how the fuck do you lock a porn folder on your computer?

h3n741.g33k

Registered
Sep 23, 2023
21
116
33
Points
163
My point was only that, once offline, there is absolutely ZERO protection from ACLs, Unix permissions or SELinux. Not "a little", not "a bit", not "you need to be in computer field". ZERO. A single call to "cacls" and it's done for good.

When online, you need at least an admin access (remote or local, it doesn't matter) to rummage into another user's files. It may not be a problem - for example, by getting an access in cache to a Kerberos admin token (bonus point if it's a domain admin one) - but it's not "immediate" as it can be on an offline disk, where you can even break into the admin account of the OFFline disk with a standard user account on the ONline system.

But you're right, it can also be done online. It's trickier, in particular if you have a capable administrator running the server you try to break in. But you need knowledge at least to do it.
While, with an offline disk, even a script kiddy can get EVERYTHING without being delayed by anything else than the time needed to propagate ACLs/permissions recursively on the whole disk.
yea I'm aware on offline. Point in highlighting low level backdoor and access even with OS online, was that this is tricker than when offline. As to offline, the sentance

High level restrictions only exist at the OS level.

This does imply non-functionality when OS is offline but it is a very subtle way of doing that, perhaps should have been more direct there.
 

Anon7483

Registered
Jan 10, 2023
1
202
141
Points
106
You're DENSE stupid, and ignorant to a fault. That's why I was saying, in my early messages, that you are a typical example of the Dunning-Kruger effect...
Thank you, very cool. Maybe you should go ahead and reread the post you replied to.

So for high level user access restriction control a) this can be bypassed at low level in minutes whether it is online or by an offline user with physical access to the terminal. --> [edit to a) in ( parentheticals) below:

(as in even when ur OS is running. Wis's explanation of live OS breakin, is 100% accurate. Ur drive is just pure data, if the OS is not running, 0 security methods employed by the OS apply. So unless you physically encrypt the data, everything is readable. PLUS cuz windows/mac are BS, RAM is NOT encryptable. So anything in the RAM cache be it VRAM or CPU RAM, its all directly callable at any time).

b) you do not need to technically access the contents of app data dirs to identify what programs they are for. You just need the path chain dir listing. While at low level it is not entirely open (though can be backdoor-ed and is why DRM shit is still a zero day hack). at low level, you can still view the file structure and names of these folders which is all you need.

Tidbits on VPN is not entirely related to veracrypt, yes, veracrypt is a software you can use to physically encrypt your drive. There are some issues to that itself, but that gets highly technical and we still seem to be having trouble communicating fundamental data security basics so that discussion is for another day.

Point with VPNs is that your data on device even if you have a "secure folder" through that client, its not actually encrypted on your device. It is only encrypted in data packet exchange over a network. This is why to make security effective you need 1) VPN for communication 2) method of physically encrypting partitions on the server/drive 3) as wis outlines, with internet identifier protocols req by law (imei, mac address, sim serial id, ip address etc) you need an additional method of hiding/disconnecting this identifier data.

4) ultimately, for "true-ish" security, you need to confine your activity to an encrypted remote server and or blockchain to truly hide connection data or to run the software of questionable content on such an encrypted remote server/blockchain. Plus, your connections to this and from that to the net, both need VPN + further(method, there are several) serial end user identifier metrics to be hidden on both ways for both your connection and the remote server/blockchain.

This way, the questionable content, is never actually on your actual device. And it is safely stored on an encrypted drive in a tertiary location.

As to ISPs and remote access help agents, on remote access I was speaking about the actual help agents. If you "lost your keys" and need to recover the data, a help agent is remote casted to your device to help you with data recovery. That was the remote access portion.

On ISPs, I was talking about the service providers of the client software itself. That if you go with an option such as a "sync-share-able" encrypted folder via VPN cloud services, not only can help agents get into this data, but anything stored on the "secure cloud" can be decrypted by the admins of the client software/cloud server database. But this is only with SOME such services.

The some such services in question, being "any" client provider that in ToS/docs states that "if you lose your keys we can still help you recover the data".

The other bane of the net, 60%+ of companies are fraudulent AF. Since most "encryption" software clients and VPNs are strictly proprietary in their algorythms and methods, there is actually 0 guarantee that your stuff is actually both a) encrypted at all and b) that the client provider does not have direct back door access to it through trade secret proprietart means (if the data is even properly encrypted).

on "properly encrypted" there is a difference between actual encryption, and just "sorting the data" so it appears encrypted. That gets into heavy maths on calculous so I'll just end that here.

A bit on TLDR side but like make more sense now?
Very much a TL;DR but no, users cannot access data from other users in Windows via the terminal while the OS is in use and ACLs are active. This includes both files and directories. VeraCrypt protects data at rest.

We weren't talking about VPNs or how they make (or don't make) "secure folders" at all. EFS is also native NTFS encryption. You are not installing client software, Windows is capable of it by default. Files encrypted with EFS are non-recoverable if you do not have the original key or the file in question was not created or accessed after a DRA was put in place, and especially if the attacker has neither administrator privileges nor access to the original environment.

