Skip to main content

Johan Bové

Johan Bové

Johan Bové

Johan Bové

Got again a nice A+ score from Mozilla Observatory tester for my https://johanbove.info site after fixing issues with the Strict-Transport-Security header and the inline styles content security policy using base256 hashes

Johan Bové

Before You Turn On Two-Factor Authentication…

Many online accounts allow you to supplement your password with a second form of identification, which can prevent some prevalent attacks. internet, security, syndicated

Johan Bové

Technology Preview for secure value recovery

At Signal, we want to make privacy simple. From the beginning, we’ve designed Signal so that your information is in your hands rather than ours. Technologies like Signal Protocol secure your messages so that they are never visible by anyone but you and the intended recipients. security, signal, social media, syndicated

Johan Bové

My reasons to support the Gemini Internet Protocol

3 min read

Why do I believe Gemini is great for personal Internet presences? First of all, it's a real grass-roots initiative which I am very excited about.

If you're reading this, chances are high you are already using Gemini. But for history reasons and to share my opinions of Gemini I would like to offer you here some views of mine.

Collecting some of the strong-points of Gemini from my perspective of having some experience with Gopher and running personal websites.

Fast and lightweight

  • It's very easy on the system resources. So the protocol works really well on slower hardware without any problems. Hosting on a Raspberry Pi3 is easy-peasy.
  • Since there are no fancy design in Gemini capsules, it is really optimized for low bandwidth.
  • It should work really fine on a feature-phone, like for KaiOS. I don't believe there is a client yet for KaiOs at this time.
  • It's fairly easy to build clients and servers for the protocol.

Simple yet complete

  • The specifications provide enough functionality to do basically what you would expect to be able to do online.
  • Much lower learning curve compared to Gopher and HTML. You can start publishing Gemini pages within minutes.
  • Even-though the syntax is limited, it still gives enough playroom for creative expression.
  • Use of TLS certificates promises security and privacy.
  • It is more international than US-centric Gopher.
  • The procol supports the UTF-8 character set so any language can be used to publish sites in.
  • This should help make the protocol more popular in non-ascii wielding regions in the World.

Easy to publish

  • Content will be probably first of all stored in static text files which are future-proof and easy to maintain.
  • Many servers already available that require minimal technical skills.
  • Yes, you still need a server, but there are many collectives which you can join to facilitate this.

Focus

  • No popups, animations, videos, sound effects.
  • Focus on actual content instead of fluff and effects.
  • No advertisemens and commercial tracking.
  • No Facebook, Google or Twitter.

Accessible

  • Power of formatting goes into the clients or readers. Like in the good old days of the early Web, people are expected to style the content to their own liking.
  • It's pure text, has simple navigation rules, so should be great for people with disabilities.
  • No JavaScript so you really see what you get.

And on top of this, the young Gemini community is driven to make this a success!

I'm sold.

ps. I published this first in plain text on my Gemini capsule and now that I copy paste this into a HTML document I can really tell just how easy it is to publish on Gemini.

Johan Bové

How hackers steal your keys and secrets

After hunting for security bugs I've realized clients I’m working with are not familiar enough (or at all) with basic “hacking” techniques. API keys, passwords, SSH encrypted keys, and certificates are all great mechanisms of protection, as long they are kept secret. javascript, node.js, programming, security, syndicated, web dev

Johan Bové

It's 2020 so not only is your mouse config tool a Node.JS Electron app, it's also pwnable by an evil webpage

Earlier this year, peripheral maker Kensington patched its desktop software to close a vulnerability that could have been exploited by malicious websites to quietly hijack victims' computers. node.js, security, syndicated

Johan Bové

Element secure messenger review

Element is another encrypted chat app for the security conscious to consider, offering not just end-to-end encryption but also decentralized storage, so your message data isn't held in one place by one company – you can even set up your own server, if you want to. decentralization, internet, matrix, syndicated, tech

Johan Bové

4 ways to send encrypted messages on Android

At some point in your mobile life, you're going to need to send an encrypted message. Whether it's mission-critical, sensitive business data, personal information, or a secret family recipe, the need to hide that information away in an encrypted missive will come to the fore. decentralization, encryption, internet, security, syndicated

Johan Bové

DiceKeys creates a master password for life with one roll

Modern cybersecurity, done with properly paranoid best practices, requires meeting some tough demands: Carry a physical two-factor key to plug in and authenticate yourself on a new computer, but if you lose or break that tiny piece of plastic you could be locked out of your accounts. dicekey, passwords, security, syndicated

Johan Bové

How to fix target=”_blank” links: a security and performance issue in web pages

Almost every web page has links which open in a new tab leaving the other web page still available. For example, news agencies will tweet about recent events on Twitter: the tweet contains a short description of the article and a link to see the full story on their web page. internet, javascript, security, syndicated, web

Johan Bové

Contact-less cash in the Real World?

How to hand out cash contact-less?

