 Perfect. So, good morning everybody. Sorry for being late. It's so much for the organization team here. A challenge for the time of my talk. Perfect. So, we will just say that it was normal and pretend that it's normal that I did not finish on time. But, what I have to say about these 7 grades. Before, let me present myself. My name is Ramika Chandra. I'm living in Paris. I'm French. I'm originally from Paris. I'm 16 years old. I'm a teacher. I'm working at Freelette. I'm the system administrator at the EpoBusWolfs and Stealthy. Which is a team focused on earning a strategy community product. Most of the lab has a new community management one. But, I saw writing documentation rather than a big book to write documentation. I'm doing system administration at EpoBusWolfs. And, as the guy asked for the team I'm doing system administration. You are at the co-worker of mine and I'm living in something Tokyo. And, the difference that I've been working for is our company making more items for the firewall and security stuff the company crashed. And, before, I was a system administrator for a big European institution which was an interesting job. Partially because of the low-passing word and how it was my question that I did that life. So, at the point to start by a quick survey I will ask a question and people can raise their hands. First, is there someone here working for the army? Is there someone working for a bank? Just if you're on your end, wait. Someone working for a big institutional doing something on this kind of stuff where you know there is kind of industrial secrets and stuff to protect. People doing system administration using the name for free software and stuff that could be targeted. So, competition for the people who raise their hands are provincial targets for all kind of criminal or foreign agency and everything. I found you there but it's not because you are not working on free software that you are not targeted. This morning I did with some foreign government like the one that's targeting your human rights activities and I guess that no one here would say human rights is not important. So, yeah. I'll give you that. So, before talking about security we always make the same job but we only work in French. So, let's speak about a very security concept on bank basics. It's all about CIN, not the CIN, the bad guy in the movie in the 70s. It's all about multiple principles for some availability, like making sure that the system you are supposed to protect the system administrator or the engineer is working as they should because let's imagine you are an e-commerce system administrator if the website is not working you are losing money and I do not need to repay all losing money in advance for most companies which are not started. Then there is confidentiality. If you are part of a political party you do not want your e-mail to be leaked. Is it in the US or in Turkey? That's our obvious freedom. And there is continuity which is basically to mean you are supposed to be able to do stuff but you are not supposed to edit anything like edit the password, change the configuration change the data so we need to protect your system from modification for unauthorized people. And in practice there is a lot of attackers but from what I see it's two types of attackers the usual one the one that you can see all kinds of automated like SSF new force it did not work quite often I want to see all these forms and I did a presentation four months ago about some project I'm working on that did all the root password root for us in secret right now in secret as well secret. And on the other side there is an entity it's not about the package management which is not considered as a security program it's not for me it's about advance persistence to us, it's like a big criminal organization that wants to give out a lot of resources to get through our foreign government the difference between the two is just that it's not illegal to do hacking when you are part of the government at least in your general election And first of all I would like a few assumptions mostly because I forgot I'm running laptops since a long time so some of the techniques I will speak about would be applicable only to laptops like you do not have a problem of your workstation being stolen when you are sleeping in the hotel for example, because people do not take their workstation on foot or laptops are something that do happen and yeah so you got your computer you got it for your IT service you bought it, you get it from the black market you steal it from someone in the hotel room and one thing you need to do to secure it is to decide on an operating system so it's quite obvious that you need to use free software mostly because we have free software from France but if you are not convinced free software is better you can see the reason it's not like people always look but at least you know that the interests of the coder are the same as you it's not like they are interested in fucking you and adding some feature like the Galaxy and Windows if you remember how it looks out of the box so free software is not sufficient you need to use something supported we all know that Fedora 9 was a better distribution because it was before Cousin or maybe if you know something before SystemD or if you are not free but they are no longer supported you should run that because it was better or you have no security update or anything so please don't do that do not do like a friend of mine that does not need to try your first treat to see if it was faster it was likely faster but it was also much less secure and if you try try to use a recent display because I did better security security thing so on the camera and GCC both kinds of new stuff some of them I don't like but yeah I sometimes just want to switch that laptop to Fedora because it gets a lot and a lot of features for security so I do not use my own regulatory so that I do not have people running cover but