4 ms·

Years ago on an email list, we were advised to not say anything on list that we wouldn't want posted to the front page of the local newspaper. I still find this

by Mz 10y ago

Years ago on an email list, we were advised to not say anything on list that we wouldn't want posted to the front page of the local newspaper. I still find this to be a good rule of thumb. Humans are incredibly, horribly bad about writing stuff online like it is confidential, just between you and me -- even when it is a public forum that anyone can read, like Hacker News. Thinking of it in terms of published to the front page of the local paper can help people keep some of their worst, stupidest impulses down to a dull roar.

tptacek 10y ago
Yes. Email in general is an opsec nightmare, no matter what rules you come up with or what tools you use to protect it. It's the worst case scenario, a system that goes out of its way to make sure everyone has copies of everything. Above all else: do not create mailing lists for at-risk projects.
- Mz 10y ago
  We may be talking at cross purposes, but for clarity's sake: I was not recommending email. I was only recommending that noobs be told to think of any written communication in terms of "like it is being published to the front page of your local paper, where your husband, mother in law, and any personal enemy might see it" and, in this case, where any officials might see it as well. The list in question was mostly full time mothers. I was a full time mother, but also a military wife. I was more familiar with general information security practices than most of them. So this is the most noobie friendly line I know that seems helpful in trying to get inexperienced people to think before they speak/type. I also got annual InfoSec training while working for an insurance company for more than five years. Getting human beings to take InfoSec seriously is incredibly challenging. If you can't get that to happen, no amount of good tech will save you.
  - tptacek 10y ago
    I'm enthusiastically agreeing with you.
  - e12e 10y ago
    Indeed. The fundamental truth about communication is that you want at least one person to be able to read it. That person might be undercover, or get turned (just now thousands of (new) people can be threatened with deportation, for example). Doesn't mean one shouldn't organise, just be aware that all communication have risks.
  - type0 10y ago
    > Getting human beings to take InfoSec seriously is incredibly challenging. If you can't get that to happen, no amount of good tech will save you. I personally know one case when an assistant for a medical study forwarded a email list of participants to everyone when it was specifically complied that it was confidential. You would think that the person was fired because of this but no they literally couldn't find another employee that would take the job for such a low pay, so he kept his job and security didn't improve...

by Mz 10y ago

tptacek 10y ago

Yes. Email in general is an opsec nightmare, no matter what rules you come up with or what tools you use to protect it. It's the worst case scenario, a system that goes out of its way to make sure everyone has copies of everything. Above all else: do not create mailing lists for at-risk projects.

Mz 10y ago
We may be talking at cross purposes, but for clarity's sake: I was not recommending email. I was only recommending that noobs be told to think of any written communication in terms of "like it is being published to the front page of your local paper, where your husband, mother in law, and any personal enemy might see it" and, in this case, where any officials might see it as well. The list in question was mostly full time mothers. I was a full time mother, but also a military wife. I was more familiar with general information security practices than most of them. So this is the most noobie friendly line I know that seems helpful in trying to get inexperienced people to think before they speak/type. I also got annual InfoSec training while working for an insurance company for more than five years. Getting human beings to take InfoSec seriously is incredibly challenging. If you can't get that to happen, no amount of good tech will save you.
- tptacek 10y ago
  I'm enthusiastically agreeing with you.
- e12e 10y ago
  Indeed. The fundamental truth about communication is that you want at least one person to be able to read it. That person might be undercover, or get turned (just now thousands of (new) people can be threatened with deportation, for example). Doesn't mean one shouldn't organise, just be aware that all communication have risks.
- type0 10y ago
  > Getting human beings to take InfoSec seriously is incredibly challenging. If you can't get that to happen, no amount of good tech will save you. I personally know one case when an assistant for a medical study forwarded a email list of participants to everyone when it was specifically complied that it was confidential. You would think that the person was fired because of this but no they literally couldn't find another employee that would take the job for such a low pay, so he kept his job and security didn't improve...