorrent and other P2P programs are often responsibles for this.

When a Bt program is closed there is a lot of remaining packets in UDP and attemps to connect in TCP hours after the program was shutdown.

Since Bt and may other p2p used not only p2p "standard" ports but any port it's not easy to identify them based on port use...

The other frequent packets are TCP + syn flag packets on ports 135 and 445: (Blaster, Sasser worm ? )

And finally there is many UDP packets mostly on ports 1026 to 1028. This is a "Net Send Messenger" spam mostly from IP addr. in the "Pacific ring" (Taiwan, China, etc)

To have a closer look on these packets you may use Packetyzer:
http://sourceforge.net/projects/packetyzer/

[KingdomCome]

I'm using Tor now with my laptop, I'd love to know what kind of encryption cipher it uses. This information does not seem to be available anywhere, is Tor not supposed to be open source?

[lotuseclat79]

I would go to the small expense of using the xeroBank browser, aka formerly known as TorPark. The Plus version is just 10$/month. A small price to pay for the additional security it gives to your transactions on the Internet.

Encryption is the key to security, at least until quantum computers come along and turn everything topsy-turvy. Just now getting started is the DPI or Deep Packet Inspection technology - when fully rolled out, unless you are encrypted on your Internet traffic then forgeddaboutit with regards to security on the Internet.

-- Tom

[KingdomCome]

The product that you are endorsing really lacks information. For instance what encryption cipher are they using? What is their definition of anonymous surfing?

All they have is a cover page and no further detailed information.

MOVING ON...

Does anybody here have any experience with installing OpenBSD?

I am currently running on a Vista which is not really very secure. I am not even sure if my laptop can run OpenBSD(Core Duo Yonah).

[lotuseclat79]

Originally Posted by KingdomCome

The product that you are endorsing really lacks information. For instance what encryption cipher are they using? What is their definition of anonymous surfing?

All they have is a cover page and no further detailed information.

MOVING ON...

Does anybody here have any experience with installing OpenBSD?

I am currently running on a Vista which is not really very secure. I am not even sure if my laptop can run OpenBSD(Core Duo Yonah).

Hi KC,

Be that as it may, you should send a PM to member Torrify aka Steve and I'm sure he will answer any questions your have. I don't use it myself - no bandwidth as I am on dialup, and I have no stake in the product. You can find one of his posts here in the "Tor and https (continued) | Tor encryption?" thread (post #4).

-- Tom