Security on MarkJacobsen.net

Handing secrets in PHP Docker Compose site

Tue, 24 Jun 2025 12:50:00 +0000

If you’re using a single instance server (not Docker Swarm) and Docker Compose, but want to keep your secrets out of source control it’s not too bad. First, make sure you’re excluding “.env” in your .gitignore…

.env

Then, add your secrets to a .env file (file name must be exactly .env) in the same folder as your docker-compose.yml…

SEC_1=Something SEC_2=SomethingElse 
Then, be sure to expose your secrets in the “environment:” section of your docker-compose…

environment: SEC_1: ${SEC_1} SEC_2: ${SEC_2} 
Upload both the .env and docker-compose.yml to the server, and restart docker to pick up the env vars…

docker compose down docker compose up -d 
And finally, use the values in your PHP…

getenv('SEC_1')

Oh yeah, and since your .env won’t be in source control I’d still recommend finding a secure place to save it like a password manager.

Communication is Key

Wed, 22 Jan 2025 11:38:00 +0000

Now that we’ve discussed E2EE and FOSS, let’s start with probably the most important thing you want E2E Encrypted… your communication!

Did you know that most text messages sent from your phone or chat/IM messages sent through social media companies can be seen, read, or processed in a number of ways?

How gross is that??

Very!

So what to do? Use an end to end encrypted messaging service like [Signal][1]. Signal is cross platform (no blue/green bubble shaming) so works on iOS and Android, but also has desktop apps that work on Windows, Mac, and Linux! Add in rich media (photo/video support) as well as calling (including video calling), and you shouldn’t need any other communication tool (other than email – which we’ll get to)

Note: Please don’t be fooled by the titans saying they have E2EE too. It may be “technically” true, but usually there are manual steps or other “gotchas” involved, and often the titan has a copy of the key to read your messages. Save yourself the research and just use [Signal][1].

Think Apple’s iMessage is special? [Think again][2].[1]: https://signal.org [2]: https://www.forbes.com/sites/zakdoffman/2024/12/15/fbi-iphone-warning-why-you-should-stop-using-imessage/

Is it time to quit social media?

Sun, 21 Oct 2018 18:45:00 +0000

As I read this article what was running through the back of my mind was, “is it time to quit social media?”, and to be honest… but for being involved in real estate and a large bulk of that requiring being “engaged” I’m not sure I have much use for it. Never before has it been easier for marketers to target and connect with their “target audience”. You do realize that’s what social media has become right? The proverbial barrel where the fish are to shoot.

So, is it possible to take back the social networks? I’m not sure it is – at least with the current companies. Built from the ground up, or under a completely different model – maybe. But as the article linked to above points out it would be to the detriment of the “bottom line”.

Would I like a feed where I only see posts from my family, and maybe some other groups at my leisure? Of course, but unless I’m paying for that the only recourse I have is to a platform that has the resources to provide it based on the party that is willing to pay for it – the marketers.

So what would this “social media” service of the future look like? Number one, it should be built on a privacy, no-advertising first model. Second, I believe it should be decentralized, but speak a standard protocol – just like how email service is provided. Then, organizations like companies, teams, or even families could manage their own little groups and individuals could determine what they want to see or who they want to connect with…

And yet, as I sit here writing this, I wonder if it’s even possible or needed. After all, I’m able to run my own little blog right here. You can share it on social media if you so choose. In fact, I’ll probably post it to my account – and try not to look at the “likes” or “comments” that fuel the FB “engagement” engine.

So, while I may have just rambled for a number of paragraphs, let me finish by encouraging you to consider your use of social media, and at a minimum strongly consider turning off your notifications and moving the app to a sub-folder on your phone (just those two things alone have made a huge difference in my life). I would also encourage you to look into downloading and using Signal Messenger in place of text messaging and especially in favor of the social media messaging platforms.

Until we figure something out, you can always find me right here.

Stop Using WhatsApp If You Care About Your Privacy

Thu, 10 May 2018 14:46:00 +0000

Yet another reason to use [Signal][1]…

Stop Using WhatsApp If You Care About Your Privacy[1]: http://markjacobsen.net/signal/

Don’t Give Away Historic Details About Yourself

Wed, 25 Apr 2018 14:17:00 +0000

Please be safe out there

Social media sites are littered with seemingly innocuous little quizzes, games and surveys urging people to reminisce about specific topics, such as “What was your first job,” or “What was your first car?” The problem with participating in these informal surveys is that in doing so you may be inadvertently giving away the answers to “secret questions” that can be used to unlock access to a host of your online identities and accounts.

