Note: This is an old post from 2015 at blog.selvans.net. It is moved to this site with updated screenshot and content. Though it is more than 7 years old, it is still valid & Facebook still supports this feature.
Thursday, January 26, 2023
How to protect your Facebook account with encrypted notifications
How to access your passwords anywhere
Note: This is an old post from 2014 at blog.selvans.net moved to this blog site.
Have you ever forgotten the password to login to one of your many online accounts? It happens to me all the time so I save all my passwords to a file, encrypt it, and have a shell script to decrypt, search and spit the plain password whenever I don't remember the password. This is great when I am at home where I have access to my script and my encrypted password file. However, if I don't remember a password to a site when I am not at home, it is a problem. So I exposed a simple public interface on my webserver to securely decrypt my passwords online from anywhere. Feel free to use this tool to encrypt/decrypt anything (passwords, email, or just any text) and share a per message passphrase to other person to decrypt the message to its original content. Don't worry no one will be able to read unless you give them your passphrase. You can save the encrypted content (see a sample below) anywhere like google docs, dropbox, skydrive, or usb stick etc so you can easily access it anywhere. Feel free to use the tool (it is at the link below). There are many password manager tools like lastpass, keepass etc available freely that does similar things but the only difference is, here you control how you safeguard your encrypted file and in addition, you have simple web access to encrypt/decrypt any arbitrary text.
It is perfectly safe to store the encrypted message anywhere in your laptop/desktop as it will be encrypted with strong AES-256 cipher. Whenever you need to see the message content, all you need to remember is the passphrase you used to encrypt it. To get an idea, decrypt the sample content below using the passphrase 'th1s 1s coo1' without the quotes if you are interested to see how it works.
b97ca8a4928db1a7M5lbEofsXXYqTrvEQXyIYBwbJgqUo8S5iUZuzUuoX370OzoeIXiEbkX1KKprK02Z7n9ocnMx1JoEeB3cJdgqBxkpO84Pq+rQrSsUcgLtOp10xZnFM40EJX9RPyLD7Gyl1yKIzZ5nuWxrKIz29R5UFel6J6ZBGKCbWRP2lVbaQPKFZLJtgUQ7Vq7sKxffUOepPoBxeCWcpNYyhthj4IQ/t1WUl8asGSH7CUp0Rje3GJIaHBSciwUDA+g4euunb4NY6Kivq3O7FCyJ8REpZgZ9TIZuUgYFV0tjMi9xdAxWR4EUsJUaG4fC+5JfFA05cGZgcEkwc9VSdLKDc6L1p3Ku3L/3dRnBSlSC1hXZM0Shsdo=
Sunday, July 17, 2022
How much of your info is freely available online?
Have you ever wondered how much of your information is available on public websites for anyone to search? I am sure some of you are aware of paid services that go far beyond typical google and other search engines but I am talking about totally free service to instantly get a ton of information not only on you but also everyone associated with you like your kids, neighbors, relatives, phone numbers, and more. Not to mention all the places you have ever lived which I am sure many of you know is one of the key attributes to validate your identity with many financial institutions.
Well, wonder no more as there is tons of information about you online and are freely available for anyone to search. And these are constantly being updated and redundantly stored on multiple online sites!
Now that I caught your attention 😊, here is a quick way to find out how much information is out there on you and how to remove your information ... well, you can attempt to remove it but it's not that easy, which is explained at the end. Just open your browser and navigate to the following site below and search your name and your address (just city or even state is fine) or phone number ... you would be very surprised to see how much of your info is out there.
https://www.fastpeoplesearch.com/
Make sure to scroll down all the way and click the "VIEW FREE DETAILS'' button at bottom (as shown in the screenshot) that brings up the detailed screen which shows all info they got on you. I am sure some of you know that this is not new, and this specific site mentioned is in business for well over 10+ years but how much of the information they gathered over the years is nutts!. This site has a lot more free information now than it had before when I looked at it several years ago.
Note: I removed my information but it is erroneously showing someone else in that place 😄
So how do you remove it? For this site, navigate to the link below and follow the directions. It should be fairly quick to get your data removed. Feel free to post a comment on this blog if you have trouble removing yourself and I will try to help you. Now, the big question is, how long it's going to stick?
https://www.fastpeoplesearch.com/removal
Here are a few more sites and the corresponding removal links but these are by no means a full list.