anybody can upload anything without something which is slightly less secure than the previous so please do not do like one of the people who support it and go back to the rule of not using unsupported software if you do not decide to follow my advice please check the bit system of the distribution we are running and I'm not talking to single out a mint but yeah I think they do not have a good bit system because they have no security for their website and there is no information on how they build their package so I know the bit job but it's not secure enough for me so now we just selected the public system so now which we did not install with an encrypted disk or too bad it's unlogic you cannot just check about you need to go back and install everything and if someone is working on your anaconda installer it would be nice to be able to switch later it seems that there is some way that the team could copy everything and doing some global work stuff it's much easier on the basics we just check about weight and that's it I recommend you go for a text and through this encryption it's not like you only have something to protect in your home sometimes you have a display database sometimes you do not have people to modify your disk and everything many people ask me about neural field and throughput and throughput I think where they are un-maintained for some time the good part is that it's running on more than one hours the bad part is that we do not care I said that you need to use Linux or BSD so I don't think that there was a security that it's running on fine but I still prefer to get a native solution which is supported by my employer but by the community at large and some people also ask me why I am here I never get any problem and I know that through this conclusion it's taking my battery and I need self-portable rather than the plan so I do not want to spend the battery or anything I said yeah but I am without you are protected from the test right we just go to some place and you say I don't want to carry my laptop because it's quite easy that's what I did yesterday for the tour and yeah I wish I was both paranoid I was able to keep it in my room but to bad I can't and yeah at least if someone forgets the laptop I've been quite glad for some security services like the UK one technically people are not able to steal the document and do something bad with them I cannot publish them or use them or use the passwords that are stored in the browser so it's not perfect there is a class of attack called good attack without going in the detail when you shut down the system where the memory is not right which is bad which means that someone can just take it put it on another system start it and dump the memory and in the memory there is a key to unlock your disk and if you have the key when you have it on time so you need to steal the laptop steal the disk which is usually attached to the laptop steal the memory which is attached to the laptop on this disk it solders so it's quite complicated but on the other it's not the case and yeah people can access as long as the laptop is running so it's called the even made attack oh no there is this attack there is also the even made attack you leave your laptop and unturned in your room and someone pretend to be a maid and it turns out that it's not a maid it's just bound with a good arm with these guys and someone just modifies the laptop and you know when you unclip the disk you get a point type your password and it turns out that it's surprise it's not the regular federal password it's one that records everything or send it by SMS or whatever and it's even because surely it's a record attack until someone put it together as a real attack which is working quite fine you just run it and it detects that it's human too it detects that it's a federal and it changes the unit of it because the way it works is that you need to have something which is unenculted to decrypt everything and that's the part which is attacked by the even made attack so well just take a look for that so of course if you want to collect from that there is a secure boot the result to be written and said about a secure boot but basically it verifies each step of the boot that nothing was modified or countered you can do that with a signature obviously you do not need to put a signature key for Microsoft you can upload your own key then it starts to become annoying and complicated because for each camera you need to sign everything and you need to start the key securely or when it starts working it's quite annoying so people propose another approach using a TPL it's a small chip set and you'll record only one secure boot that can be used for other stuff and that is a program called Antiavillumade which is basically using a TPL with a wild type password I do not speak that much about it much about it in the presentation six months ago for the cloud computer converse it was a wild presentation so I'm not going to be able to explain something about a product I do not move that much and in less than one less than half an hour so I recommend you try to take a look it was not so easy to do because it was not integrated but yeah, it's something to take a look while we are speaking about low level stuff I didn't know if it was all about the fire wire it's what we were able to send about and there is some other like something on the laptop that can do direct memory access which basically means there is an interesting look of insertion of that so it's supposed to work I never been able to test not because I didn't have one of the laptop I do when I didn't I just used a laptop of people who didn't look after it in the office the problem is that I never managed to get a good cable to put from my laptop to another laptop thanks to standardization there is three types of cables so you need to have the right coordination so if someone managed to make it work it would be nice if it not work but Fedora it would be also