A virtual private network (VPN) may confuse some people. At it's core, a VPN is a private network that is made available to authorized users from the internet. Examples of a private network would be the network at your work, at college, or government locations.
Those networks have internet access, but the internet does not have access to them, hence the term private network. The private network becomes virtual when you are able to access it from the internet. The internet still does not have access to the private network, but your computer does. As far as the private network is concerned, your computer connection is at work or school.
When you connect to a VPN, you are connecting to a set of servers over the internet. This process is known as tunneling. Anything you do on the internet will go through these servers. All of this data is encrypted, which provides great privacy for you.
As far as your internet service provider knows, you're connecting to some IP address. They cannot see what the data is or anything.
The most important, and obvious, reason is security. As we stated above, all of your internet data is encrypted once you have created that tunnel. Hackers, for example, would not be able to intercept your internet browsing activity. Hackers will often attempt to do this when you use public WiFi in places like coffee shops and airports. If you make a purchase with your credit card on public WiFi, hackers could get a hold of your credit card number. This is why you should use a VPN.
A secondary benefit, which ties into security, is privacy. Because all traffic is encrypted, all data secure and private. What you search for, watch, read, or listen to is your own business. You ISP and hackers will not know what you are doing online.
VPNs will not, however, protect you from tracking by various website trackers, such as cookies.
VPN provides encryption to network traffic. It ensures the communication cannot be easily eavesdropped/tampered with by adversaries. It does not impact application features like cookies. So yes cookies can still be set on your browser if you are tunneled through VPN.
Ximning Ou from the University of Southern Florida
In order to prevent these tracking efforts, you can surf the web with your browser's incognito/private mode. Another option would be to install an extension that prevents this, like ghostery.
Another reason for using a VPN? Virtual locations. Many providers will have servers in multiple locations. This was an option many Netflix users chose to access content that was not available in their region. Just because content has a block in your country, does not mean it is in another country. All you need to do is tunnel into a VPN server in a country that does not have the block, and you will have access.
The same works in reverse too. For example, you're traveling out of the country but your bank blocks access to users outside of your homeland. You can use your VPN to tunnel to a server located back home to gain access.
On a side note, just because using VPN allows your to potentially bypass restrictions, do not forget you are still operating under your countries laws. VPNs will make you anonymous online, not invisible. If you start doing anything illegal or suspicious. Given enough time and resources, government agencies could, in theory, still find you.
Today, there are tons of VPN providers to choose from. Some providers are great, some are not. Below are some things to consider when choosing a VPN provider:
One of the biggest drawbacks is internet speed. Depending on the provider, you will see reduced internet speeds. Sometimes, the reduction is small, other times its large. It all depends on the number of users connected to the same server as you, the location of the server, and the providers setup. Longer distances between you and your VPN server means longer distances for data to travel in order to reach to the internet.
A secondary, and minor, issue is that when you use a VPN as a virtual location, you can see some issues while shopping. Say you live in the US, but have a connection through a tunnel in the UK. While shopping online, your pricing may show in pounds instead of US dollars. The simple solution is to use a server in your country while shopping online.
Using a VPN is becoming more of a necessity each day. The krack attack has proven that access to home WiFi traffic can occur. Connecting to a VPN service protects you from this vulnerability. Ensuring you have a good VPN provider will help ensure you are better protected.
It is time to take a moment for a good old fashion Public Service Announcement. The New York Times posted an article a while back about fake tech support scams. These are not new and something we, here at QCTechJunkie, have been very much aware of. But, the article in The New York Times did provide some very interesting insights into the evolution of fake tech support scams. We strongly suggest you take a moment to read it. If you are pressed for time, here's are basic run down of fake tech support scams:
Everyone has experienced this routine. A window pops up onto your computer screen, usually while browsing the web. The screen tells you that your computer is infected and offers up some technical support to help resolve the issue, "just click here."
Over time this routine has evolved into various other routines. A chat window on a web page, an email, a phone call, a text message, and the list goes on. Everyone has or will experience one of these "alerts." We are here to tell you that 99% of the time, there is nothing wrong with your computer. Customer support or technical support will never, ever, call/email/text/pop-up you first. They will only contact you once you have contacted them first.