Don’t Give Away Historic Details About Yourself — Krebs on Security

Why We Should All Ditch Other Messaging Apps for Signal

Wed, 18 Apr 2018 13:55:00 +0000

If you’re already on Signal you can find me there too. If not, I’d like to suggest it…

Why We Should All Ditch Other Messaging Apps for Signal

And here are [my reasons][1].[1]: http://markjacobsen.net/signal/

Facebook Lockdown

Sat, 14 Apr 2018 14:00:00 +0000

Warning: I may get slightly snarky below. I’m not intending to belittle anyone’s intelligence, but to forcefully promote the importance of privacy and security.

So… recently I know a number of people’s Facebook accounts that have been “hacked”, and since I don’t want to bore you with the technical details I do want to provide some basic security advice and show you how to lock down your account.

First the basics… While I know it may be super tempting, or you “just weren’t thinking”…

NEVER click on a link you don’t recognize and have a reason to click on. I don’t care if it’s unicorns and rainbows or will create world peace. Stop clicking on links for no reason. What’s a reason? Ex, your friend messages you and says, “Hey [what they would normally call you], here’s a great recipe we tried last night and [some family member of theirs] really enjoyed it [link]”. Notice how actual identifying information was included in that and it was targeted?
But what about all the great articles on Facebook? Do you recognize the domain? Do you have a real reason to be going there? Maybe you should log out of Facebook and delete your account? But anyway, same rules apply… unless you recognize where the link is going to and you have a real reason – **don’t**click on the link!
Here we’re going to get a little Facebook specific, but NEVER install apps, games, or allow third party access to any part of your profile unless you are 100% sure of the legitimacy. In fact, delete all apps with access to your account. Ready, for a real link? [Here’s where you can delete apps with access to your account][1]. You’ve heard of Cambridge Analytica, right? If not, go delete your Facebook account right now and never log back in.
Ok, back to the basics… Never use the same password for sites. Hint, your Facebook account getting hijacked isn’t usually because of a bad password, it’s usually for one of the reasons above which I why this is listed forth. Still… don’t use the same passwords.
Ok, ready for probably the most important thing you can do other than following the items above? [Enable two factor authentication EVERYWHERE][2]. In fact, go back and read that article I wrote 4 years ago.

Ok, now I’m getting tired as this may be one of my longest posts ever. So, to wrap it up, here’s how to enable two factor authentication on your FB account (note, even 2FA won’t protect you from clicking on stupid links and installing apps).

Install an authenticator app on your phone like Google Authenticator.
Go to your Facebook security settings: https://www.facebook.com/settings?tab=security
Under “Setting Up Extra Security” enable “Use two-factor authentication”
Under “Code Generator”, click the “third party app” link to generate a QR code you can scan w/ the Google Authenticator app.
Follow the instructions.

Now, go enable 2FA for your other important accounts like banking and Google/GMail.

But most importantly, stop clicking on links!

PS: Again, apologies for any snarkyness. It’s interesting because in the wake of the cambridge analytica, #DeleteFacebook, and other campaigns I’ve been thinking of what it would take to create a distributed, secure, no ads based, non-profit social network. If you know of one already I would be interested. If not, and you’re a developer who might be interested in working on such a project, please let me know.[1]: https://www.facebook.com/settings?tab=applications [2]: http://markjacobsen.net/2014/04/heartbleed-and-the-importance-of-two-factor-authentication/

The Matador Defense – TWiT

Thu, 12 Apr 2018 11:14:00 +0000

I would strongly recommend listening to the segment on Facebook

This Week in Tech 658 The Matador Defense | TWiT.TV

Scary Chip Flaws Raise Spectre of Meltdown — Krebs on Security

Thu, 11 Jan 2018 14:10:00 +0000

Please be sure to update/patch every device you have. On most Windows machines, you should be able to do a manual reboot (Start -> Power -> Restart) and have the updates applied. On iOS you want to go to Settings -> General -> Software Update

