Creating an RSA keypair for JWT(RS256) or other purposes.

$ openssl genrsa -out key.pem 2048
Generating RSA private key, 2048 bit long modulus
.......................................................................+++
..............................................+++
e is 65537 (0x10001)

Extract the public key from the key pair.

$ openssl rsa -in key.pem -outform PEM -pubout -out public.pem
writing RSA key

Your purchase data is for sale

Background

I was reading an article posted to Hacker News recently,  “Google and Mastercard Cut Ad Deal to Track Retail Sales”, about how Google is buying transaction data from MasterCard. I’ve noticed when setting up a new bank account or getting a new debit or credit card there is often a little notice inside about their privacy practices and how you can opt out, but they don’t make it clear to what extent this is possible and what information it is that they sell and to whom.

Protecting Your Privacy

The best way to protect your financial privacy would be to use cash, but for many reasons that are not practical especially for modern convenience and things like online shopping. The purpose of these suggestions is to limit the amount of personal information and marketing data being collected and shared. Remember that the retailers and merchants you do business with may retain and sell your data as well, this is exactly how most store rewards programs work.

Privacy.com

I’ve been using a transaction tool called Privacy.com since I read in The Verge, “Privacy.com is a VPN for credit cards” a few years ago. So far it’s worked well. It’s not fully anonymous, but it keeps the data out of the bank or credit card company’s hands and has some other benefits such as allowing you to set limits and delete the virtual cards. Their Privacy Policy is also significantly easier to understand and as of writing, they do not market your transaction data like your financial institution probably does. One part of this service that has come in handy is the per-merchant cards since I haven’t had to have my card re-issued each time another breach happens.

Privacy.com Referral Link

IronVest (previously Abine Blur)

I also used IronVest Virtual Credit Cards when it was still called Abine Blur in the past, but I found the interface for virtual cards was lacking and the company hasn’t updated it in years.

Privacy Policies & Opt-Out Links

I’ve added some links below to major credit card companies and bank websites where you can find the privacy policy details. More importantly, I have included links where you can opt out of data marketing, which is where the company markets and “sells” your data to other firms.

Credit/Debit Cards

• Visa
  • Visa Marketing Reporting Opt-Out
  • Visa Opt-Out
• MasterCard
  • Privacy Notice
  • MasterCard Data Analytics Opt-Out
• American Express
  • Links below seem to contradict one another
  • Privacy Principles
  • Online Privacy Statement
• Discover
  • Privacy Policy

Banks

• Chase
  • Privacy Notice
• Citi
  • Privacy Notice
• Bank of America
  • Privacy Notice
  • Set Privacy Choices
• Fifth Third Bank
  • Privacy Notice
• PNC Bank
  • Privacy Policy
• Wells Fargo
  • Privacy Policy
• US Bank
  • Privacy Policy

Making sure you can log-in

Make sure you have SSH login enabled in by login into admin interface using your browser. Go to System menu at the bottom and make sure SSH is enabled, and note the port because we'll next that next. Be sure to save the updated configuration if you didn't have SSH enabled already.

Next open the Terminal app of your choice and attempt login. You don't need to specify -p <port> if you are using the default SSH port of 22.

$ ssh <your username>@<router ip> -p <port>
Linux ubnt 3.10.107-UBNT #1 SMP Mon Mar 5 18:53:35 UTC 2018 mips
Welcome to EdgeOS

You can also take the time to visit Wizards > DNS host names in the admin interface and create a static mapped domain for your router such as router.local or edgerouter.local. The will allow you to enter router.local into any device on your network using router dns to automatically find your router without needing to remember the IP address.

Certificate Creation

I decided to use mkcert for creating a self-signed certificate that can be trsuted by my own machines. Follow the directions for setup or obtain a certificate some other way. The next steps will assume you have a certifcate created or will be using mkcert.

Creating certificate using mkcert

You’ll want to open a new terminal window or tab since these commands will be on your local machine.

$ cd ~/Downloads ## Folder where you want the newly created certs to be
$ mkcert <your router ip> <optionally- router hostname: router.local>

Using the local CA at "/Users/dwin/Library/Application Support/mkcert" ✨

Created a new certificate valid for the following names 📜
 - "10.0.10.1"
 - "router.local"
 - "edgerouter.local"

The certificate is at "./10.0.10.1+2.pem" and the key at "./10.0.10.1+2-key.pem"

Combine Key and Certificate File to .pem encoded file.

$ cat 10.0.10.1+2-key.pem  10.0.10.1+2.pem > server.pem

Install Certificate

Start by making a backup copy of the existing certifcate on the router.

