4 ms·

You are making wide proclamations and generalizations with nothing to back them up, this is not the mark of someone with a deep understanding of the subject mat

You are making wide proclamations and generalizations with nothing to back them up, this is not the mark of someone with a deep understanding of the subject matter. You're also all over the place, rather than concentrating on the point I made [physical presence]. What worked for decades, for some definition of worked -> debacles are numerous [when the Internet didn't even exist or wasn't as widely deployed/used as it is now] doesn't mean it is best _today_. This is a fool's argument, also see what Taleb has to say about tail events. Moreover, the OPSEC details of most successful groups and individuals that use the Internet to communicate, will by definition, rarely become public. We can learn by example from failures but we can't learn by example from success _unless we are insiders_. I said the particulars in the Bin Laden case are important and made cyber hard to use. That doesn't mean trusted couriers and physical storage are a good idea for the rest of us. Re: Snowden You yourself said you were using comms embedded in HTTPS to avoid sticking out like a sore thumb, how do Snowden docs contradict what I said? Read [and try to comprehend] my post again please. To reiterate, I think domain expertise gives individuals a certain degree of confidence and a solid knowledge base that they can use to build their OPSEC strategies. What would you gamble your life on if you had to, meatspace domain expertise [with a huge number of totally unknown factors/capabilities] or Internet [some unknown factors but also lots of remedies]? For most of us the answer is obvious. When I go out, I can never be confident I'm not being followed, recorded in various ways or leaking biometric evidence. Online, I can operate with an assumption of full compromise _and still come up with useful OPSEC strategies_.

