Insights For Success

Strategy, Innovation, Leadership and Security

Security

Comparing NordVPN and ExpressVPN

GeneralEdward KiledjianComment
vpn-4056382.jpg

This is not a sponsored post, and none of the links are affiliate links?

Readers regularly ask me to compare NordVPN to ExpressVPN

  • "Can you compare NordVPN to ExpressVPN?"

  • "Is NordVPN better than ExpressVPN?"

  • "Is ExpressVPN faster than NordVPN?"

Both NordVPN and ExpressVPN are considered to be top of the line premium VPN services. Both offer similar premium services and functionality such as:

  • reliable connectivity

  • fast connection speed

  • well designed strong encryption

  • 30-day money back guarantee

  • 24/7 technical support

  • No log policy

  • Kill switch to prevent leaking of your true identity or location

If you want a VPN to watch geographically locked streaming services such as Hulu, Netflix, BBC then ExpressVPN is probably your preferred choice. ExpressVPN seems to be one of the only services that has not been blocked by the Netflix proxy filter. In addition to successfully working around the Netflix proxy filters, ExpressVPN offers the fastest performance; therefore you are less likely to get buffering or lag.

Although NordVPN has had some issues with various streaming services blocking them, the support team works quickly to work around these issues so you should have access to most of your shows most of the time. NordVPN isn't as fast as ExpressVPN but is close enough for most users. NordVPN now has more than 5,092 servers which is an amazing amount (more than ExpressVPN).

NordVPN also offers a feature called DoubleVPN. DoubleVPN is a technique called VPN chaining (called on ProtonVPN). The concept is that they encrypt all the traffic once (standard VPN functionality) and then pass it through a second VPN server (encrypting again) before finally exiting to the internet. SoubleVPN will improve your security posture but will reduce your connection speed.

Conclusion

In summary, ExpressVPN offers better and more reliable access to streaming services and faster VPN speeds. NordVPN is good but not as good as ExpressVPN. NordVPN's claim to fame is the price.

NordVPN offers one of the best VPN services available today at a price that is significantly cheaper than ExpressVPN (especially with a multi-year subscription).

NordVPN-3Year.PNG

With a 15 month ExpressVPN plan, the service costs $6.67 a month. On a 3-year plan with NordVPN, the monthly price is $2.99 (less than half).

Regardless of what service you choose, make sure you check for deals (which can discount as much as 50% sometimes).

Mozilla Firefox 67 will allow letterboxing to protect your online identity

GeneralEdward Kiledjian2 Comments
fingerprint-2904774.jpg

September 2016 I wrote an article entitles “Your browser will betray your identity” that discussed the various techniques legitimate (marketers) and illegitimate (threat actors) use to keep track of your identity even if you aren’t logged into any of their sites.

The purpose-built TOR version of the Mozilla Firefox browser has (for a while) implemented a technique called letterboxing to protect users from this type of nefarious identification through browser fingerprinting.

Most browsers allow a site to send client-side javascript code that detects the display size of the browser. This technique is used to create dynamically generated webpages that are optimized for the device size you are using. This is why modern well-designed websites render correctly on large 24" desktop screens and 6" smartphones.

Would you be surprised to learn that this can be one dimension threat actors or marketers can use to start deanonymizing you?

The privacy team behind the TOR project goes to great lengths to maximize your privacy while using their anonymizing network by minimizing your data exhaust while browsing the web. We have seen the Firefox team backport some of these privacy enhancements back into the mainstream Firefox. This backport initiative is called TOR Uplift and started in 2016.

In release 67, expected in May, Firefox will bring letterboxing into the mainstream version (from the TOR one). Letterboxing is a technique of rounding the actual size of the browser window (height and width) down to a multiple of 200 pixels for width and 100 pixels for height. This means more users will have the same window size value making deanonymizing more complicated. Firefox will add grey bars on a side that needs to be padded if the rendered page isn't a perfect fit. If you are more concerned about looks, you will be able to turn off this additional protection technique using a Firefox flag.

In the Bugzilla tracker, Mozilla wrote "Window dimensions are a big source of fingerprintable entropy on the web" & "Maximized windows reveal available screen width and height, excluding toolbars; and full-screen windows reveal screen width and height. Non-maximized windows can allow a strong correlation between two tabs".

Here is a demo of letterboxing while resizing the browser window. Notice the grey added around the rendered page.