In your router terminal session:

$ sudo cp /etc/lighttpd/server.pem /etc/lighttpd/.old_server.pem

In your machine terminal session:

$ scp /Users/username/Downloads/server.pem username@10.0.10.1:/home/username/server.pem
Welcome to EdgeOS

By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.

username@10.0.10.1's password:
server.pem        

In your router terminal session:

$ sudo cp /home/username/server.pem /etc/lighttpd/server.pem

# Kill Router Web GUI server

$ sudo kill -SIGINT $(cat /var/run/lighttpd.pid)

# Start it up again
$ sudo /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf

$ exit
logout
Connection to 10.0.10.1 closed.

You should now be able to point your browser at the Router Web GUI and see a valid TLS secured connection.

Special thanks to Filippo Valsorda for creating mkcert.

This tutorial will show you how to generate and secure SSH keys on macOS Sierra(10.12),High Sierra(10.13), and Mojave (10.14). This should also work on macOS 11, 12, 13, 14 as well. SSH Keys offer a secure way to log into your servers or other machines without requiring a password. They increase convenience as well as security by being significantly more resistant to brute-force attacks.

SSH (Secure Shell) is a protocol most often used for remote management and for file transfer often denoted as sFTP(Secure File Transfer Protocol). When accessing remote server such as a Remote VPS it is recommended to use SSH with PKE(Public Key Exchange) which uses a key-pair where the public key is provided to the server and the private key in stored on your machine.

SSH Keys can be automatically added to servers during the installation process by adding your public keys to the Digital Ocean or Vultr control panel. It is important to remember that these are your public keys only (usually denoted with .pub), you should never expose private keys.

Key Types

There are several different key types that can be selected. Using -t argument upon generation such as ssh-keygen -t ed25519. The ED25519 key type using elliptic-curve signature which offers is more secure and more performant than DSA or ECDSA. Most modern SSH software (such as OpenSSH since version 6.5) supports the ED25519 key type, but you may still find some software is incompatible, thus the default key type is still RSA.

The default key type is 2048-bit RSA which offers good security and compatibility. For higher security, you can choose a larger key size using the -b argument on generation such as ssh-keygen -b 4096 to create a 4096-bit RSA key pair.

Key Generation

To generate an SSH key, you will need to open your terminal of choice (pre-installed is Terminal.app found in Applications > Utilities > Terminal). We will be creating a key using the new creation algorithm to address the issues highlighted in the article: "The default OpenSSH key encryption is worse than plaintext".

To create a 4096-bit RSA key pair you will enter:

$ ssh-keygen -o -b 4096

You should then see,

Generating public/private rsa key pair.
Enter file in which to save the key (/Users/username/.ssh/id_rsa):

Pressing Enter/Return will save your new key pair to this default location, which is recommended. You will then have the option to create a passphrase, which will encrypt the key so that it cannot be used without authorization. Using a passphrase is recommended.

Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in id_rsa.
Your public key has been saved in id_rsa.pub.
The key fingerprint is:
SHA256:0irBXp+xKwT5e0ZFklbEVkzxu0Bzv9PmvstFD5w6zlQ username@Your-Mac.local
The key's randomart image is:
+---[RSA 4096]----+
|         =o++.   |
|        + + ..   |
|     . . +  o o  |
|   .o  .  .. + + |
|    ooo S.  . E o|
|   . oo+.+   + ++|
|    o..o+   + .o=|
|     .o o. + ..oo|
|       +.   o  ==|
+----[SHA256]-----+

At this point, your keypair has been created and stored in `~/.ssh/id_rsa` if you chose to store in the default location.

Add new keypair to SSH agent

To make the key available to the system and store the passphrase in the system keychain we will need to complete several more steps.

Note: This is only needed if you would rather not be prompted for the key passphrase each time it is used.

Enter ssh-add -K ~/.ssh/id_rsa. You will then be prompted for the passphrase if you created one and should see the following:

Identity added: id_rsa (username@Your-Mac.local)

If you would like to use this SSH key for login on a server that has already been created you can use the ssh-copy-id tool to store the public key on the server you would like to access.

Add new key to remote server
Using ssh-copy-id:

$ ssh-copy-id -i ~/.ssh/id_rsa root@192.0.2.1\

It will request your login password since the remote server is not yet aware of your key. You should see the following:

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"

Number of key(s) added:        1

Now try logging into the machine, with: "ssh 'root@192.0.2.1'"
and check to make sure that only the key(s) you wanted were added.

You can now attempt to login to the remote server with ssh root@192.0.2.1 and you should be connected without requiring a password.