nice to tell me so I can fix the side so yeah, that's quite bad for people who always all your approach to product so the first one is to not store the key on memory you can do something called a treasure to store it on the processor I didn't know if it was a piece of paper I didn't know what to do after I think it was not push-up sweep if you have a free time or at least push-up sweep it's a little bit sad that was it push-up sweep and can I use it or do I need to patch the camera and the back against can I do the follow-up something like this okay so here is the patch after that if you want anything another more preferred solution is to use a bootloader on the stick basically work super directly but you can't help work directly on the stick and if you get a self-amplified stick then as long as you have a stick in your product which is much easier to carry around than a laptop but people technically should not be able to do too much on your data and that's something which is not easy to do while you are using a camera with module and you need to update so you can do everything it's much easier to do with J2 because you have to do everything so you can just decide to compare your phone with the camera and agit monogit and that's it or if you don't have a fingerprint reader try to not use it it's not a security device at all you can imagine that for some things that cost $10 while you do not get exactly military-grade security it's more convenient stuff and it's bad to not type your password even on an iPhone it's mostly used for unlocking something fast but it's supposed to not work after a while and you need to type your password speaking to you about hardware there is value for your AP attack so if you get by the if you just get some random gift thing like that or it's an idea at your company if you get a gift from China just put it on your laptop but don't put it on your laptop it could be a keyboard it could be a USB stick or a disk or anything and it turns out that the Linux camera has a lot of flight system and some of them were kinda unused like do people remember about the JFS2 about the Amiga flight system and it turns out that if nobody uses it it's likely that nobody would look at it and it's likely that there is a lot of bugs and some of them doing security bugs in the camera and that's that for existing bugs but there is also a huge huge number of ULB widget and all kinds of things that can be detected by the Linux camera and when it's not that it's about a printer which is the phone of David that everybody sells so yeah if you plug random stuff you are asking for a potential problem and this time it goes for a HDMI plug I mean, there was a laptop two years ago about it so I can take a look at a software called ULBiGua I think it was written by someone from the real world of it but I'm not sure I was supposed to do that before the presentation but I was too busy trying to fix it so yeah, I'm still talking about Aura Security because it's quite depressing if you are not convinced you can take a look at the presentation from the ULBiGua from there she did something about oh, everything is completely broken and we have to wait for a new type of laptop for that and yeah, we are going to you can take a look at ULBiGua I think that there is maybe one developer there I say that they need to come so they can complain to people changing stuff and breaking federal and I'm not sure if we will be able to come but yeah so back to the operating system we cannot really trust the hardware but it should work mostly so back to the basics well, it's quite obvious you use a strong password I will not discuss about what is really strong people people disagree I just need to remind you that we need to take human factor in account yeah, it may be a password of 200 characters secure but you cannot remember that so we likely might be able to understand our stories in a password file try to get something that you can remember try to make sure that you get some way to get different passwords for different services if you can try to use a password manager I can't pick one one because most of them are online and that's services and if I do not pay for the services I wonder how they make money so you can get something I think the federal infrastructure is trying to use it for the Twitter and the WordPress account so just get people from the Federal magazine or Twitter to ask them who it works because I have no idea and I'd like to get a great question on your composer you should try to avoid keeping data on the laptop because if the data is not here it's not going to compromise sometimes you need to get passwords to do your job but do not start to get a copy of all your secret data it's going to be problematic if you can or you can separate your user like I have one user to go on my guide and one user to go on server and the one going on the web to get a picture of cat can be attacked but you do not have access to SSHT and all kind of stuff well if you can try to get a computer it works quite well I mean it's hard to have a computer which is not connected to another it can technically deal so when people are at that level of sophistication usually it's easier to just give you money to do whatever you do and if people prefer to spend 1 million at my computer I can do it for half of the price and it's not on the show but it's not on the show and you need to make sure that you do not exploit so obviously you need to do the fellow one and by using I mean using it and breaking stuff but using it and opening everything you need to disable what you do not need ok maybe it's easier for you to work on the copy of the production server on your laptop but maybe you do not need to be like your production server without this or that and without fellow one if you need to have something do not use it on your network you can use an FTP server or Apache but just one on your local host you should use a computer which is fast enough and