Take a moment to think about it, please. For example, Microsoft and Apple are huge companies with millions of customers. There is no financially sound, ethical, and, most likely, legal solution to monitor, report, and resolve issues of each individual customer's device. It is just just not possible. If something is wrong with your device, you will most likely know. And if you want help, then you will have to do the work to get help. Calling tech support, waiting on hold, explain the issue, explain your troubleshooting steps, and work through their troubleshooting steps.
Take the above photo from Microsoft. The scammer cannot even take the time to imitate Microsoft properly. It's a generic windows with a ton of "Scary" sounding words. That's a big red flag all in it's own.
This is the most simple section for us to write... Just ignore it. Mark the emails as spam so it get's reported. Also, ignore unknown number phone calls, delete unknown number text messages, close the browser tab, the list goes on. Doing nothing and ignoring them is the best thing to do.
Deleting your personal data, like web searches, can be a daunting activity. You need to take it seriously. If you do not, then other people have the potential to find that data. Below, we break down how to better delete your personal data.
We have all been here, you're selling an old phone or tablet, or donating it to someone or some place. Regardless, the device is will no longer be in your possession. Because of this you want to be 100% sure everything is gone from said device. No body wants to find out their Facebook account was accessed from an old device being used by someone else.
Thankfully, most smartphones have made it relatively easy to securely wipe data from them. As long as your data has been encrypted, your data is protected. Most Android and iOS devices are encrypted right out of the box. Because your data is encrypted, factory resets make it almost impossible for any data to be recovered. Here's how your factory reset your devices:
Note: For either device, make sure you have all of your photos, music, or anything else backed up and securely stored somewhere.
Windows and macOS make securely wiping your pc or laptop easier, and more secure, than it used to be. By default, Windows 10 does not encrypt your data. The upside, Windows 10 can securely erase your files during a reset. Meaning that recovery programs will not be able to grab any data after the reset.
By default, OS X Yosemite and newer will encrypt Mac's with a tool called FileVault. Make sure this feature is running via Apple > System Preferences >Security & Privacy > FileVault. Enable this encryption if it is not already enabled. Once encrypted your data will be impossible to recover after a full reset.
Going through every web account and how to delete it is an impossible task. Therefore, we can provide you with some general guidelines on what you should do though. Most websites will maintain your data, post delete, for 90 or more days.
Google maintains a lot of data about you. Thankfully they provide you that data via your My Activity page. From this page you can adjust various data logging levels by clicking Activiy Controls. Lastly, clicking Delete Activity will take you a page where you can choose what data you want deleted from your account. If you choose to delete everything, make sure to get a copy of your data from Google Takeout.
Apple also makes things pretty painless for deleting your data they have collected. Simply go online, sign into your Apple ID account, click Request to Delete Your Account, read through the disclaimer, and confirm your choice to delete the account.
PCs, laptops, phones, tablets, and social media accounts are not the only areas that have collected personal data from you. For example, smart home speakers, like Amazon Echo or Google Home, collect data on you as well. The data Google Home collects can delete be delete from the same My Activity page we wrote about earlier. Amazon will allow you to delete your Echo's voice recordings from your Amazon Devices page.
Cloud Storage services, like Dropbox, will probably keep copies of deleted files in case you need them at some point in the future. Features like this are great when you need to recover something you realize you still need. However, this feature is not great if someone gains access to your account, because they can easily go digging around and recover those files as well. In the end, if you have something sensitive that you need to delete, especially from cloud storage, you need to make sure it's actually deleted.
Unlike Dropbox, Google Drive allows you to permanently delete multiple files or all of your deleted files.
Empty your entire trash
Delete an individual file forever
OneDrive, like many cloud storage services, will store deleted files in a Recycle Bin. From there you can restore files, if you need to. You can select Recycle bin in the OneDrive left side navigation
Regardless of the device or web account or service, it is always a good idea to make sure your data is deleted properly. We have only listed a handful of examples and how to delete your data properly. A simple web search should help you figure out the best route for deleting your data from whatever device, account, or service you use. If anything, you will learn more about the data you leave behind, something you do with out realizing it. Trust us, it's worth the extra effort to protect yourself and your data from leaking out into the wrong hands.
SplashData compiles over 5 million passwords, that have leaked online, from 2018. From that data, they are able to build a list of the top 25 most used passwords of 2018. The sad part? The top two passwords have been the same top two passwords for five years now. No one should ever use "123456" or "password" and yet millions of people do.
We will note that several of the top 25 passwords are repeats from previous years, though their use has varied from year to year. One upside to all this data? There are a few new passwords on the list.
