DoH update

 Support for DNS over HTTPS (DoH) in browsers has improved since I last researched it.

In "Brave", it is just a simple click to enable it.

 

For other browsers like "Firefox", you can refer to this link to enable DoH using "OpenDNS".

However, the "OpenDNS" option fails for some sites so I switched to "Cloudflare" instead.

DNS security on Android

 Android has come a long way. I only recently found out that I can define my own DNS settings instead of relying on my ISP's DNS servers which I don't trust to be secure enough.

Whilst my go-to DNS on "Desktops" is "OpenDNS" but it is not compatible with the "Private DNS Mode" in "Android". 

I am using the DNS offering from "Cloudflare" instead. "Google" is an option but do note that you will be surrendering even more information about your traffic to them.  

Easily access the section by searching DNS in "Android" then entering the DNS service's hostname that you want to use into the "Private DNS provider hostname" field. 

Why "Ubuntu"?

I was asked recently why I use "Ubuntu" instead of "Windows". 

I was casually playing around with "Ubuntu" since version 7.10 but what pushed me to seriously switch full-time was the anger over being forced to fork out money in a short span of time to upgrade to "Snow Leopard" and "Windows 7".

Version 8.04 LTS was so reliable for 3 years and there was no turning back.

There's also a trove of tools that are native to Linux that I use personally and for work. There's all sorts of "commandlinefu" that you can perform from the "Terminal".  

And yes... "Ubuntu" is free.

 

Latest "extension"

 Been awhile since I've updated on what useful privacy "extensions" that I use in "Firefox". "HTTPS Everywhere" and "uBlock Origin" I've used for years but "Adnauseam" is a new one.

Batch DNSSEC check

 Wrote a simple Shell script that can check if a list of URLs have DNSSEC enabled.

 

#!/bin/bash
## Set variables ##
_now=$(date +"%m_%d_%Y")

## Curl Sidn Labs API ##
while IFS= read -r line; do
    curl http://portfolio.sidnlabs.nl/check/$line >> "dnsseccheck_$_now.txt"
done < dnstargets.txt
cat "dnsseccheck_$_now.txt"


##Please edit "dnstargets.txt" in current folder.
##Results will be stored in current folder.
##Written by commandrine.
##Last updated on 6 Apr 2021.

"sslyze" on "Ubuntu"

 I have used "sslyze" primarily on "Windows" and I figured it was time to use it on "Ubuntu".

Wrote a "shell script" to run on "Ubuntu".

#!/bin/bash
## Get current date ##
_now=$(date +"%m_%d_%Y")
sudo python3 -m sslyze --update_trust_stores
sudo python3 -m sslyze --regular --targets_in=targets.txt > "sslyze_$_now.txt"
sudo cat "sslyze_$_now.txt"
#sslyze script to run on Ubuntu.
#Please edit "targets.txt" in current folder.
#Results will be stored in current folder.
#Written by commandrine.
#Last updated on 23 Nov 2020.

"DNS over HTTPS"

I've always liked "Firefox" but been using "Chrome" and "Brave" more in recent times. I may just go back to "Firefox" with their latest feature "DNS over HTTPS".
You can enable it from "Network Settings".

DNSSEC check

Was recently triggered to research how to verify if a domain has DNSSEC enabled.
The manual way would be to run a "dig" command to query the domain you want to check but the DNS server you query has to support DNSSEC.

Plan B was using an API provided by SIDN Labs. You can leverage their API by running a "curl" command as seen below. Any status other than "secure" is bad.

This method is tedious if you want to check multiple domains. Alternatively, you can populate a CSV file with the domains you want to check and upload them to SIDN Labs using this form. I replicated the form below.

DNSSEC check form

Upload the CSV containing the domains you want to test using SIDN Lab's API.

Log review

Wrote a simple script to aid with log review using keywords. You can use the below by substituting the keywords as well as log source.

#!/bin/bash
grep "Authentication fail" /mnt/c/monthly/app.log > /mnt/c/monthly/app-fail.txt
grep "Authentication fail" /mnt/c/monthly/os.log > /mnt/c/monthly/os-fail.txt

Bash on Windows

The day has finally arrived where I can run Linux commands on Windows. This is way better with the ability to run comands like "grep".

Set up Bash on Windows and you are ready to go.

Privacy update

Been awhile since I've posted. Not as paranoid as I used to be but still cautious and thus I have 2 new tools to recommend.
I use Brave browser more nowadays because it is built with privacy in mind. However, I installed uBlock Origin plugins for Chrome and Firefox when not on Brave.