nickpsecurity 10y ago
" rather than concentrating on the point I made [physical presence]" A method for surveilling people's activities ideally has these properties: 1. Delivers intel on as many targets as possible. 2. Requires little to no effort on operator's part. 3. Is easy to deploy multiple times or stays persistently. 4. Doesn't reveal presence of surveillance. 5. Takes a lot of work to avoid. 6. Has reasonable cost. A method for concealing communications or activities has at least these properties in this order (except for 5 which always helps): 1. Prevents detection of activity entirely against likely eavesdropping methods in use. 2. Makes the eavesdropping difficult to attempt 2-1. Focused instead of mass surveillance. 2-2. Expensive. 2-3. Physical. 2-4. Requires talent instead of brainless drones. 3. Increases odds of person being surveilled detecting the surveillance. 4. Allow for countermeasures to end or recover from the surveillance. 5. Is deniable and inexpensive. So, let's look at average person using common recommendations. The average person will be using Torbrowser, TAILS, Windows + Tor, Mac + Tor, Linux desktop + Tor, or main mobile OS + Tor. They will not be professionals at attacking or securing systems like the criminal or government hackers tasked with uncloaking them. The attacks on Tor, by NSA & by academics, apply where many users get unmasked remotely in a way they never see. They can all be surveilled at once by NSA's existing infrastructure. Outside this, the FBI deanonymized users by using a browser 0-day (endpoint attack). Five Eyes, esp NSA, have 0-days on each desktop and mobile OS with high, market share per leaks. We regularly see Russian and Chinese hackers breach them in the news. We also see all kinds of hackers breach systems in general plus lots of bad decisions by users. The risk of a stealthy, mass, inexpensive leak of people using digital communications is very high whereas the odds of them outthinking average surveillance is low and targeted hacking very low. So, let's look at people using meatspace with methods like I described above and simple guides on their use. They've spent their whole life learning how to tell when people are watching them, nervous, or just acting unusual. They have numerous ways of blending into a crowd where WiFi or drops are available but with limited camera coverage. They can learn the traffic patterns of the area to see if anyone sticks out. Likewise, there's private spots to stash a long-range antenna and camera to do the same from a distance. Many know how to ditch evidence or pay for stuff with cash. Keeping their name and I.P. out of it reduces odds they'll be seen where no tech or HTTPS-style comms increases odds surveillance ignores them entirely as mere Internet, background noise. These methods were and are used successfully by many crooks and spies... today just like decades ago with drops, radios, and countersurveillance... while "smart" people, their OS's, and anonymity software get owned on computers quite regularly. So, the average person looks to be better off avoiding the Internet, executable media, or anything that draws attention when trying concealed communication with other average people. It's easier for them to follow this advice like that than learn arcane, technical information that changes constantly. It also turns inexpensive, stealthy, mass attacks into requiring footsoliders focused on one person or a small group at a time risking detection constantly. That's also with no guarantee they'll keep whatever gains they acquire in intelligence collection. That's a significant increase in effectiveness versus new methods where you trust things that can be and are often invisibly hacked by remote attackers. "When I go out, I can never be confident I'm not being followed, recorded in various ways or leaking biometric evidence. Online, I can operate with an assumption of full compromise _and still come up with useful OPSEC strategies_." No you can't. If you can't trust or mitigate physical risks, then you can be compromised in the physical realm to defeat your software countermeasures. There's whole Snowden slides dedicated to those things. Not to mention books by experts in hacking, black bag jobs (esp TSCM), infiltration (esp spec ops), and crime (esp B&E's or cons). Physical security and lack of subversion is a prerequisite for and/or major part of online security. So, what you're really doing is hoping you're not worth their time or money at all plus no flaws are found in your hardware, firmware, OS, browser, Tor, or any other running software. Might be true but lots of counterevidence on software side. ;)
- armitron 10y ago
  This was never about the "average person" (that has clearly already lost, especially in USA) but the _dedicated_ practitioner with domain expertise. Most physical risks that one would need to mitigate, completely disappear when one _is not operational_ in meatspace, you assume this is always the case. It is not. I'm going to stop here, I'd ask you to read again what _you wrote_ esp the parts about blending into crowds, learning area traffic patterns etc. These would be well-placed in Hollywood movies, but I fear you're deluding yourself in a major way if you believe they're remotely close to being practical.
  - nickpsecurity 10y ago
    You've hit me with at least 3 ad hominems but no counter-evidence so far. You should stop. While you're at it, you should look up one of those Tor papers where they say they deanonymize (percentage here) traffic for all hiding in the Tor network. Then come back with the attack on my methods that deanonymized the same percentage. You won't because it's delusional to think average or experts will be safer given all of them that were already compromised online (including Tor) remotely, stealthily, and cheaply. Versus the gangs and spooks kicking same LEO's asses with stuff simple as shortwave radio in random places and affiliated couriers delivering messages. Or has the NSA remotely uncovered a third to half of all terrorists, cartel members, or IP thieves? Wait, they're still going strong by the billions in cash and damage with impunity.
    - armitron 10y ago
      TOR de-anonymization can be factored into a working OPSEC strategy. The OP article itself _demonstrates a pedophilia ring that did not get compromised due to correct usage of TOR and other measures_. I also love your constant assumptions about .. everything really. And you're supposed to be some sort of expert? I think not.