Website | Removal Link |
www.truepeoplesearch.com | |
www.peeplookup.com | |
www.beenverified.com | |
truthfinder.com | |
www.zabasearch.com | |
www.intelius.com | |
www.familytreenow.com | |
www.peekyou.com | |
www.fastpeoplesearch.com | |
www.spokeo.com | |
nuwber.com | |
Radaris | |
unmask.com | |
whitepages.com | |
infotracer.com | |
emailtracer.com | |
freebackgroundcheck.io | |
govwarrantsearch.org | |
familytreenow.com | |
peopledatalabs.com | |
clustrmaps.com |
A goto website that has aggregated data of many breaches of last few decades | |
Exclusively search the NPD dataset - a super large breach in July 2024 | |
Sunday, June 26, 2022
Deterministic Password Manager
While Apple, Google, and Microsoft are all very hard at work on a variety of passwordless schemes, passwordless logins will not be a reality at every website you visit anytime soon, simply because password-based login systems are the easiest and the cheapest to implement and most business, including banks/financial institutions are too lazy and don't want to do anything unless they are forced to implement a better solution. So we all have to continue using password manager for quite some time to come.
There are many commercial and free versions of password managers out there to choose from but most of them store your encrypted password somewhere on the cloud which has a potential to be compromised. What if a password manager stores literally nothing and is able to deterministically calculate your password every time you access it? Would that be cool? That is what I did with my deterministic password manager prototype below.
My website password.selvansoft.com creates deterministic password without storing anything on the cloud or local storage unlike many password managers. All you need to remember is your single passphrase, the website name (FQDN), username for each website to create or retrieve your strong password on the fly. For convenience, the password is copied to browser's clipboard so it can be pasted into the website's password field directly.
Note: Password length can be set to 8 char for old & outdated websites that still insists on 8 char but it is highly recommended to use 16 char. Also, fields are case sensitive to ensure high variability on generation of password.
Simple Encrypted Drive
We all have sensitive data that we need to keep them away from prying eyes. While there are so many free software and solutions available, they all have advantages and disadvantages in using them. A discussion of available solutions and the pros/cons are outside the scope of this blog. If you are interested in using a simple, highly secure and most importantly, a free solution where you have 100% control of your sensitive information, read on. Note: This is only if you use a Mac or Linux laptop/desktop, sorry no Windows.
# Instructions for installing encfs
Facebook knows you way more than you think!
We all know that Facebook collects data on all of us. They manage to do that with different ways including via 3rd-party web browser cookies; an explanation of 3rd-party cookies goes beyond the scope of this blog but you can read about it at the link here. Though 3rd-party cookies are slowly phased out, the alternative i.e. FLoC proposed by Google, as per many privacy advocates, is even worse i.e. so for now, just assume Facebook and other platforms will always have a way to spy on you.
While there are ways to restrict what Facebook collects (follow steps at end of this blog), there is not a whole lot you can do to make them stop other than just deleting your Facebook account. The reason is, Facebook generates substantially all of its revenue by selling ads so they have to monitor your online activity to slap you with targeted ads and curated content based on your web browsing behaviour i.e. the sites you visit, shop, like etc. At the end of the day, Facebook knowing I have T-mobile wireless, or shop at Amazon or browse Reddit is not a big deal for me, I just don't care. However, when I looked at what websites are sharing with Facebook, specifically, financial institution that I do business with, I was concerned. My financial institution (will not mention their name here) shared with Facebook something related to my activity, see below ...
