How do BBS's stack up against Big Brother? reddit / bbs ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 16:18 Given the assault of on alternative media and the rise in censorship around the world, how do BBS's stack up against Big Brother? If you're one who is concerned about privacy, invasive monitoring, or hidden profiles leaching into databases of ilk repute, are BBS's an alternative to the web (http:// protocol) that will keep the spying eyes and assault from government regulation out of reach? Are BBS's exempt from bots, spiders, and crawlers? ---------------------------------------------------------------------- scubascratch · 2023-09-04 17:41 BBS tech is very old by todays standards and typically all information including passwords were stored in plaintext etc. Analog modems did provide encryption so listening in would be relatively easy. ---------------------------------------------------------------------- SqualorTrawler · 2023-09-04 17:47 They don't, because a bunch of sysops make the infuriating decision to gate things to the web, where that data can be scraped. ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 18:01 So, if you didn't gate it to the web, by and large you would be free from scraping utilities and search engines. Say you have exposed telnet access to a SyncTerm BBS behind torsocks, unless you know the username and password of a user, the contents of the message boards, file areas, doors, and anything behind elevated access privileges would be quarantined from the web? ---------------------------------------------------------------------- alvarkresh · 2023-09-04 18:05 You could always go modem-only but that often requires sourcing legacy hardware and that can be tough. ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 18:14 If it's old and ignored then that would probably be more hidden, correct? ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 18:18 Could you use a VOIP connection to the internet to dial up BBSs and connect as a Zmodem for example? ---------------------------------------------------------------------- SqualorTrawler · 2023-09-04 18:24 > So, if you didn't gate it to the web, by and large you would be free from scraping utilities and search engines. Yes, although, if you can get an account on a BBS, you could probably script a telnet session to log in and read messages in automated fashion to script them that way. But now, as in the past, I think BBSes are under the radar. As much as security through obscurity isn't optimal, the obscurity of BBS systems makes it unlikely anyone would go through the effort. (Coupled with the geriatric, coffee-klatchy conversation which makes BBSes a very uninteresting place in terms of surveillance.) > Say you have exposed telnet access to a SyncTerm BBS behind torsocks, unless you know the username and password of a user, the contents of the message boards, file areas, doors, and anything behind elevated access privileges would be quarantined from the web? Yeah. If your intent here is, "I want to make an under-the-radar messaging system," as opposed to, "I want to use existing BBSes to do this," the answer is yes. All of the interesting stuff is on the darkweb, or on the open web. I think that is where surveillance issues and "fishing for people doing questionable things" is focused. I don't think people give much thought to BBSes at all. However, one wonders whether or not it makes sense to just set up a web-based BBS/forum on tor, with authentication, and whether adding telnet (or ideally ssh) into the mix is more trouble than it's worth. Not sure. I had a tor BBS (Synchronet) up for 2 weeks and I think I got 3 people who logged in and said, "neat" and never returned. But then again it was just a proof-of-concept to see if tor would create any barriers for BBSing (it doesn't, other than the complication of having to use torsocks with telnet). I never really promoted its use much other than to say, "I'm trying this out." Ideally, I'd want to use ssh for logins; not telnet. I can't recall for certain but pretty sure Synchronet supports that. Mystic does too, but its current reliance on cryptlib means it doesn't work with modern ciphers. ---------------------------------------------------------------------- alvarkresh · 2023-09-04 18:31 > Zmodem Are you referring to the file transfer protocol or some sort of virtual modem I'm not familiar with? ---------------------------------------------------------------------- alvarkresh · 2023-09-04 18:34 > Analog modems did provide encryption so listening in would be relatively easy. I was thinking about this and unfortunately, yeah, there's basically nothing like SSL for modem connections. In the 1970s - 1990s the principal protection against eavesdropping was the need to match the bps rate exactly by the eavesdropper and it was simply technically cumbersome. With ESS and all the rest I'd suspect it would be child's play today to record the tones and "play" them back, as it were, and reconstruct a modem call even with the V.42bis and all that. ---------------------------------------------------------------------- SqualorTrawler · 2023-09-04 18:35 This is a fair question; it's security through obscurity, a generally rejected premise except, as I've argued, the question about security rests upon whether you're using that as your security strategy, vs. adding it on to a more robust strategy. Having moved ssh and telnet off of the standard ports, and monitoring those ports, I can say that malicious attempts on those ports drops to zero. People who are doing broad scans of the net, or downloading scan data from, say, shodan.io, are obsessed with the traditional ports (22 and 23). That's where the biggest hit rate is. So, whether this wrankles people or not, obscurity on top of whatever other security measures you have in place, does make an impact. * A locked-down Synchronet (no new user access to messages) * Plus a global