nickpsecurity 10y ago

" rather than concentrating on the point I made [physical presence]" A method for surveilling people's activities ideally has these properties: 1. Delivers intel on as many targets as possible. 2. Requires little to no effort on operator's part. 3. Is easy to deploy multiple times or stays persistently. 4. Doesn't reveal presence of surveillance. 5. Takes a lot of work to avoid. 6. Has reasonable cost. A method for concealing communications or activities has at least these properties in this order (except for 5 which always helps): 1. Prevents detection of activity entirely against likely eavesdropping methods in use. 2. Makes the eavesdropping difficult to attempt 2-1. Focused instead of mass surveillance. 2-2. Expensive. 2-3. Physical. 2-4. Requires talent instead of brainless drones. 3. Increases odds of person being surveilled detecting the surveillance. 4. Allow for countermeasures to end or recover from the surveillance. 5. Is deniable and inexpensive. So, let's look at average person using common recommendations. The average person will be using Torbrowser, TAILS, Windows + Tor, Mac + Tor, Linux desktop + Tor, or main mobile OS + Tor. They will not be professionals at attacking or securing systems like the criminal or government hackers tasked with uncloaking them. The attacks on Tor, by NSA & by academics, apply where many users get unmasked remotely in a way they never see. They can all be surveilled at once by NSA's existing infrastructure. Outside this, the FBI deanonymized users by using a browser 0-day (endpoint attack). Five Eyes, esp NSA, have 0-days on each desktop and mobile OS with high, market share per leaks. We regularly see Russian and Chinese hackers breach them in the news. We also see all kinds of hackers breach systems in general plus lots of bad decisions by users. The risk of a stealthy, mass, inexpensive leak of people using digital communications is very high whereas the odds of them outthinking average surveillance is low and targeted hacking very low. So, let's look at people using meatspace with methods like I described above and simple guides on their use. They've spent their whole life learning how to tell when people are watching them, nervous, or just acting unusual. They have numerous ways of blending into a crowd where WiFi or drops are available but with limited camera coverage. They can learn the traffic patterns of the area to see if anyone sticks out. Likewise, there's private spots to stash a long-range antenna and camera to do the same from a distance. Many know how to ditch evidence or pay for stuff with cash. Keeping their name and I.P. out of it reduces odds they'll be seen where no tech or HTTPS-style comms increases odds surveillance ignores them entirely as mere Internet, background noise. These methods were and are used successfully by many crooks and spies... today just like decades ago with drops, radios, and countersurveillance... while "smart" people, their OS's, and anonymity software get owned on computers quite regularly. So, the average person looks to be better off avoiding the Internet, executable media, or anything that draws attention when trying concealed communication with other average people. It's easier for them to follow this advice like that than learn arcane, technical information that changes constantly. It also turns inexpensive, stealthy, mass attacks into requiring footsoliders focused on one person or a small group at a time risking detection constantly. That's also with no guarantee they'll keep whatever gains they acquire in intelligence collection. That's a significant increase in effectiveness versus new methods where you trust things that can be and are often invisibly hacked by remote attackers. "When I go out, I can never be confident I'm not being followed, recorded in various ways or leaking biometric evidence. Online, I can operate with an assumption of full compromise _and still come up with useful OPSEC strategies_." No you can't. If you can't trust or mitigate physical risks, then you can be compromised in the physical realm to defeat your software countermeasures. There's whole Snowden slides dedicated to those things. Not to mention books by experts in hacking, black bag jobs (esp TSCM), infiltration (esp spec ops), and crime (esp B&E's or cons). Physical security and lack of subversion is a prerequisite for and/or major part of online security. So, what you're really doing is hoping you're not worth their time or money at all plus no flaws are found in your hardware, firmware, OS, browser, Tor, or any other running software. Might be true but lots of counterevidence on software side. ;)

armitron 10y ago
This was never about the "average person" (that has clearly already lost, especially in USA) but the _dedicated_ practitioner with domain expertise. Most physical risks that one would need to mitigate, completely disappear when one _is not operational_ in meatspace, you assume this is always the case. It is not. I'm going to stop here, I'd ask you to read again what _you wrote_ esp the parts about blending into crowds, learning area traffic patterns etc. These would be well-placed in Hollywood movies, but I fear you're deluding yourself in a major way if you believe they're remotely close to being practical.
- nickpsecurity 10y ago
  You've hit me with at least 3 ad hominems but no counter-evidence so far. You should stop. While you're at it, you should look up one of those Tor papers where they say they deanonymize (percentage here) traffic for all hiding in the Tor network. Then come back with the attack on my methods that deanonymized the same percentage. You won't because it's delusional to think average or experts will be safer given all of them that were already compromised online (including Tor) remotely, stealthily, and cheaply. Versus the gangs and spooks kicking same LEO's asses with stuff simple as shortwave radio in random places and affiliated couriers delivering messages. Or has the NSA remotely uncovered a third to half of all terrorists, cartel members, or IP thieves? Wait, they're still going strong by the billions in cash and damage with impunity.
  - armitron 10y ago
    TOR de-anonymization can be factored into a working OPSEC strategy. The OP article itself _demonstrates a pedophilia ring that did not get compromised due to correct usage of TOR and other measures_. I also love your constant assumptions about .. everything really. And you're supposed to be some sort of expert? I think not.