4 min read

Got a SwatchPay watch developed by Swatch and G+D Mobile Security, the other Saturday as a father’s day gift. I activated the payment function today using the Boon Virtual Debet Card I had registered for some months ago. Since WireCard in Germany is filing for bankrupcy there was some confusion and uncertainty.

The nice people at the Düsseldorf @Swatch store had to verify that it would work. It did. Some time later I paid contact-less for lunch with my new watch. Pretty sleek and COVID - safe.

Being able to pay contact-less is pretty great. But people on the street who depend on small change donations are really left out. I simply don’t carry cash and coins anymore with me. My credit-card size wallet also attest for that.

So how could we give small-change using a contact-less cash system? Similar to how in China vagrants use Alibaba Pay QR codes to beg for a small contribution on the street.

How would that work with a system that relies on NFC like SwatchPay? Give everyone who needs it access to NFC readers? What is the cheapest, most battery-efficient, weather-proof, solar-powered NFC reader payment terminal you know of?

It would have to be a system that works offline, but where the collections can be transfered into a system that exchanges for actual cash or exchange for food and clothes or shelter. People who have no identification should also still be able to use this system. The reader would have to taken care of as if it was actual cash.

How can we digitalize small-change donations in Germany where a large part of the population, luckily, still trusts cash in the hand more than electronic payment systems?

So the best solution is that we would reverse the devices. The people on the street all get “SwatchPay - like” watches or a similar thing like a card. They work without a battery, need only to be registered once. Then it would be up to everyone else to use their phones, or a portable NCF payments-capable device, to initialize the donation transaction. There would be an app for that. Just like the existing Boon or SwatchPay apps.

Instead of paying, we would be giving.

How much technology is inside the SwatchPay watches? It’s an NFC tag chip, similar to the ones we all have on our bank and credit cards.

How SwatchPay! Works (source)
Payments are made possible by the NFC chip, which is located on the back of the case. In a ring around the bezel, the watch has an antenna that catches the radiation, connecting the chip with the payment terminal. This is exactly the same technology as your bank card uses. You can activate your watch with your internet banking system. Setting this up costs about ten minutes. SwatchPAY! uses a method they call tokenization, which creates a unique “token” for the device. Simply store your credit or prepaid card on your smartwatch via the app (activation of SwatchPAY! watch in Swatch store) – the app is available for iOS and Android.

More insights in the tokenization can be found in the PDF: SwatchPay case-study by G+D Mobile Security.

Giesecke+Devrient Mobile Security is a company based in Munich, Germany

I’m not an engineer or have really investigated fully into the technical side of this, but the logic seems sound. What if we could tokenize everything this way?

And how we would avoid abuse is a whole different level of challenges to look into.

Johan Bové

Power in the Age of the Feudal Internet

PROPOSITION Bruce Schneier, Cryptographer and Computer Security Specialist and Author of Liars and Outliers: Enabling the Trust Society Needs to Thrive We’re in the middle of an epic battle for power in cyberspace.

Johan Bové

„ Your organization's data cannot be pasted here.“ is one of these corporate IT „security considerations“ that are imho useless - I can still make a screenshot- and only causes friction and employee unhappiness.

Johan Bové

Johan Bové

Johan Bové

My Known "Content-Security-Policy" htaccess configuration

2 min read

My current Known .htaccess Content-Security-Policy is full of tool urls.


<IfModule mod_headers.c>
Header set Content-Security-Policy: "default-src 'self'; frame-ancestors 'self' https://www.youtube-nocookie.com https://player.vimeo.com; base-uri 'self'; form-action 'self' https://www.brid.gy https://indieauth.com/ https://monocle.p3k.io/ https://aperture.p3k.io https://indigenous.abode.pub https://alltogethernow.io https://quill.p3k.io; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https: data:; media-src *; worker-src 'self' https; font-src *; connect-src 'self'; frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
    Header set X-Content-Security-Policy: "default-src 'self'; frame-ancestors 'self' https://www.youtube-nocookie.com https://player.vimeo.com; base-uri 'self'; form-action 'self' https://www.brid.gy https://indieauth.com/ https://monocle.p3k.io/ https://aperture.p3k.io https://indigenous.abode.pub https://alltogethernow.io https://quill.p3k.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https: data:; media-src *; worker-src 'self' https; font-src *; connect-src 'self'; frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
    Header set X-WebKit-CSP: "default-src 'self'; frame-ancestors 'self' https://www.youtube-nocookie.com https://player.vimeo.com; base-uri 'self'; form-action 'self' https://www.brid.gy https://indieauth.com/ https://monocle.p3k.io/ https://aperture.p3k.io https://indigenous.abode.pub https://alltogethernow.io https://quill.p3k.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https: data:; media-src https:; worker-src 'self' https; font-src *; connect-src 'self'; frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
</IfModule>

Johan Bové

Replied to a post on github.com :

@mapkyca How is HSTS involved in this? Are you referring to HTTP Strict Transport Security?