Scary Chip Flaws Raise Spectre of Meltdown — Krebs on Security

10 Unusual Things I Learned From Mr. X – Altucher Confidential

Wed, 25 Oct 2017 00:41:00 +0000

Ep. 265 – 10 Unusual Things I Learned From Mr. X – Altucher Confidential

_You can find all my shares on my Facebook Page

Find the Members of an Active Directory Group

Mon, 14 Aug 2017 20:21:00 +0000

The simplest way to get the list of users in an Active Directory group is to use the following command right from the command line:

NET GROUP "my_group" /DOMAIN

And yes, that is the work “DOMAIN”, not the domain you are in. The only value to change in the command is my_group

Ref: Is there a way to view the members of an Active Directory group if you aren’t a domain admin and can’t log into a domain controller?

Apple vs FBI

Thu, 18 Feb 2016 17:39:00 +0000

So my mom asked my opinion on the current standoff between Apple and the FBI over their insistence on building a back door into the iPhone “just this once” (wink, wink, nudge, nudge). As I said to her…

I completely agree with Apple’s stance. Once they create such a method to circumvent the security on the phone, I guarantee it will be ordered to do so from now until eternity. That is unless you believe everything the government and law enforcement tell you. In that case, then yes it will be just one time (wink, wink, nudge, nudge).

Let’s also address certain politicians insistence on “opening up” security and “using our heads”…

START: Sarcasm and Contempt
Yeah, let’s open up security all over the place. In fact, then no one will ever be able to transmit anything securely ever again. Hint: “open up” just means lets build in a vulnerability, a bug – intentionally!! You didn’t want your credit card info submitted securely now do you? Probably should let the gov’t be able to scan all your photos and financial documents, and travel plans, and basically anything that’s stored digitally. Not like that’s everything now a days.

Not that hackers or “bad guys” would take advantage of that or anything. Gahh!!

END: Sarcasm and Contempt

Heartbleed and the Importance of Two-Factor Authentication #1aDay

Wed, 16 Apr 2014 11:28:51 +0000

With the recent announcement of the Heartbleed vulnerability it’s more important than ever to consider your security precautions. Of particular importance you should be…

Using a password manager like LastPass or KeePass
Using Two-Factor Authentication wherever you can
Using strong passwords wherever you can’t use Two-Factor Authentication

So now a few details…

What is Heartbleed and why do I care?

For those who are not server administrators, Heartbleed made it possible for attackers to steal information from servers memory. Of importance to you, that information may have included usernames and passwords. Should an attacker have your username and password I’m sure you can figure out that they could do not nice things with that information.

What can I do?

Use a password manager like LastPass or KeePass

Tools like LastPass and KeePass are great because they give you a secure and central place to store your usernames and passwords. Plus a service like LastPass includes additional tools and can provide valuable services like they did with Heartbleed to let you know where you should be updating your passwords. Concerned about using a service like LastPass? Here’s a good article on why you may not need to worry.

Use Two-Factor Authentication wherever you can

As that article above pointed out, you should be using Two-factor authentication wherever you can. Two-factor authentication requires an additional step in addition to entering your password, usually by sending a message to your mobile phone or using an app on your smartphone. Basically, with 2 factor authentication, logins require something you know (your password) and something you have (your phone). In short, two factor auth prevents Heartbleed because should an attacker have your password, they still don’t have your phone and thus would not be able to login as you.

You can find a good site with lots of places that allow two factor authentication here. My suggestion, support companies like these with take security seriously.

Use strong passwords wherever you can’t use Two-Factor Authentication

If a site does not allow two factor authentication, I would highly recommend that you use a strong password. Here’s another place where a service like LastPass or KeePass come in handy because they can generate strong passwords for you.

Change your Passwords

Keep an eye on this list for when and where to update your passwords. Even if a site sends you an email saying they weren’t affected, it wouldn’t hurt to change your password and add it to your password manager. Chances are you weren’t using a secure one to being with.

Missed a call? ‘One-ring’ cell phone scam could cost you money

Fri, 07 Feb 2014 07:00:22 +0000

Take a quick look at [this article from NBCNews.com][1], and then remind yourself that return calls should be handled just like email… If you don’t know who or what it is, just ignore it and delete it. Do NOT click on it or call back![1]: http://www.nbcnews.com/technology/missed-call-one-ring-cell-phone-scam-could-cost-you-2D12044967