you can use the VM on one you can work with it and then you just need to separate the VM from the rest of the world so container can be a solution it depends on the problem like if you get bored or if you have too much free time container can be a solution for that there is a world talk dedicated about securing container it was yesterday so you can go back in time just go watch it if not you can do a project on YouTube if you have a choice between VM and container for security just go for the free machine it's much better so we are not on windows it's not recommended to use a glass scanner in internet in fact they are quite dangerous our windows should follow the Google Zero project but it's basically Google that has improved a lot of money on the program and higher a lot of security guys who just try to poke all the flash adobe in the glass scanner in internet would be quite catastrophic like they are doing security analysis you are getting the windows scanner with a secret code which is quite unsafe or something to disable the administration interface without password you know security is part of the business of your scanner but well it's not what they are doing so yeah it's much better to be running without a virus scanner at least on Linux it's not like they have a ton of virus scanner virus program so it seems that I have a slide about showdown and IPv6 because the first time I did the presentation it was well not a big discussion but it was a discussion there are a lot of people who think that ok my server is connected on IPv6 and no one will be able to find the runway because you know it's IPv6 it's like several time order videos on the regular internet so no one will be able to find anything in internet showdown which is a company doing scanning of the whole internet and indexing all kinds of webcast or printer connected to the network or it's quite scary to see how many people are trusting the fact that no one knows the IP address while it's using an NDB like when you do an NDP request it will see that that IPv6 is a valid IPv6 and they will scan you and just list your IP address maybe you know both but yeah I do not trust that you get an IPv6 and no one will find you it's not something like that it seems to be the part where I just started to lose complete currency over my slide because this one is about another interesting stuff that you need to see it's the Enigma conference it was a security conference in general and the keynote was done by some guy from the DSL which was the chief table access operation which is particularly people who get crystal access from the NSL for a pilot like I don't know if you are from Belgium, TECCO and everything and basically what he said it's like good job is to attack everything but we want to show you all to different it's like we are too bold and we need to get more options so let's try to get five of the easiest stuff and get us something worth basically what he said it's like we can wait one month two months, six months just for that time when we will disable the five euros for five minutes and at that precise time we will attack because we have people waiting just for that so yeah that's basically traditional military way like we go to Poland to throw more money and more people at it so it's not like they get extra security stuff but it's still interesting and so it's meant for the people to attack that's why they are using phishing it's like detecting someone and say oh by the way you need to open that file so do not open one of them or attachment I mean it seems quite obvious but it's certainly NSL means that it's a criminal it's a foreign conflict again that's what I'm talking to some human rights activists and the problem is you can say yeah it's only targeting windows but no as long as you other people that are running like ortho-office or libo-office and we command libo-office because it's actually bad data for security or the Linux 15 news article goes up so yeah they can make a targeted targeted payload for just your office suite and then you can practically get school credit so if you can you can use a sandbox so if you have a company you can create or throw a VPN we can exactly that it starts for your folks it starts a specific instance of for your folks running a specific plugin for video conference we are using at work in a specific VN it spent the whole afternoon working on that after we jump while drinking coffee but it's secure because everything gets thrown away after if you don't want to spend too much time you can use a storage sandbox it's working quite well for some reason but I do not understand I need to test that out and if not I will just complain to people in the company there is other stuff like very hard-jaded and everything there is docker but do not use docker because it's too complicated it's not made for security it's mostly made for sysadmin and either few and basically being able to move from production to QA or whatever the other side it's not really made for security take something made for security please not docker you can also use sysadmin from the desktop so there is some process that were contained like the thumbnail maybe the preview for firefox you can use the mcs policy which is an example that we give in documentation as a very interesting use except for testing it's like if you say yeah this document so the user need to have it's working quite well when you test it's just for military and that's it you can use the content user I did try that for you it was quite painful because I need to administrate my laptop so each time I need to want to do something opening the port it's not working looking at the room it's not working so I need to go root and go unconfined kind of with the whole idea of having a content user and the user is content that can only touch to its own file and it turns out that my data are on my home so it's not working that well so you can do like this something that was a result of work