#security

https://lobste.rs/s/cd5gdk/i_got_targeted_trying_get_your

good alternative to enpass / birwarden?

good detailed how to for exit nodes. prob worth it!

tldr emailing a six digit code is a good option, as encouraging clicking a link is bad and more importantly the place the person gets the email is often different to where they want to login, eg phone for email, laptop for sign in to app, or worse the phone just authenticates in its in-app browser

Tailscale VPN alternative. recommended. used at Neptune

https://news.ycombinator.com/item?id=45103065

Good advice in top comment: Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN providers partner with local orgs who can figure out the safest and most efficient ways to distribute a VPN package in countries at risk of censorship or undergoing censorship. - Once you've got the software, you should try to use it with an obfuscation layer. Obfs4proxy is a popular tool here, and relies on a pre-shared key to make traffic look like nothing special. IIRC it also hides the VPN handshake. This isn't a perfectly secure model, but it's good enough to defeat most DPI setups. Another option is Shapeshifter, from Operator (https://github.com/OperatorFoundation). Or, in general, anything that uses pluggable transports. While it's a niche technology, it's quite useful in your case. In both cases, the VPN provider must provide support for these protocols. - The toughest step long term is not getting caught using a VPN. By its nature, long-term statistical analysis will often reveal a VPN connection regardless of obfuscation and masking (and this approach can be cheaper to support than DPI by a state actor). I don't know the situation on the ground in Indonesia, so I won't speculate about what the best way to avoid this would be, long-term. I will endorse Mullvad as a trustworthy and technically competent VPN provider in this niche (n.b., I do not work for them, nor have I worked for them; they were a competitor to my employer and we always respected their approach to the space).

Use instead of certbot for SSL / TLS certs Lets Encrypt LetsEncrypt ` --server letsencrypt` sounds like a useful option! See https://news.ycombinator.com/item?id=44071690 for more context and alternatives

Another good reason to use Zed

hn: https://news.ycombinator.com/item?id=40573211