password, if what you're doing is invite only -- I think Synch supports this. A password which won't even bring you to the login prompt unless you know the password. * Plus ssh only on a non-standard port -- if you really want to get weird, put it over 60000 somewhere. No one bothers scanning that range, at least from my own monitoring. And I have no idea what is even involved in scanning tor sites anyway. * Install this on tor. * Provision a VPS to host it which will let you pay via Monero, or if you're not too concerned, via something like privacy.com, but in any case don't use your real info. This is possible but it will take some research. I would also not bother registering a domain name for this VPS; if you're running 100% on tor, it serves no purpose. It is one less place you'll have to provide personal information. Since you'll be connecting to the VPS via the open internet to get things configured, you'll ideally want to connect to the VPS via tor, or at least reputable VPN. You don't want to leave any of your personal IP trace in your server logs, or in whatever the VPS provider is logging. That's what I would do. This is about as obscure as you can get. ---------------------------------------------------------------------- scubascratch · 2023-09-04 18:36 Somehow I left the word “not” out of that sentence; analog modems did not provide encryption. I’m not sure where you got the idea the bit rates would be a challenge; RS-232 is asynchronous so clock recovery is pretty easy. ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 18:46 Amazing answer. What's shodan.io? ---------------------------------------------------------------------- alvarkresh · 2023-09-04 18:48 I'm remembering a writeup about Kevin Mitnick back in the day when he upgraded to a 2400 baud modem and everybody in the FBI lost their shit because the tones produced garbage until someone realized they needed to change out their 1200 baud eavesdropping modem for a 2400. ---------------------------------------------------------------------- SqualorTrawler · 2023-09-04 18:49 It is a site which scans all of the net, just port 80 (web servers). So you can search on keywords, ports, locations, and find industrial equipment, webcams, and all manner of other non-web services. FTP sites, gopher sites, sites that respond to finger, still. BBSes, MUDs, etc. ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 18:52 Back when using Telix, for example, you would need to specify the type of modem you would be using (i.e. Zmodem, Ymodem, etc.). which, I believe, were different types of modem technology. My question is more along the lines of if I had a Zmodem (or any other physical modem) would it be operable via VOIP or does it require the use of traditional a telephone line? ---------------------------------------------------------------------- scubascratch · 2023-09-04 18:53 Mitnick was an interesting character but I would not take everything reported about him at face value. Anyone doing electronic surveillance professionally would not have been confused by this for more than 10 seconds. ---------------------------------------------------------------------- banksy_h8r · 2023-09-04 19:00 No encryption means completely vulnerable to passive monitoring. If someone is under active surveillance BBSs would probably be the _best_ way to leak sensitive information since the traffic would be right there for easy reading. ---------------------------------------------------------------------- alvarkresh · 2023-09-04 19:19 X/Y/Zmodem is a method by which you transfer files over a phone line. A modem itself is the actual telephone line communications device. ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 19:26 Can a modem connected to a computer with a VOIP telephone line connect to a dial-up access BBS? ---------------------------------------------------------------------- alvarkresh · 2023-09-04 19:30 I've honestly never tried. The last time I used a modem (for shits and giggles last year) I just used my actual external modem and a phone line. ---------------------------------------------------------------------- jfalcon206 · 2023-09-04 19:50 I've seen a few posts stating that Modems and BBSs lack secure connection through the modem. While, by default, this is true, people have likely already forgotten one of Phil Zimmerman's spinoff projects after PGP - Pretty Good Privacy, entitled PGPFone - an early person-to-person "digital" phone connection encrypted and encapsulated by PGP to provide secure voice calling to anyone with a similarly powerful computer with an adequate modem for the line conditions. So, taking that stance, not that I saw it enmass like the world was that scene in Sneakers where they touch a pin on a universal "Un-DES" decryption chip, it wouldn't be hard to add it on. It's not like file transfer protocols are any less "digital." [https://www.youtube.com/watch?v=F5bAa6gFvLs](https://www.youtube.com/ watch?v=F5bAa6gFvLs) As for "Big Brother" - with BBSs that are "standalone" and not part of any file or message traffic "networks" like FidoNet or UUCP, there isn't any brother... It's just an old nerd forcing their will upon you or risk ban or expulsion from their system that is likely in their home and that they pay to run for you to call into it and make them feel "self- important." Make sense? Good. :) ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 19:56 I'm thinking more along the line of a personal communications network. ---------------------------------------------------------------------- whatThePleb · 2023-09-04 20:30 Yes it works, but you have to activate "FAX" compatibility and set the baudrate quite low as the compression of VOIP will fuck up the data which then results in disconnects ect. So a real analogue line would be perfect. Sadly all phone providers in most countries aren't offering those anymore. So for connect & text VOIP is quite "ok". ---------------------------------------------------------------------- redmax_ · 2023-09-04 20:52 Some interesting discussions here. While BBS's are old they are not exempt from monitoring however, they can hide pretty well. For instance, if nobody knows the IP address to the BBS then the only connections you will get are from robots, you can obscure this by moving things to non-standard ports or.. removing it from the internet (I believe someone suggested TOR) All that does is adds another layer of obscurity. The real issue is not hiding your BBS but hiding the folks you "grant" access to your system, no matter how obscure you make things, eventually someone will follow someone and find out the little secret. Back in the day the only way to find a BBS was through a physical listing or word of mouth. Some took the speakeasy approach and required a passphrase to access the login. Most Sysops learned that unless you change the passphrase on a regular basis you would be up to your armpits in new user accounts looking to be approved. Personally, I believe that a BBS system is pretty secure because NOBODY cares about them (ok, maybe a select few care). The system is generally hosted on a single person who can simply shut down the service and boot anyone they don't want on the system. Much like back in the day, the Sysop is king, it is their system and their rules are law (within the context of the BBS). There is nothing more painful than being banned from the only BBS running Operation Overkill II because families of 3 didn't exist "back in the day". ---------------------------------------------------------------------- Unmasked_Deception · 2023-09-04 20:59 >Back in the day the only way to find a BBS was through a physical listing or word of mouth. Don't forget about demon dialers ;) ---------------------------------------------------------------------- redmax_ · 2023-09-04 21:26 We called it war dialing but, the point still remains, the process of finding a board was not an easy process laid out in front of you with a pretty bow. (of course this is where I could describe a situation where a significant other would/could distract you enough that finding some obscure BBS so you can download the latest JP Anime bootleg became a non-issue.) ---------------------------------------------------------------------- Attreidies · 2023-09-04 22:24 Using encrypted ham radio on a packet radio modem might be a good way for protection connecting to bbs, just very slow ---------------------------------------------------------------------- ten-oh-four · 2023-09-05 02:56 If your BBS uses ssh for connections (vs telnet) and passwords are encrypted, and the BBS is only attached to FTNs which have the same (ssh + encrypted password) details, then yeah, it's pretty safe I guess. ---------------------------------------------------------------------- AllEncompassingThey · 2023-09-05 05:21 Shodan.io seems really cool. ---------------------------------------------------------------------- NuSkooler · 2023-09-05 05:31 Local areas that stay local only on a board with ssh is decent. Assume messages on the BBS machine to be plain text. ---------------------------------------------------------------------- droid_mike · 2023-09-05 06:43 I can connect up to 28,800 on my VOIP line with ease. That is more than enough for a BBS ---------------------------------------------------------------------- droid_mike · 2023-09-05 06:46 FCC regulations prevent encryption on amateur bands. ---------------------------------------------------------------------- Attreidies · 2023-09-05 07:09 Ohhh Nooo! We all love salty hams repeating rules! ---------------------------------------------------------------------- Saxbonsai · 2023-09-05 07:52 Big brother will never use telnet, considering your password is transmitted over plaintext, telnet is not secure enough for big brother to snoop unless they think you’re up to some really nefarious shit. ---------------------------------------------------------------------- Taclink · 2023-09-05 08:26 Depends. Synchronet supports SSL, for what it's worth. ---------------------------------------------------------------------- jfalcon206 · 2023-09-05 08:44 Signal also did SMS encryption a few years ago but was pulled because 150 characters isn't enough room to set up a good cipher and other issues. I know someone did fork the code and has been trying to work that branch... but I have no clue how it's working out. There may be some path through MMS, but I would look into how to modulate an encapsulated (presumably also encrypted) Codec2 or OPUS stream that can fit through the audio path. ---------------------------------------------------------------------- jfalcon206 · 2023-09-05 08:50 I do recall that. All they did was tap the audio to a third modem that didn't have a full duplex audio path (one way). Today, there is software like "minimodem" (and others) that will do this. [http://www.whence.com/minimodem/](http://www.whence.com/minimodem/) ---------------------------------------------------------------------- jfalcon206 · 2023-09-05 08:53 Yes. It's not only operable, but it's also actually a great time to war dial the world as calling around it is pretty cheap with providers like VoIPBuster. Here is a talk where I describe how it's done from 2008. [https://www.youtube.com/watch?v=EnjyIcwFv- A](https://www.youtube.com/watch?v=EnjyIcwFv-A) ---------------------------------------------------------------------- jfalcon206 · 2023-09-05 09:05 Baud doesn't matter - the latency and built-in data compression (MNP5) removal from the connection. It doesn't matter if the connection is slow. It cannot have big swings from moment to moment because analog modems depend on a stable clock on both ends. But starting at 300 (Bell103/V.21) helps fix the bugs. I had an internal extension off my Asterisk server dial plan that would playback the "Information Society - 300bps, n,8,1" track, and if all goes right, it