Personally, I don't think data you don't physically control is secure. That being said, yes, a server hosted in a location with a non-reciprocal agreement would technically be one of the best options if you're in an unfriendly country as long as the right prerequisites are in place. It will be expensive.

VeraCrypt is FLOSS. VPNs use OpenVPN and WireGuard protocols, and there are FLOSS clients for both. The algorithms used are public.
 
Last edited:

Wisblade

Registered
Jan 22, 2023
0
23
27
Points
12
Thank you, very cool. Maybe you should go ahead and reread the post you replied to.
I've read it the first time, dude. And you're still wrong: ACLs don't work at "low level" - they operate several layers above what is truly "low level" in a mass-storage stack. As proof, ACLs aren't even a real thing if you don't use NTFS, for example. And it's exactly the same for Unix, obviously.

Everything related to isolation between users (including ACLs) is done, in fine, through a security token, because it would cost way too much time and CPU to check credentials each time. Obviously, the "normal way" to get one is to use credentials; therefore you'll need a login and password. But that's the "normal way", and, as I've already said it numerous times, you're definitively thinking too much inside the box to speak about security. I'll tell it another time: YOU MUST BE PARANOID TO CHECK SECURITY FEATURES. The problem lies not in the anticipated and expected threats, but rather in the unforeseen and/or unknown ones. Forget any already anticipated threat or problem, as it is precisely already foreseen. One must think outside the box, or for events classified as "improbable" or even "impossible".

But once you get a token, the process can use it to impersonate ANY access allowed by this token. Little by little, you may then obtain an admin's token, then a domain admin's one, and then, you're the king of the network. Because the "human factor" is such that most people do NOT reboot their computer once an admin came to unlock something they needed - whatever it was. Including through remote control - and there isn't ANY reliable way to do it, whatever protocol / software you can use. If you can get remote access to a computer, someone else can TOO. Full stop.

The "drama" here is that most computers aren't rebooted often, in particular servers, therefore the granted security tokens aren't flushed away. And most people (and even admins...) set their validity time to a way too long period: near 2 months isn't uncommon (2^32 milliseconds, in fact, so roughly 50 days).

To get back to thinking out of the box: that's why we use "dead man's switch" type of securities, for instance. Because death from a heart attack or an aneurysm is NOT a risk normally anticipated for a security position, since there are always TWO guards together... But both can die at the same time, either due to misfortune, or because of an attack! So, if the guards die suddenly, the alarm triggers a few minutes later, at worst. For the same reason, a train always defaults to applying brakes, and a constant action is required to allow its wheels to move: if the train driver dies, the train stops automatically a few kilometers further.

Applied to computer security, a dead man switch means something like UAC or start/stop validities - you ask for a security token, and you explicitely release it once you used it, with a default timeout set to a very short period, like 30 seconds at most. Because EVERYTHING done by user can be replayed by a process injecting messages/triggers inside other processes, excepted when something like the "Secure Desktop" used by UAC is triggered... And even that can be hacked, theoretically, if you managed to get inside kernel! It should rely on another CPU running a ROMmed software to be "perfect", this CPU being used to enable/disable physical address and data lines on the main CPU. Unfortunately, this cannot be done on a modular computer but exclusively on locked machines where access to peripherals is fixed by construction.

So, you CAN break into ACLs even on a live OS. And as I already proved, even your grandma can do it on an offline OS. OK, the trainee secretary can't. But you do realize that several people, including myself, are "a bit" above this level of competence regarding computers security?

Just for you to know: common OS are rated CC-EAL4. There are THREE levels above this one (and three below). You probably never encountered anything better than CC-EAL4, while in my domain, it's the MINIMUM rating, the one used for... non-critical display panels. We're not playing in the same league.

Very much a TL;DR but no, users cannot access data from other users in Windows via the terminal while the OS is in use and ACLs are active. This includes both files and directories. VeraCrypt protects data at rest.
Seriously, you're a complete joke, you know?

So, tell me: how the fuck can a ransomware infect and spread across a network, in this case? I'm using this example because, nowadays, it's the most common type of hack encountered...

And, for FLOSS software: who is responsible for their review and analysis? What are their qualifications? What is the deadline for submitting the analysis report? Is the code reviewed 100%? Is static analysis or, better yet, dynamic analysis used? Who takes responsibility for ensuring the safety of such software, and is there any guarantee? Code that is not reviewed by anyone, except malicious hackers, is by no means more reliable than proprietary code... I have seen more than enough bugs in "free" software to not have an exaggerated trust in them, especially when you can struggle to get any guarantee - be it in terms of corrections or diagnostic assistance!

One always gets what they pay for. If you pay nothing, draw your own conclusions, knowing that the engineers who worked on it, on the other hand, need to eat and have a roof over their heads.
 
