6 ms·

I have a feeling the people who are very serious about OpSec never use the net.

mseebach 10y ago
The "OP" in OPSEC means operational. The field is entirely about securing operations. Not performing an operation at all may be inherently secure (as relates to the operation) but is entirely orthogonal to the field of OPSEC.
- tc313 10y ago
  I think he means using thumb drives and burkas instead of the Internet.
deleted 10y ago
[deleted]
Bartweiss 10y ago
I think this comes back to the line about "identifying minimum security for your threat level". If you want to pass 'safe' data to lots of people or over long distances, you use the web. Throw it on pastebin via Tor, a burner computer, and Starbucks wifi. If you need to deal in live meetings or other identity-compromising communication (like a big drug deal) you probably want to deal in flashdrives and couriers.
nickpsecurity 10y ago
We rarely used the Internet for anything if we were doing something questionable. If we did, we did it through 3rd parties' connections with or without proxies depending on what that might show. My scheme was covert communications embedded in HTTPS to blend in, remailers through various jurisdictions that don't cooperate, face-to-face for most stuff, dead drops, calls with lineman's headset, snail mail of CD's surrounded by coupons etc, and so on. Stuff that draws no attention or has strong security against likely threat profile. Not sure how much of it would work today but no tech and low tech methods are still best. Example was bin Laden succeeding with nothing more than trusted couriers, air gaps, and USB drives until he got ratted out by someone. What you're seeing with most posts labeled "OPSEC" is mainstream security in action where something gets popular and people run with it. Grugq at least usually has good advice embedded in. Real OPSEC avoids visible encryption, things prone to attack like Tor, and so on. Unless you want them looking directly at you or absolutely have to be all-online. Which is another, tougher type of OPSEC altogether. Mafia has the most experience with the former. I'm not sure I've seen an example of the latter I trust. "Strong OPSEC means low efficiency, while high efficiency necessitates weak OPSEC." This is the best statement in the post. It's always true. It's why most "OPSEC" people use in practice sucks. ;)
- armitron 10y ago
  "My scheme was covert communications embedded in HTTPS to blend in, remailers through various jurisdictions that don't cooperate, face-to-face for most stuff, dead drops, calls with lineman's headset, snail mail of CD's surrounded by coupons etc, and so on. Stuff that draws no attention or has strong security against likely threat profile. Not sure how much of it would work today but no tech and low tech methods are still best." This is way off the mark I think, how can something that requires _physical presence_ be best? Bringing up Bin Laden is not a good example here, as the particulars of his case made using cyber extremely difficult. The Internet is absolutely and by far the best way for anonymous and/or covert communications between individuals or groups, as long as they possess domain expertise. And this is only going to get better, not worse, mass-surveillance notwithstanding, due to the proliferation of information. That doesn't necessarily mean everyone has to use TOR and PGP, just that it's very easy to _hide_ amidst the noise and not compromise on OPSEC. Lots of ways to do that.
  - nickpsecurity 10y ago
    How can it be way off the mark if such methods have worked for decades while online communities keep getting decloaked and secrets inisibly copied? I think what already worked should be baseline go compare against. Plus, you can use Tor within my model so long as it's an untrusted layer among others. Important they dont see you using it. Bin Laden was a good example because he likewise employed good, pre-Internet OPSEC. He stayed away from electronic communications mediums, used physical medium for data storage, moved it with trusted couriers, and couriers activity looked normal to observers. These principles are compatible with my recommendations and held off the most powerful, SIGINT attacker in existence. They can work for others, too. ;) "That doesn't necessarily mean everyone has to use TOR and PGP, just that it's very easy to _hide_ amidst the noise and not compromise on OPSEC." Snowden links directly contradict you. Such people and data stick out like a sore thunb. They also collect what encrypted data tgeg can for five years. People using my methods would likely have been filtered and ignored. Or, avoiding the net, they'd have never been seen at all.
    - armitron 10y ago

The "OP" in OPSEC means operational. The field is entirely about securing operations. Not performing an operation at all may be inherently secure (as relates to the operation) but is entirely orthogonal to the field of OPSEC.

tc313 10y ago
I think he means using thumb drives and burkas instead of the Internet.

deleted 10y ago

[deleted]

Bartweiss 10y ago

I think this comes back to the line about "identifying minimum security for your threat level". If you want to pass 'safe' data to lots of people or over long distances, you use the web. Throw it on pastebin via Tor, a burner computer, and Starbucks wifi. If you need to deal in live meetings or other identity-compromising communication (like a big drug deal) you probably want to deal in flashdrives and couriers.

nickpsecurity 10y ago

We rarely used the Internet for anything if we were doing something questionable. If we did, we did it through 3rd parties' connections with or without proxies depending on what that might show. My scheme was covert communications embedded in HTTPS to blend in, remailers through various jurisdictions that don't cooperate, face-to-face for most stuff, dead drops, calls with lineman's headset, snail mail of CD's surrounded by coupons etc, and so on. Stuff that draws no attention or has strong security against likely threat profile. Not sure how much of it would work today but no tech and low tech methods are still best. Example was bin Laden succeeding with nothing more than trusted couriers, air gaps, and USB drives until he got ratted out by someone. What you're seeing with most posts labeled "OPSEC" is mainstream security in action where something gets popular and people run with it. Grugq at least usually has good advice embedded in. Real OPSEC avoids visible encryption, things prone to attack like Tor, and so on. Unless you want them looking directly at you or absolutely have to be all-online. Which is another, tougher type of OPSEC altogether. Mafia has the most experience with the former. I'm not sure I've seen an example of the latter I trust. "Strong OPSEC means low efficiency, while high efficiency necessitates weak OPSEC." This is the best statement in the post. It's always true. It's why most "OPSEC" people use in practice sucks. ;)

armitron 10y ago
"My scheme was covert communications embedded in HTTPS to blend in, remailers through various jurisdictions that don't cooperate, face-to-face for most stuff, dead drops, calls with lineman's headset, snail mail of CD's surrounded by coupons etc, and so on. Stuff that draws no attention or has strong security against likely threat profile. Not sure how much of it would work today but no tech and low tech methods are still best." This is way off the mark I think, how can something that requires _physical presence_ be best? Bringing up Bin Laden is not a good example here, as the particulars of his case made using cyber extremely difficult. The Internet is absolutely and by far the best way for anonymous and/or covert communications between individuals or groups, as long as they possess domain expertise. And this is only going to get better, not worse, mass-surveillance notwithstanding, due to the proliferation of information. That doesn't necessarily mean everyone has to use TOR and PGP, just that it's very easy to _hide_ amidst the noise and not compromise on OPSEC. Lots of ways to do that.
- nickpsecurity 10y ago
  How can it be way off the mark if such methods have worked for decades while online communities keep getting decloaked and secrets inisibly copied? I think what already worked should be baseline go compare against. Plus, you can use Tor within my model so long as it's an untrusted layer among others. Important they dont see you using it. Bin Laden was a good example because he likewise employed good, pre-Internet OPSEC. He stayed away from electronic communications mediums, used physical medium for data storage, moved it with trusted couriers, and couriers activity looked normal to observers. These principles are compatible with my recommendations and held off the most powerful, SIGINT attacker in existence. They can work for others, too. ;) "That doesn't necessarily mean everyone has to use TOR and PGP, just that it's very easy to _hide_ amidst the noise and not compromise on OPSEC." Snowden links directly contradict you. Such people and data stick out like a sore thunb. They also collect what encrypted data tgeg can for five years. People using my methods would likely have been filtered and ignored. Or, avoiding the net, they'd have never been seen at all.
  - armitron 10y ago