Sorry, Mr. President, but this is not fake news – using your name or any common name as a password is a dangerous decision. Hackers have great success using celebrity names, terms from pop culture and sports, and simple keyboard patterns to break into accounts online because they know so many people are using those easy-to-remember combinations. Our hope by publishing this list each year is to convince people to take steps to protect themselves online,” Slain said. “It’s a real head-scratcher that with all the risks known, and with so many highly publicized hacks such as Marriott and the National Republican Congressional Committee, that people continue putting themselves at such risk year-after-year.
- Morgan Slain, CEO of SplashData
This list is to help raise awareness for internet users on adapting better security measure, like stronger passwords. Strong passwords do not guarantee better online safety, but they do increase it. If you use a password that is on this list, you are just asking to be hacked.
1. 123456 - Unchanged 2. password - Unchanged 3. 123456789 - Up 3 from 2017 4. 12345678 - Down 1 from 2017 5. 12345 - Unchanged 6. 111111 - New for 2018 7. 1234567 - Up 1 from 2017 8. sunshine - New for 2018 9. qwerty - Down 5 from 2017 10. iloveyou - Unchanged 11. princess - New for 2018 12. admin - Down 1 from 2017 13. welcome - Down 1 from 2017 14. 666666 - New for 2018 15. abc123 - Unchanged 16. football - Down 7 from 2017 17. 123123 - Unchanged 18. monkey - Down 5 from 2017 19. 654321 - New for 2018 20. !@#$%^&* - New for 2018 21. charlie - New for 2018 22. aa123456 - New for 2018 23. donald - New for 2018 24. password1 - New for 2018 25. qwerty123 - New for 2018
Nearly everything on the Internet starts with a DNS request. DNS is the Internet’s directory. Click on a link, open an app, send an email and the first thing your device does is ask the directory: Where can I find this?
Unfortunately, by default, DNS is usually slow and insecure. Your ISP, and anyone else listening in on the Internet, can see every site you visit and every app you use — even if their content is encrypted. Creepily, some DNS providers sell data about your Internet activity or use it target you with ads.
On April Fool's Day of 2018 Cloudflare announced their brand-new DNS service. The statement above explains the importance of having a good DNS service. Not all DNS providers are created equal. Cloudflare's DNS service is almost 20ms faster than Google's DNS service. We here at QCTechJunkie have updated all of our devices to use Cloudflare over Google. And there is no real reason why you should not at least try Cloudflare's DNS yourself.
One reason to use Cloudflare's DNS, over the one your ISP probably has you using, is for data privacy. According to Cloudflare:
We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we’re doing what we say.
Frankly, we don’t want to know what you do on the Internet—it’s none of our business—and we’ve taken the technical steps to ensure we can’t.
Setup is easy, as long as you know where to look. In fact Cloudflare will recognize the device you are on when you go to https://1.1.1.1/. From there they will provide you with basic instructions to setup up your device to use their service. But, why do that when we will cover the major four platforms for you right here:
Windows
MacOS
Android
iPhone
If you want to make things easier for all your devices on your home network, you can configure your router to use Cloudflare's DNS. Doing this will eliminate the need to configure each device on your home network. Below is the general setup for most routers:
Note: Configurations for your router maybe different, consult your routers owners manual for more information.
Password managers are great for everyone. They can help generate stronger passwords and keep track of them for you. But, many password managers do more than that. 1Password is our prefered password manager, but Lastpass work great too! Both of these programs can also double as a digital safe box too.
First off, you should already be using one. If not, then you need to get one. You should be storing all of your usernames and passwords for all of your online accounts in a password manager. No two passwords should be the same. Additionally, you should be storing all of your "truthful" security question answers as well.
Your online passwords and answers are not the only thing you can and need to keep secure. You can store Wi-Fi passwords in your password manager too. Here some additional items, not a complete list, you can store in your password manager:
This list is not all encompassing. But, they can give you an idea of all the ways you can use your password manager to store important information.
Undoubtedly, some of the passwords for you accounts will be for accounts others in your household will need to use. Router credentials, the account for utilities, maybe even Netflix login information. Sharing this information is important, especially when you use long complex passwords. Here are the basics of sharing information in Lasspass and 1Password:
Connected devices in our home is common place, and the number of those connected devices in our home is growing. This means there are a growing number of opportunities for someone to access your home network and your devices on that network. Because of this we want to take a moment to go over some steps you can take to help make your home's smart devices safer and more secure.