  • Face Palm
Reactions: 1 user

rwolf

Registered
Jul 20, 2023
0
17
9
Points
7
so Microsoft basically removed the ability to password a folder on windows 10 because your account is already protected. the problem is that it's really not, physically anyone can access your computer. so I have a password when entering windows, but why can't I just bypass that by using safe mode and then removing the password? unless it can't be done (pretty sure it can and at most I just need to access my email) and let's say I encrypt a folder (properties allows this) it means that unless someone uses windows via my user, they will never be able to access that folder?

I often don't lock my computer (again, anyone can probably hack it like nothing, this isn't an iphone, pc's are super easy to hack if you have physical access) I would just prefer if no one finds the 75 mother milf daughter lesbian incest videos I have inside that folder. pretty sure it's not that bad tho, people probably have some really fucked up stuff saved on their computers XD

I know there is a script I can run that basically allows me to lock the folder by making it vanish and then show it again via the script exe by using a password. however it works on a single folder so if it has any more folders inside of it, it won't work as well. basically what I want is for anyone to try to open that folder and not be able to without a password, and that you can't just download a hacking app and gz folder is unlock after 5 minutes. I also don't want to zip/rar it with a password because then I can't keep using it without extracting it every single time. another problem is renpy games for example that show up as game saves inside user folder/appdata/roaming.

it is truly annoying how programs tend to spread all over the place instead of remaining in a single location.

p.s.

I don't want to hide the folder, that would be too simple of solution and I happen to like everything unlocked and shown for faster access.
VeraCrypt is the best in my opinion and open sores.
 
  • Like
Reactions: 1 users

Mr. Tearson

True Freedom is the Art of Creation
Staff member
Moderator
Game Uploader
Jan 28, 2023
37
673
1,080
Points
227
Alrighty, folks. That's enough. Seems like a few apples aren't getting along here, eh? No more insults or I'll be forced to do some clean up.

.
 
  • Like
Reactions: 1 user

h3n741.g33k

Registered
Sep 23, 2023
21
116
33
Points
163
Thank you, very cool. Maybe you should go ahead and reread the post you replied to.


Very much a TL;DR but no, users cannot access data from other users in Windows via the terminal while the OS is in use and ACLs are active. This includes both files and directories. VeraCrypt protects data at rest.

We weren't talking about VPNs or how they make (or don't make) "secure folders" at all. EFS is also native NTFS encryption. You are not installing client software, Windows is capable of it by default. Files encrypted with EFS are non-recoverable if you do not have the original key or the file in question was not created or accessed after a DRA was put in place, and especially if the attacker has neither administrator privileges nor access to the original environment.

Personally, I don't think data you don't physically control is secure. That being said, yes, a server hosted in a location with a non-reciprocal agreement would technically be one of the best options if you're in an unfriendly country as long as the right prerequisites are in place. It will be expensive.

VeraCrypt is FLOSS. VPNs use OpenVPN and WireGuard protocols, and there are FLOSS clients for both. The algorithms used are public.
um thats a lie. Administrator has direct access to all user data through regedit of the Hkey registry. While other users "do not have" administrative access, this can be subverted by manipulation of hkey registry through prompt while logged in.

further, using prompt from the log in screen through hack, anyone has access thanks to registry data system structure.
 

Anon7483

Registered
Jan 10, 2023
1
202
141
Points
106
um thats a lie. Administrator has direct access to all user data through regedit of the Hkey registry. While other users "do not have" administrative access, this can be subverted by manipulation of hkey registry through prompt while logged in.

further, using prompt from the log in screen through hack, anyone has access thanks to registry data system structure.
Users =/= Administrators. Can you tell me what's a lie, in particular?

Do you have any proofs for the latter two statements? You're going to have to show me how it's done.
 

Wisblade

Registered
Jan 22, 2023
0
23
27
Points
12
Users =/= Administrators. Can you tell me what's a lie, in particular?
You do understand that any user can become administrator by being added to the "Administrators" group? Or by being elevated through UAC? Or through "System" processes?

Do you have any proofs for the latter two statements? You're going to have to show me how it's done.
Do not reverse the burden of proof. It is well-known that ACLs are not free of flaws, so it is up to YOU to prove that it is, as you are the one advocating a viewpoint that is completely outside the state of the art and basic security rules.

We don't have to show you how to do it, especially since I've already done the exercise, and, as a good hairy troll, you carefully avoided responding on the subject afterward - including apologizing for saying bullshit.

There is absolutely NO "perfect system". But your position, i.e. trying to promote a flawed one, starts to be fucking annoying. You don't even have the "informed amateur" level on the subject of computer security, so stop pretending to be knowledgeable.
 
  • Thumbs Down
Reactions: 1 user

Donation drives

Lewdcorner Server

Support the continuation of lewdcorner without ads by contributing to our renewal costs.
Goal
$600.00
Earned
$325.00
This donation drive ends in
Donation Drive
Click one of these buttons to initiate donation.
Top Bottom