to do for that another option is to look at xdj which is now called flashpack again there was a good presentation I wrote yesterday I didn't see it but I know it's good so we can go look how the young people are trying to contain everything and make sure that a random package coming from the internet do not break too much work because what could go wrong with a random package coming from the internet if you are using Ubuntu there is also a snappy and everything and yeah the biggest part for your desktop security is your browser because we all know that the browser can do everything like you can send email you can play music you can use a webcam and everything I'm pretty sure that soon people will be able to get systemd by firefox so yeah, I don't think it was a choice between Chrome or Firefox I will try to it's not that I do not like a bit funny but I think that it's not really a browser which is used by much people so I tend to firefox mostly only on firefox security even if I think that Chrome architecture seems to be better so on the firefox security if you need to remember only one single thing of my talk is remove flash you just do you just remove it, you do not use it I do not use it since 5 years and the only thing I'm missing is playing some ninja game on the web it's not like a big deal you can watch YouTube entertainment and all kind of stuff if you need to do something else well, there is Java I think that Java is not the only one time this day and there is still big security problem and it's to be expected it's like a complete desktop machine to execute one output from the internet and a lot of stuff can go wrong if you can do that you can also go to multimedia content again because codec are quite complex so it's not like building completely but at least building from auto-playing, like if you want to go to YouTube you can say ok, I will first go to YouTube to build content, but I do not get a random advertisement there is also a lot of issues with the web view and direct video access I think it's desirable by default but make sure that if they want to do something you can actually trust NVIDIA driver, you can actually trust all kind of stuff to work on performance for the security and it may be sometimes and may use some shortcut and you do not want to have some shortcut being used in code which is running in the channel for the device that can access the whole memory and it's like a receipt for disaster same goes for WebFTC as all kinds of network access but you do not want your platform to start sending a random packet on your internet internet, that's what Skype was doing and it was quite efficient to buy a passwordable so something that most people do not do is using a master password or you can record your password directly in your efforts but if anybody taking your laptop can access it, it's quite bad so I recommend using a master password there is a few researches that are quite nice, like HDB it's everywhere, so we can be sure that stuff are quite secure more secure by default if you really like your clicking on the menu to undergo all kinds of websites on the Windows script it's quite fun, now you get back on the experience of 20 years ago when nothing was working but at least you are protected from all kinds of attack and if like me you go always on the same website, you get the rest problematic at all times, also I learn about it another nice function like let's say you are calling you are going to China and suddenly you discover that the website of your company is using a different hdps certificate and it turns out that it's not signed by the user, suddenly it's signed by a random China corp so yeah, it's quite fun and self-afford try to verify that the certificate you don't change too much since last time and say to you so if you can, you can remove this here, because there is really one of them and most of them come from government and not only from a democratic government, I shall say and you can imagine that loads can be different and that you know, they can use some certificate just for you, because that's what we sold them so yeah, if you want to try to remove here our artists, try to filter them if you want to be really depressed, you can look up for something called the browser of the gs it's an attack where you randomly flip the same part of memory and it turns out that after a time it starts to flip other parts of the memory it's quite depressing I will not speak a bit more about it because like, you cannot block it you cannot do much more except changing your complete architecture of your pc so yeah, and there is a question of privacy, which is not exactly about security, but it turns out that after the latest modern revelation 3 years ago that some foreign agency is targeting specific people and they do that because they know who they are and because there is master alliance, so from government but actually tracking all over the world well, it's quite easy to get some specific target without doing much I mean those people who need to upload exploits in advertisement there are some people using the targeting of Twitter to specifically throw specific parts of the population like say you want to get a view from the close of windows and you just say yeah, I want to get that and people getting on Twitter on that specific place in Poland at that specific time for that specific part of the population and suddenly everybody gets a windows or an advertisement on Twitter so it's quite it's just some training but you can do worse I know someone more supremacist treating that to antifascist and this kind of stuff people treating about abortion directly at people around abortion clinic and this kind of stuff, so yeah it can be quite bad and I recommend to use some two stuff, first is not upload because it's taking all your memory and you need to do your memory to run a virtual machine or this kind of stuff or just running for your thoughts so it's mostly you block which is quite