Please keep in mind there is an ever growing array of smart home devices, we cannot go over specifics for each gadget. One general rule of thumb is to go through the device's documentation for initial security precautions. If your device does not have a guide, double check the manufacture's website.
Windows and macOS do a great job and downloading and installing updates. Most smart home gadgets do not. There are many reason why this could be or by default the devices does not need internet access, just access to devices on your home network.
This, ultimately, means it is on you to keep track of devices updates. This can be a pain when you have a lot of devices to deal with, but it is worth it in the end in order to safe guard your home network and the devices connected to it. Checking for updates for your smart devices can happen through the smartphone app for the device, if there is one, or by checking the manufacturer's website.
For a lot of smart home devices, updates will not release on a regular basis, unless a security exploit crops up. So, setup a schedule to sit down and run through checking for updates on all your devices. Doing this, at least, once a month is a good starting point.
If your smart home device does have an update, it could take a few steps to install. Some devices require you to connect it to your computer, which are usually for devices that do not have access to the internet. Other devices will allow you to update them via Bluetooth with an application on your phone.
An update routine extends to all of your electronics in your home, not just smart devices. Check for updates for you computers, phones, TVs, sound bars, and especially routers. Routers these days are doing better at alerting you an update is available, provided you log into their admin page. Most manufacture websites will tell you if there are updates and how you can update your devices.
Technology today is very much set it and forget. It is very nice to get up and running with new devices and then never have to worry about them. But, often some of the default settings can be too relaxed on security. We recommend that if your device has a settings menu, that you go through each option. If there are settings you are not familiar with, then check the manufactures websites for a better explanation on what the setting does.
Some key settings to look out for:
Once again, this routine should extend to all of your household devices. If the device or account to access your device offers two-step verification, enabled it. Also, if your device sends you notifications, like a security camera, to an email account, make sure you have a strong password for that email account. If a hacker gains access to your email, they could potentially see security snapshots and be able to determine when you are home or not.
Sticking with bigger name companies for your smart home gear does have it's benefits, even though they cost more. Samsung and LG can still be hacked just as the next company, but they at least have the resources to fix flaws in their devices if one is found. Newer or smaller companies, though having cheaper devices, may not ever fix found flaws or support could hard to work with when you run into issues. Devices that do not have a clear way of getting a hold of support is usually a sign that they probably will not fix security flaws in their devices.
In this day and age, we see many innovating smart devices, thanks to sites like Kickstarter and Indiegogo. Always do your research when buying into these products. Look into the company and see what security measures they have in place for the device you are thinking of purchasing.
Keep in mind many new companies have a habit of starting out with a bang but then disappearing just as fast as they exploded onto the market. The last thing you want is a smart lock or voice-activated device, that does not function anymore.
Because of the reasons stated above, it is best to get devices that all fall under the same umbrella. By limiting the number of smart home platforms you install in your home, you limit your exposure to attacks. Some smart home umbrellas include:
Once you have picked a system, we recommend you find products that work within that system. Some systems, like Samsung SmartThings and Google Home, will work with each other. But, that is not always the case.
Now, if you already have a miss mash of smart home devices, trying to get your setup under one or two umbrella's could prove difficult. Luckily, BullGuard’s Internet of Things Scanner is handy at helping to determine if any of your smart home devices are on the Shodan site. Shodan is a search site that scans the internet for any network device that is publicly accessible. Basically, if you find one of your devices is listed on that site, then someone could hack into it, so disconnect that device from the internet immediately. Then, check for updates and your security setting for that device.
The router in your home is the gate keeper to everything connected to the internet in your home. Smart devices, computers, mobile phones, game systems. Keeping it secure is the key to improving your home network security. The big three things you need to do are:
For example, you have a Roku plugged into your TV. The TV may have smart features as well, but they will not be as useful as the Roku is. Because of this, your TV does not need to be connected to the internet, at least not all of the TV. Remember today's TVs will get firmware updates that might fix issues, so it's good to have it connect to the internet every now and then to check for updates.
One special note about all devices that need internet access, be cautious about devices that prompt you to automatically configure your router for you. They do not need access to do that, so do not give that device the username and password to your router's settings menu. Additionally, most router's these days have a list of devices that are connected to your router, which you can control internet access too or block from your network.