It is unclear to me what they shared since I don't have the details other than Facebook telling me they did. I have the habit of clearing all cookies on banking and financial websites frequently, so unfortunately, I can no longer access this specific cookie in my browser to see the content! However, based on the name of activity shared i.e. "COMPLETE_REGISTRATION", I can only assume it is not something I would like them to share, whatever it is. If it was just "PAGE_VIEW" like all other sites, I would be ok with it. The only thing I remember is opening a new account, transferring money on those 2 days at that exact time mentioned which caused my concern. Why on earth Facebook needs this information? Just to give some perspective, this is just one specific instance of a website I have discussed above, there could be crap ton of them we visit everyday sharing all kinds of stuff w/ Facebook 😮
Finally, if you got this far, you can follow the steps below to tell Facebook to quit doing this, at least for now, until they figure out new ways of profiting on you 😃
Update: (May 22, 2024): Since many page links and interfaces have changed since this original post back in June 2022, I updated the details below as of today.
While logged in Facebook ...
- Navigate to https://www.facebook.com/off_facebook_activity
- Click "Manage future activity"
- Click on "Disconnect future activity" [Note: this will also clear all the stored activity so you don't need to clear that]
Sunday, November 2, 2014
How to get free home phone service w/ Google Voice + OBi
OBi110:
Google Voice (GV):
Number porting:
Setting up OBi Device:
International calls:
Skype integration: (optional)
- Download the latest SipToSis (a program that creates a bridge between your skype client and OBi device) from here: http://www.mhspot.com/sts/siptosis_download.php Once download is complete, extract the archive to a folder named SipToSis. Execute SipToSis_win.bat (windows users) on a command prompt or SipToSis_linux (Linux users). When activity has stopped, terminate SipToSis.
- Now, using notepad (or vi) edit SkypeToSipAuth.props file and add the following line at end of the file. In order to do this, first you need to find the IP Address of your OBi device. To find IP address, pickup your home phone, and dial ***1 and press talk button. Now your OBi will speak the IP address (and other settings) for you, once you note down the IP, you can hang up. I assume you know your skype_id :) Note, replace the appropriate entries on the line with out any angle brackets of course.*,sip:siptosis@<your_OBi_IP_Address>:5061,<your_skype_id>
- Add a # in front of the line in the same file as shown below#*,play:clips/invalidDest.wav
- Go to obitalk.com and enable expert settings (click the blue button for expert/advanced configuration, click yes at the warning and click enter to enable expert settings page). Under the expert settings, make the following changes.Service Providers -> ITSP Profile B -> SIP -> ProxyServer : 127.0.0.1Voice Services -> SP2 Service -> AuthUserName : (put anything here)Voice Services -> SP2 Service -> X_RegisterEnable : (unchecked)Voice Services -> SP2 Service -> X_ServProvProfile : BSP2 status should show : Registration Not Required
- Start skype client.
- Start SipToSis on the command prompt. (You should see the output similar to what I get on my machine shown below for reference)
Bridging a land-line with OBi: (optional)
Final thoughts:
Saturday, May 3, 2014
How to block unwanted calls using Vonage and Google Voice
Just follow the 3 steps below.
1. Get a free google voice number. Go to https://www.google.com/voice and follow the prompt to set it up with your home or cell (you should remove it later) and google chat as the forwarding numbers as shown below ...
Phones setting: http://selvans.net/vonage_scb/gvsettings.png
Calls setting: http://selvans.net/vonage_scb/gvcallsettings.png
Note: mine shows only google chat since I removed all forwarding numbers.
2. Login to your vonage account and setup simulring to ring your google voice as shown below
Simulring: http://selvans.net/vonage_scb/simulring.png
3. Login to your vonage account and setup voicemail timeout settings as shown below
Vonage VM timeout: http://selvans.net/vonage_scb/vmtimeout.png
After this, when ever you get an unwanted call, login to google voice, select history, find the unwanted number and select "block" from the pulldown menu under "more" as shown below ...
http://selvans.net/vonage_scb/gvblock.png
Note: Google does a pretty good job on its own blocking spam... as you can see, I did not have to block this 702-815-2394 number since google already did that for me :)
In addition, if you have a list of numbers to be blocked you can follow my original post below to setup a group of numbers to block.
https://forums.vonage.com/showpost.php?p=17184&postcount=56
Enjoy!
How to setup keybased ssh, scp to Transend WifiSD card
The following are steps to get root and ssh access to Transend WifiSD card to automate copying of files from the card. It is assumed that the user is familiar with some knowledge of Linux scripts and commands. It is also assumed that the user is going to use a Linux host to interact with the card although the setup can be easily used in Windows as well using tools like winSCP or cygwin or pscp.exe.