a bit better and there is another one called cookie monsters that basically renews both the cookie because I'm not sure if it's that efficient to block but it's slightly making things a bit more complicated and if you are using no script it gets much harder to target you if you really want to get predicted there is a tower and Tess will go through it so the tower is the Union router I think I do not need to present it Tess is a Debian based system with a custom browser and everything that tries to erase everything once you stop the system so you do not leave any trace which is great, you need to make sure that you save your document which is not great so yeah and it's quite secure, people are working with that a lot of things quite right like doing the and all kind of stuff discussing with journalists and understanding what all the people did react with automated the graphical testing which should really be doing a thing it just requires motivation and yeah as always I saw all kinds of local effects who are working on the internet so obviously you need to use a screen seller and obviously with a password so you have to set up for looking on an item because someone will just come out later and you need to come right now there is some cake in the kitchen and you say, oh, cake! and yeah, if you forget to lock your laptop at the office it will just be that someone is sending an email using your computer or if it's like me preparing to send an email two days after so you are just using your laptop and you need to go out and you do not understand why and people tend to seek out who is that and thanks to Zimbabwe we will understand later so do not forget about TP-Wide I mean sometimes if you are the only technical person in the place who are learning about TP-Wide but sometimes you are not the only one and people can check so you can use the password code TL-OUT sometimes it could just disconnect you it's actually working on Zimbabwe to create a route so you see if you need to use your own chain you can use it make sure that you take care of the studio security like making sure that your financial expires like you take your password you do not have to take it each time especially if it's the first shutter of a load of the ring but you want to get it expired after 5 minutes or something like this and it's about P-Trace so for people who do not know P-Trace is a C-Score that can be used to inject code in other process it's used by GDB it's used by S-Trace and you can be used by your compromise power folks to upload some code in your SSH with the obvious problem of dumping the key, recording the key or whatever so you can be disabled as well with the password code and you can really enable when you want to do something just wait but by default you should disable it speaking of SSH most of the time if someone is targeting a C-Samine which is my case not that I'm targeting a C-Samine, I am a C-Samine what I want to protect is not the list of it's not the list of websites I always go it's mostly the SSH key so just get the password of the key if you don't want to type it each time because the whole idea of choosing a key is to not type your password you can use the SSH agent if you use the SSH agent do not forward it because if you forward on another system when someone can use the forward agent to connect you will not see it there is no load or anything it's quite bad I recommend you to get a different key per device like I get one laptop another laptop and another key mostly because if the key is compromised, I know what I need to remove some people are recommending one key for each server and laptop I think it's too much but it's up to you to do your setup in any case you need to change the key of a regular basis because someone steals the password of the key which is protected by the password and it takes 2 years to break and test everything for example in turn if you change the key every 6 months they will take 3 years to break it and it will be useless so for that you need to work on an automated key changing which is a part that I don't do but again, do what I say and do what I do because once it's automated, it's much easier you just start it by calling or something like this you can store the key on a smart card if you get a smart card reader it's cheaper I mean it's like 50 euros you can get a cheaper one if you live in Paris because we use a smart card to pay for the public transportation and they give that for 7 euros to not be working that way but it's cheaper for our testing you can get a duty key or if you want I do have one club on my laptop it's working well I said that I was not working on that version of well and it's not supporting the key I want to put on it so it's working another solution is to store something on the TPL as I said the TPL can do some crypto operation and there is a package called simple TPL PK11 which is not everybody in federal because the guy bringing the package is lazy it's me, I rather speak about doing the job and yeah it's working well my key is on my cannot be used without the TPL and the day I lose the laptop I can't access any server anymore and the same is the other world either flight it's not that great I need another key for them but technically people should not be able to get it without spending a lot of money to get my laptop and get specific equipment to get stuff out of the TPL so I think it's quite secure if you press the TPL and whatever you do for the desktop desktop security is not everything you still have the confused issue which is basically someone that will use your credentials or your access to do something that you are not supposed to do like erasing all the backup or all kind of stuff so you still need to add server side production so there is basically two things to do audit and server and audit obviously you need to store the audit on a different server because if someone manage to get food access on the server they can remove the log and