Router's are getting better at keeping themselves up-to-date, but you still have to do some manual work. But, if you find that your router is not getting updates or the last update is already years old, it might be time upgrade. Today, many routers are built with smart home security in mind. Many will monitor your device's network traffic and will block common routes used by hackers and malware. Some will even go as far as blocking devices that appear to have poor security settings. Two routers we recommend, that have these features, are the Asus Blue Cave ($170) or the Luma Whole Home WiFi (3-Pack) ($135). If you rent a router from your Internet Service Provider, make sure to ask them for an upgraded router. But really, you're better off using your own router.
There are also devices you can purchase that are dedicated to just monitoring your smart home for vulnerabilities. These are nice options if you do not want to upgrade your router. Some of these devices are:
We will note that a lot of these devices have not ample third party testing. So, the claims made by the manufacture are just that, with no solid user proof to back them up. You are more then welcome to try them out, bu do so with caution. If you are using a device listed above, then leave some comments below on your experiences.
In the end, the best protection of your devices is to keep them up to date. Check for software/firmware updates, password protect them, if available, and make sure they are hard passwords.
When signing up for online bank accounts, new email addresses, or health insurance accounts, they all ask you or force you into using security questions to add an extra layer of protection to your account. The problem is that most these security questions are not very secure. The most common question is "Your mother's maiden name" and one that is easy to guess or research. In fact, if someone gains the correct access to your personal information, it can affect you credit score.
With that, we urge everyone to take matters into your own hands and make security questions more secure. How do you do that? Well, security questions often ask you questions about your life. This is information anyone can potentially figure out from your social media accounts or data breaches, like the Equifax hack. With all of that data online, figuring out the first car you bought, street you lived on when you were a kid, or favorite hobby can be easy. Basically, answering truthfully is a bad idea. Below is the best suggestion to make security questions more secure for you.
Seriously, just flat our lie on the answers. First car? List your favorite plane, boat, or motorcycle. First grade teacher? Use the name of your favorite pet or the most disagreeable phrase to describe your first grade teacher, like garbage dump. The point is, as long as the data is not common knowledge, something not searchable online or via your social media, it's a good answer. Incorrect answers are inherently more secure than truthful answers.
Here's the problem with using incorrect answers, it can be hard to keep track of all of those answers. We use 1Password to store all our passwords and security answers here in our daily lives. A password manager is an essential tool in today's world, assisting you in storing all of you passwords securely and helping you to create more secure passwords. Honestly, if you have a password manager, have it generate your "incorrect" security question answers. #$Adke@A is a much harder answer to guess than Jennifer, even though neither are the actual name of your high school prom date.
But what about security questions that have canned answers? Well, you still lie! Just note those answers in your password manager. If they give you an option to create a custom answer in addition to canned answers, then choose that option and create your random answer.
Stay safe out there!
Your Synology NAS comes with web hosting features. With Web Station you can easily host and publish your own website with Virtual Host support and additional HTTP/HTTPS settings for each single instance. You can also select the back-end server and PHP settings for each Virtual Host created. This allows you to create dynamic, database-driven websites for your personal use or business.
The problem users might run into with running WordPress on Synology, is folder permissions. By default, the Synology packaged version of WordPress will work just fine. But if you run multiple versions, you will get alerts to setup FTP settings in order to download, install, and update your WordPress plugins, themes, and core updates.
Never fear, I have a solution. Just follow the simple steps below.
Enable via Control Panel > Terminal & SNMP > Terminal. This allows your Synology NAS to support Telnet and SSH command-line interface services. You can also change the security level of the SSH encryption algorithm.
To enable Telnet/SSH service:
For system security reasons, Synology limted access to root. If you need to get the root permission, you will need to log in to your DSM in the command line interface , via PuTTY with any account credentials belonging to the Administrators group, and then run the sudo -i command to switch to root access.
Below is an example of the steps to get root access to a Synology NAS:
Synology Web Station uses a special HTTP user for it's default web folders, including it's WordPress package. If you create your own folders, like for multiple WordPress sites, the system will use your permissions instead. This is what causes the issues with installing/updating plugins, themes and WordPress. Now that you are logged into your Synology via Terminal/SSH, you can navigate to the systems WEB folder and update all of your WordPress folders and files.
Below is an example of the steps to update your WordPress folder Permissions:
Continue to use the above steps for all of your WordPress folders. This will effectively resolve the issues with WordPress prompting you to setup FTP in order to install/update plugins, themes, and WordPress.