The setup outlined here is based on the information and code shared by the original author (Glen) at the following link/blog.
https://www.pitt-pladdy.com/blog/_20140202-083815_0000_Transcend_WiFi_SD_Hacks_CF_adaptor_telnet_custom_upload_/
DISCLAIMER: Use it at your own risk. I am not responsible for any loss or damage to your property.
STEPS:
0. Use the Transcend tools (andriod app or ios app) to configure your card to connect to your home wifi network; while you are at it, change admin user, cards wifi ssid, passwd etc. Make sure your card successfully connects to your wireless network and note the IP address assigned to it by your home wifi router.
1. Download and extract http://selvans.net/public/custom.tar.gz in your desktop computer and edit the autorun.sh file to uncomment the line below for telnet access, i.e. remove '#'
telnetd -l /bin/bash &
2. Edit the access.sh file and change "trusted_network" variable to match yours
trusted_network="your_routers_ssid:your_routers_ip:your_router_mac"
example: trusted_network="myrouterssid:192.168.1.1:ff:ff:ff:ff:ff:ff"
3. Insert your SD card in your computer and copy the entire custom/ directory from step #1 above to the root directory of SD card. In addition, also copy autorun.sh to root directory of SD card.
4. Remove card and reinsert it into your computer.
5. Now you should be able to telnet to your card from your linux box, i.e. telnet <your_card_ip>
In the examples shown below 192.168.xxx.xxx is my WifiSD card and 192.168.yyy.yyy is my ubuntu desktop
arul@cheetah:~$ telnet 192.168.xxx.xxx
Trying 192.168.xxx.xxx...
Connected to 192.168.xxx.xxx.
Escape character is '^]'.
# ls
bin home lost+found sbin usr
config_value init mnt sys var
dev lib proc tmp www
etc linuxrc root ts_version.inc
6. Once you are logged in via telnet as shown at #5 above, you need to create dropbear hostkeys and copy them to your desktop to include in /custom directory on SDcard. Note: I have included two dummy files in /custom directory you need to replace them by creating your own key files. i.e. follow the example below but use your IP address and your user name of course.
# dropbearkey -t rsa -f /tmp/dropbear_rsa_host_key
# dropbearkey -t dss -f /tmp/dropbear_dss_host_key
# scp /tmp/dropbear_* arul@192.168.yyy.yyy:/tmp/.
Now, copy the 2 files from your /tmp directory to the custom/ directory on the SD card by replacing them.
7. Create (or copy if you already have a dsa public key) in your desktop to the /custom directory as authorized_keys. Note: I have a dummy authorized_keys file that you need to replace.
ssh-keygen -t dsa
cp ~/.ssh/id_dsa.pub custom/authorized_keys
8. Once you update all the key files in custom/ directory in the card, unplug your card and plug it back into your device (computer or camera) one last time. Once the card boots, you should be able to ssh into your card or scp files, or setup automated scripts to copy files from card to your desktop... and pretty much do everything you can do with ssh!
example:
arul@cheetah:/tmp$ ssh root@192.168.xxx.xxx
# cat /proc/cpuinfo
Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 421.06
Features : swp half fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5
Hardware : KeyASIC Ka2000 EVM
Revision : 0000
Serial : 0000000000000000
# date
Sat May 3 16:13:53 UTC 2014
# /sbin/busybox-armv5l uname -a
Linux (none) 2.6.32.28 #137 PREEMPT Fri Mar 22 18:21:52 CST 2013 armv5tejl GNU/Linux
Connection to 192.168.xxx.xxx closed.
arul@cheetah:/tmp$ scp -r root@192.168.xxx.xxx:/mnt/sd/DCIM/* .
DSCN0254.JPG 100% 836KB 278.8KB/s 00:03
Have fun with ssh/scp on your Transend WifiSD card!
TOOLS:
This is where I got the prebuilt busybox and dropbear binaries for reference. They are already in the custom/ directory for convenience.
arm5l busybox: http://busybox.net/downloads/binaries/latest/
arm5l dropbear: http://landley.net/aboriginal/about.html