audit so it's much harder if it's a different server I do not feel like I want to know the documentation about that because people do not feel documentation but it's also my administration harder you need to make it hard or slow to clean and delete so if someone wants to delete the system like ok it will be deleted but it will take like one day or something so if you see something you can prevent the cleaning for the log and you can use the usage based on fucking and machine learning in advance like seeing that suddenly at 4 in the morning when you are on PTO you connect from Q&A maybe it's suspicious to be honest it's completely pretty and without surprise that's what Facebook and Google are using in their system like you are looking at documentation you are not supposed to look you get any information and when you choose that you are looking at the documentation about that stuff and you tell me are you watching me so yeah I seem to be working quite well I mean we didn't know that much about the security program and yeah I'm not about data because I spoke about security and security that's all about other reviews so you need to make better everybody is doing better so I'm not going to do that you need to make sure that the data is encrypted because it's nice that if you unplug your laptop but suddenly the server which is a sitting somewhere in the data center is not encrypted and the data is in clear text well it's bad because there is people coming they just take one disk and you are reading and read and read so you do not see that one drive it is up here and that they just got the data and when they finish copy they can just and it's great you will not see that your data is disappear it did happen for real and I did see so you can consider using NIDS an inclusion detection system I know a few people running that on their own laptop you can use Pro, you can use the smart so it's basically the same as an antivagros I remember what I said about antivagros I think that at least it's free software so we can be sure that they are doing proper security stuff it's better to use A or Q player it's working properly if you can, you can try to use a read and read file system if you can, you can even go on OST and then you need to go and see a Patrick or a player to read it and you can also use a log watch see if suddenly your laptop is doing some work stuff either the processor is burning or suddenly someone is trying a 1000 password per second and your SSH did because they are trying to me and you are still running SSH did on your laptop so yeah, it can be quite nice to get an email to say oh, something fishy is going on you need to stop everything please disconnect from the internet so yeah, to conclude I still have 6 minutes of questions because I have a nice fill from my video, you can see it so first thank you for our coming and if you have any questions you have like 5 minutes I think what's your opinion on password management so the question is what is my opinion on password manager you mean like specific password manager or the wrong set well I think the concept is quite good because we remember a lot of master password but can you recommend some password manager or so the question is can I recommend the password manager and as you also know I currently recommend, I would recommend to people to use something which is free software, which is maintain and everything I prefer to use something which is local because I do not want to depart from my password on some infrastructure to be up and some infrastructure to maintain by someone else I use the password replication feature of FireFox which seems to be working quite well and they say that everything is computed on my side so that's good I have a good thing about Pass it's using I think and GPD which is great because I do trust the password because it's not exactly good example of usability also we are using Git and GPD and we stop importing and we go working in vulnerability and let's say that there are significant usability issues with people who will not spend 10 years working on presufra people losing their private key and people having problems with something like the equity mark and GPD is not handling the quality and all kind of stuff it works well but I think we need to get something that is easier to use another question again you mentioned those who are going to go into a new matrix there's another part of the sort that I find is easier to use so you can also use a new matrix which is made by the same guy that you wrote when stopped by you it's once quite nice I use it on my browser and there for using those scripts I'm testing each of them if you haven't considered the finding in that you're not looking there where you can prove that the file has nothing to do with the IC251100 so the question is did I consider for a lot of security from the system and the answer is yes but not on my laptop or from because I wanted to test on CERA first and there is production and there is testing and testing on CERA the second one is because the presentation is already full on so they don't want to put everything I can say about security or if we just need to speak about security I just want to say about security feature and you need to take a look at that yeah so no other question so if you don't want to contact me or you can use an email I just want to say something that you can send me to my personal email you can contact me on the email I can also give you a possible an IC server that you can use for whatever side of the of the way that the way it can be and if you want to get some message from me on Twitter it's not me if you get someone that looks like me on Facebook it's not me and if you get a link saying I want to connect with you it's also not me so thank you for coming and if you have any question I will be there or like getting some food because I get quite angry and something to do because speaking for a lot of existing and thanks for coming again