Thanks a lot, this seems logical, since I am not good enough in IT stuff to rely soley on the auth of the server and I want a second layer of protection to at least reduce the attack surface to known devices, i will look into a local VPN, but if this is also overkill for my skills, I may just buy a second AP for more WiFi networks. Would be beneficial for coverage anyway.
Love that guy, but that’s the only source I have which at least feels objective, but one source, especially a YouTube video, isn’t enough. Someone got like scientific/investigative data on this?
Having the correct class analysis but trying to keep the system just split the classes by ethnicity instead of overthrowing it is exactly what the Nazis proposed…
What VPN would you recommend which outs privacy first but also has good enough speed and ping to use as daily driver for HD videos and casual gaming?
What vpn to migrate to? Proton trys to be Google 2.0 and centralize, The ones from the adverts (nord, tunnelbear, surfshark) dont protect your privacy and are therefore useless…
Anyone with more tech knowledge got a recommendation fro maximum privacy and decent enough speed and ping for hd videos and casual gaming?
Okay, maybe I’m misunderstanding something, but my thinking goes like this:
In my mind I could prevent this with authentication, as I could force a device to have a keyfile or something in order to use that IP address. So the bad actor would at least first need to get access to the real device and steal the keyfile in order to spoof it. Which (in my mind) is way harder than iterating through all Mac addresses and testing which addresses get which IPs with which permissions.
The issue i want to solve (with this part) would basically boil down to: securely giving different permissions to devices on the same network/subnet.
The only other way I would see would be to buy more APs so there is a separate WiFi for every set of permissions I want to give out, so spoofing Mac addresses becomes irrelevant.
I’ll try to do a diagram tomorrow. Its a mixed network of multiple families of whom some want to host a server to the internet. That would mean lots of untrusted traffic, so I get more concerned with auth. If I know the Mac address and IP I want to spoof, I can get the permissions of the device I spoofed, as long as I am in the same subnet, which is the case for wifi (ap can only host 4 different ones, I have more than 4 groups of user permissions so I can’t separate them all). That’s where some auth would come in in my mind.
The problem is, I just learned about how to use the software, I am far from deep enough in it (and IT-knowledge in general) to actually pen test myself, I would have no idea how someone would worm through my network, if he gets rce on the server of one of the other families, so I can’t really say if something like this is possible or not.
Well I did that for the parts I did understand (trying to connect to server on different subnet, trying to get an IP in the space of a different subnet to get access, trying to get internet access on networks that should have none)
I just wonder how to test for things I dont understand. I have no plan on how one would go about exploiting a flaw in my NAT or VPN setup, so I can’t test it
Thanks for you thoughts! It will take a while to go through the tools, but having a list really helps.
For the auth, you are suggesting that clients on the same subnet should always have the same permissions?
Usecase would be: We have a WiFi for family A, mother shall get access to the media server on a different subnet, tech savy son should not get acces to it. We have client isolation, but that would not stop the son from “stealing” the IP address his mom uses by spoofing their Mac address. I dont see how client isolation would help here, but I would need some kind of auth approach.
Sure putting them on different subnets would be an elegant solution, but I can only host 4 wifis from my ap and have more than 4 “permission groups”
Yes, that’s the idea, that everything needs to go through opnsense, where I manage who’s allowed to go where. The question now is how to determine if the front door lock is safe, so that nothing can leak through because I misconfigured nat or VPN or something
Well I have separate subnets for separate vlans. Connections between them get blocked by the firewall by default from my understanding, but to be safe I explicitly deny all outbound AND inbound connections, so I have to make a rule for each of two subnets if I want inter subnet communication, which is the case for the shared media server. If I do that I whitelist which IPs can reach which IPs on the different subnet. There still is the problem that different clients on the same network can "steal"the IP of other clients with more permissions. That’s why I asked about authentication
I tried that a little, but my problem was that there was to much stuff going on in the network for me to understand and review all. I am currently not reachable at all from the big internet, only local server access and I only get working connections if I rset an IP corresponding to the vlan I am in, but unify broadcasting, Nat, VPN, etc. Make a lot of connections and connection attempts internally I dont understand.
Problem with no client authentication is that the network is used by multiple separate households not necessary trusting each other, and some now want to host servers to the public, which would mean lots of untrusted traffic. I am concerned if they dont handle their security right and have access to for example our shared media server, they could scrape ip-mac address pairs to get deeper in the network. Any thoughts on benefits and lows of 802.1 vs. Radius?
Okay, yeah i do look at the reporting to Register things that look off, but I am not sure I recognize everything that IS off.
Generally I keep outbound and inbound completely closed except for the connections I need, which I manually allow for in the rules for each subnet. for the client WiFi I have a alias with all private (ipv4) ranges, and a rule that allows outbound to anything but that (so only connections to “the internet” not to stuff in my network.
Radius is the thing I at least came across a few times in my settings, from what I understand I would need a dedicated radius server all can reach an authenticate against right? At the moment I only have a bare metal Debian server for the self hosted unifi controller, maybe I could learn proxmox and do radius and unifi in different VMs on that machine.
What would the tailscale option mean? I have heard about it (but mostly mentioned in combination with arr stacks, which I dont have, so I never looked at it. What does it do? What are the benefits over for example radius?
Okay, so radius/tailscale for client networks, for iot I rely on subnet separation would be your advice?
There could be driver issues for the difrerent Hardware devices, most likely it will run just fine, but you may have performance impacts you later dont know where they are comming from. Reinstalling is the safe way, if you dont want to redownload all games, you can copy the steam games folder
Isnt the sun the actual lamp and all others the forbidden ones? Like they try to orient at the sun when wanting to rise higher, that’s why they get caught by artificial light no?
First of all: i havent used sailfish nor a Sony 10 IV so take everything with a grain of salt, but:
When looking for a familiar alternative to normal android, lineage is your go to. If there is an official build for the device it will most certainly work for everything in its power.
If a banking app doesn’t allow running without google services, it won’t run on degoogled lineage, but that’s not really lineages fault.
I used lineage for years, and though you sometimes “feel” its a custom ROM (sometimes something doesn’t work on the first try but randomly on the third, and the like) I always was able to satisfy my needs in a phone.
If you rely on apps that purposely don’t run on custom ROMs, and can’t find an alternative, you will need a second drawer smartphone for those I fear, but I don’t think this would be any better under sailfish.
Mine runs in lineage
Klicks “report for:”
“I am in this picture and i dont like it”
Wdym medieval? This is still in every german “spielesammlung” I played this a lot as a kid
Thx for the suggestion, I have seen this, the hated one is my only good source on this topic, but more than one source would be nice.
The anarchist story was one of those which sounded almost to good to be true in my ears