should decode cleanly through the modem and ATA. It would also allow me to fine-tune the audio levels as well. But the fastest I've gone point to point was 48k with 52 or 56k from a dialup ISP. I still haven't figured out how to reinject that signal within my setup, but that's for another day... ---------------------------------------------------------------------- BreakTheMachine · 2023-09-05 13:08 Can you provide an example of alternative media that you refer to ---------------------------------------------------------------------- vrhelmutt · 2023-09-05 15:58 I can confirm that SIP software modems work well for BBS ---------------------------------------------------------------------- istarian · 2023-09-06 14:39 Is there a rule against transmitting noise, gibberish, etc? Not exactly good protection, but I can't imagine anything that would prevent you from using a basic text cipher (caesar, substitution, one time pad, rot13), translating all the text into swahili (or another odd foreign language), etc --- I.e. At the very least you could obscure or obfuscate what you're communicating to deter casual snooping. ---------------------------------------------------------------------- istarian · 2023-09-06 14:40 You can't really remove an internet connected device from the internet, only make it difficult to directly access as intended. ---------------------------------------------------------------------- redmax_ · 2023-09-06 15:43 aka: secure by obscure. The hardcore would simply remove the Ethernet cable. (or drop it from the WiFi) of course, that would negate "internet connected" but a BBS isn't a Nest device and was never intended to be Internet connected and works just fine without it. ---------------------------------------------------------------------- droid_mike · 2023-09-06 22:10 Yes, actually. Technically, anything that is encoded in a way that cannot be easily decoded by known methods (communications protocols) is not allowed. You could certainly use an obscure communications protocol or one you made yourself and published discretely as a defense if you really wanted... The thing is, digital encoding of radio communications is a pretty new thing, so you could probably bend the rules quite a bit and get away with it. Remember that the only people that would really enforce it would be other hams, so unless you really piss them off, it's not likely to be that much of an issue... that being said, some of them can get quite ornery... ---------------------------------------------------------------------- digitlman · 2023-09-08 00:38 > Couple with this with Fidonet's goofy real-names-only rule, and you can forget about privacy at all on that network. That's a common misconception: FidoNet has no "real-names only rule". While many FidoNet echoes have a "real name" rule, many FidoNet echoes allow aliases without problem. ---------------------------------------------------------------------- digitlman · 2023-09-08 00:40 Synchronet uses cryptlib for SSH and TLS/SSL support as well and it supports modern ciphers. Perhaps the version of cryptlib that (that particular install/version of) Mystic is using is just old. ---------------------------------------------------------------------- SqualorTrawler · 2023-09-08 01:55 That's definitely new to me. Do you know of any examples of echoes which don't require it? (I'm not challenging you on this point; I am just curious.) ---------------------------------------------------------------------- SqualorTrawler · 2023-09-08 02:06 They link [here](https://wiki.mysticbbs.com/doku.php?id=cryptlib) to 3.4.5.0 as the most recent. I can find this: https://cryptlib.com/security-software/download-form/download- security-toolkit Which is 3.4.6. Either this minor version release adds support or -- and this occurs to me only now -- there are configuration options during compile that need to be enabled to get the modern stuff. Not sure. ---------------------------------------------------------------------- digitlman · 2023-09-08 05:23 By default, \*all\* FidoNet echoes allow aliases unless otherwise stated in their echo policy. So it's more a question of which \*do\* require real names, and for that, you'd have to check the echolist or posted echo rules. But generally speaking, nobody cares: post using an alias that looks real or not. If an echo moderator complains about it, just change your alias to a "real looking" name. Nobody cares if it's your actual real name or not. :-) ---------------------------------------------------------------------- PaulLee420 · 2023-09-13 03:44 security thru obscurity is the best we have to hope for. if anyone, worth their weight in salt, wanted to sniff our activitities - bbses would prove to be inferior.... however, this isn't the case with the topics we enjoy. bbses enjoy privacy because no one is sniffing around our community. that could be changed with one github and some decent code - IMO. :P pAULIE42o /s ---------------------------------------------------------------------- Digimaus2K · 2023-09-17 03:54 One can set up a \*NIX server to use as a SSH gateway to a BBS that does not support SSH itself. I do it here for friends to connect to my Max/2 BBS under ArcaOS. ---------------------------------------------------------------------- Digimaus2K · 2023-09-17 03:58 That's why Fidonet these days is a shithole: everyone thinks they're above the law. ---------------------------------------------------------------------- Digimaus2K · 2023-09-17 04:02 Just because someone wants to follow federal law makes them salty? Ignorance is no excuse for an argument, especially with the FCC. ---------------------------------------------------------------------- Digimaus2K · 2023-09-17 04:03 Yes. Look up FCC Part 97. That's the section of rules that regulate amateur radio. ---------------------------------------------------------------------- Attreidies · 2023-09-17 07:38 Thank you for making it even more clear.