The letterboxing feature won’t be turned on by default. Users wanting this extra layer of protection will have to open about:config and enter “privacy.resistFingerprinting” in the config search box and change the setting to “true”.

Continuous authentication is the future

GeneralEdward KiledjianComment
eye-2771174.jpg

User authentication is one of the most important and fundamental building blocks of security. Authentication is built on username, password, token, biometrics or any combination of these. Regardless of the model, authentication is performed when the user starts his/her interaction with the target system.

What do you do if you require a higher level of authentication? What if you need to make sure the user interacting with your system is always whom they say they are. This is where the concept of continuous authentication comes in. We started to see this concept implemented for the mass-market with the Apple Watch and Apple Pay. You authenticate Apple Pay once and as long as the watch stays on your wrist (validated with a pulse), you do not need to re-authenticate. Apple pay can be sure that the person wanting to make a payment is the user that authenticated originally.

Continuous Authentication is a paradigm shift moving authentication from an event to a continuous risk management process.

Dynamic risk-based authentication means the system is continuously monitoring changes to environmental parameters and can decide the trustworthiness of users continually.

The shift to continuous authentication is inevitable. Not only will it make authentication more natural for the user but it will allow security administrators to implement much tighter security models.

As an example, if the user walks away from the computer, the system could notice and freeze the interactive session. Another example is a user working on a PC is tricked and launches malware. The system could be intelligent enough to know that a rogue process is attempting to masquerade as the user and block access.

Continuous authentication is to use the full array of modern technologies and others that have yet to be released. Parameters such as keyboard typing speed and style, how the user swipes on a touchscreen device, how the user moves the mouse, the camera input (from modern day cameras), gait analysis using the accelerometer in a smartphone or smartwatch, etc.

Although continuous authentication will be easy for users, expect it to be very complicated for developers. Expect this to be a burgeoning market in the coming years, something most security professionals have to start thinking about. We expect to start seeing serious mass market products around 2020-2021.

Popular TOR site list

GeneralEdward KiledjianComment
TOR-Links1.png
TOR-Links2.png

Candle is a basic search engine. It contains a small but interesting subset of TOR sites.

TOR-Links3.png

Grams is a dark market search engine for labour, digital & physical goods that can be purchased with various currencies including Bitcoin. It searches the most popular darknet markets including Hansa, AlphaBay, Agora, Nucleus Market, Majestic Garden, Oxygen, Outlaw Market, Oasis, Tochka and Arsenal.

TOR-Links4.png

Haystack is another TOR (darknet) search engine and claims to have indexed 1.5 billion pages (which makes it one of the most comprehensive TOR search engines). In my experience, this site is a hit type of thing. Every couple of searches fail for me.

Security sites

TOR-Links5.png

GnuPG (open source version of PGP) allows users to cryptographically sign and encrypt email communications.

TOR-Links6.png


OnionShare is a free and opensource tool that allows users to securely and anonymous share large files over the TOR network.

Anonymous Pasting sites

There may be times when you want to post (public or private) a snippet of text with the world. The common feature shared by most of these TOR based services is that pastes delete automatically after a certain amount of time. These are TOR alternatives to pastebin.com

TOR-Links7.png

DeepPaste is a very simple and basic pasting service.

TOR-Links8.png

RiseUp pasted are automatically deleted within a week. Additionally you can share files up to 50MB.

TOR-Links9.png

Pasta is an open source paste service that supports standard pastes, editable pastes, self-burning pastes and URL shortener.

Email

TOR-Links10.png

Confidant Mail is a free and open srouce non-SMTP encrypted email system that leverages GNU Privacy Guard (PGP).

TOR-Links11.png

Daniel email service is a free anonymous email and XMPP service (limit of 25MB storage space). Encryption is not built into the service.

TOR-Links12.png

Elude is an email service with encrypted storage with a TOR only web client. Their accounts are completely anonymous, they allow you to purge your data completely if required and provide encryption.

TOR-Links13.png

I wrote a review about ProtonMail here and their well designed email service is also accessible via the TOR network. This is a very good option because unlike the other email services here, ProtonMail is a real company offering a professional service.

Social sites

TOR-Links14.png

Cyph Messenger is an open source video chat and file transfer app that uses a modified Signal messenger protocol enhanced with Quantum Resistant encryption (their claim).

TOR-Links15.png

Dread is a TOR Reddit clone that is used primarily as a drug market discussion and reviews forum.

TOR-Links16.png

Here is the Facebook TOR site.