8 ms·
Twitter Activist Security
- EekSnakePond 10y agoPerfect. By engaging in hyper paranoia, the intoxication and inherit mimetic violence found in identity politics is gradually thwarted. Welcome to what the Right was doing under Obama for the past 8 years during the Leftist heyday of doxxing the "unpure". Very much looking forward to your latent realization that your SJW undermining of Linux communities cut your own throat. :) Social justice needs child-like recognition in order to thrive. You can't just jump into hermit-esque opsec without paying the philosophical toll.
- akjainaj 10y agoI'm happy for the next four years. All the enemies of the state are uncovering themselves for what they are. This article, written by an incognito Jewish Marxist agitator, doesn't really show having much balls, though; but this is a future doxxing that I'll really enjoy. edit: it was a joke ffs lol
- erelde 10y ago> This article, written by an incognito Jewish Marxist agitator the grugq isn't incognito.
- dtg 10y agoGrugq has been a pretty consistent and coherent commenter on cyber security issues for some time now. Your "Jewish Marxist agitator" comment is pretty inflammatory and seemingly without reason or backup. I'm glad trolls are uncovering themselves though.
- grugq 10y agoGuess I'll save my "dialectical materialism and Torah: an incognito exploration of Jewish working class identity" for a later post...
- sctb 10y agoWe've banned this account for continuing to violate the guidelines after we've asked you repeatedly to stop. What we've said before still applies: Hacker News is not the place for such political trolling and other incivilities.
- kyrre 10y agointeresting read, but isn't this written by the same guy who was selling exploits to 3rd world dictators? edit: it appears he was a "broker" / middleman. some moral high ground. http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/#7437d3e69448 http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-th...
- deleted 10y ago[deleted]
- grugq 10y agono. never sold anything to "3rd world dictators."
- deleted 10y ago[deleted]
- angry-hacker 10y agoBut you feel morally ok by selling exploits? You never know how are they being used, how come you're so proud of it?
- nickpsecurity 10y agoI was originally against it but now I'm neutral on it. Most of the exploits are intentionally put there by companies that have enough money & expertise to avoid them. The bigger ones have enough money to make compilers and CPU's that make the software immune to code injection. Microsoft even has Steve Lipner who did one of projects (below) that taught me high-assurance security. Like them, his philosophy is shipping product over correctness since that is what market rewards. As for market, they almost always buy something insecure over something more secure if even the slightest extra benefit in insecure thing. You can't get them to use something secure even when it's free (eg Signal). So, what you should be thinking is you and/or other people are using and financially rewarding companies that intentionally leave vulnerabilities in software. Is that morally right? Probably not. Is someone making money off those vulnerabilities morally right? Probably not. The first seems worse, though, as the vulnerability market would be tiny if it wasn't happening. They'd command higher prices but even that would mean less damage. http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf Note: Compare Design and Assurance sections to how commercial or FOSS VM's are built today. Regular "security" is a joke.
- Perceptes 10y agoOne comment and two questions: I wish I had something important enough to say to be able to put this advice to use! How important is the physical location you work from? Should you religiously avoid working out of a place that is associated with you, such as your home or office? Should you avoid places that are near where you live, and if so, how far should you go? Or is Tor sufficient for masking your physical location in all cases? I'm very interested in how the grugq is able to have had such a public persona for so long and remain anonymous—including speaking at conferences in person, I understand. Obviously, he is an expert, but that doesn't really explain _how_. He writes prolifically on Twitter and sometimes other mediums. How is this large body of content not subject to stylistic analysis? Information is known about him, such as where he lives and what he does for a living. That seems extremely revealing. How has he been able to speak at conferences, quite literally tying his physical identity to this anonymous persona, let alone traveling to the conference in the first place?
- StavrosK 10y agoFor the former, yes, I believe Tor is enough to hide your physical location. The times you tweet/write would be more worrisome, but maybe that can be automated. As for the second, I didn't know he's anonymous. I'd imagine it would be very difficult to maintain anonymity when you need to board a plane. You're definitely not anonymous to someone who cares enough to follow you, I'd bet.
- grugq 10y ago1) physical location It depends a lot on how intense you expect the investigation to be. Strong protection comes from using a network connection that is not linked to you, in addition to using technology that masks your IP address. If there are CCTV, then that increases the risk exposure, as does bringing a mobile phone with you. It is a lot of trade offs based on the threat model. In the case of a resistance twitter account, I suspect that simply using Tor Browser Bundle will be sufficient, but it is hard to make a blanket statement. 2) anonymous I'm not anonymous, I'm pseudonymous. There are hundreds, or thousands, of people that know my "real" name. It isn't important, I don't use it for anything. The only people who do use it are my mother and my bank. I've been using the same handle "grugq" for over two decades. Everything I have done is under my handle. I don't maintain two identities, I have only one -- the grugq. You can't link my handle with another identity because there isn't one. Over a decade ago I was at a small art college where +Fravia was giving a talk. After his speech, we went for a walk and a chat. He lamented that all the hackers were dropping their handles and going by their real names for commercial reasons (so they could get jobs, basically.) He said to me, "you and I are the only ones left still using our handles." A few years later he died of cancer. So, now I am the only one left. People who know my name, know where I live and know that it would increase my risk profile to expose me. They respect my wishes to use my handle, and they respect my privacy. It is no great secret, it is simply the choice I have made, an obligation to an old dead friend, and also one that could have very real security implications. It always puzzles me why people care so much. A name is a name. (also, you have no idea what I do for a living. lol)
- ShinyCyril 10y agoI'm glad they included something about mental health. There was an interesting post on /r/privacy the other day of someone with burnout from the paranoia of government surveillance [1]. I browse /r/privacy from time to time and am worried by the threat models that many people on there have. I don't know the reasons for their threat model, but I suspect a large number of people don't have any solid reason for such a rigorous model other than paranoia. The cognitive load of maintaining privacy at that level must just be overwhelming. [1] https://www.reddit.com/r/privacy/comments/5qfpb6/im_exhausted/ https://www.reddit.com/r/privacy/comments/5qfpb6/im_exhauste...
- viraptor 10y agoI can't find the tweet easily now, but the original reason for including that was because people apparently have problems handling disconnected personalities for a long time. the_grugq says this affected undercover people. Edit: here's the tweet with some interesting comments https://twitter.com/thegrugq/status/824949499688726528 https://twitter.com/thegrugq/status/824949499688726528
- grugq 10y agoyeah, a study of the literature will show that it is a constant problem for people that start to assume a secret identity. There is a class of people that are actually better at this than others[0]. For police that go undercover flow long periods, they run the risk of "going native" [1][2]. There was Tolkachev[3][4] who insisted on personal meetings rather than dead drops (although it was ultimately Alrich Ames' betrayal that doomed him, not KGB surveillance or tradecraft errors.) Karl Fuchs described his mental trauma of being both a Western atomic scientist and a Soviet Atomic Spy[5]. There are many more references available, but it is seldom discussed. This is one of the reasons that the CIA (and other secret agencies) become so insular. The members are unable to be open with anyone else except each other, and so they tend to stick together. Theres more on the extensive work that RUC and Special Branch had to do to maintain the sanity of the IRA informants they were running. There is a constant refrain, human beings do not operate well with secret identities under high stress environments for long periods of time. [0] http://www.slate.com/articles/business/the_dismal_science/2015/04/sex_and_the_workplace_do_closeted_gays_and_lesbians_cluster_in_certain_professions.html http://www.slate.com/articles/business/the_dismal_science/20... [1] Undercover and Alone [2] Lu-CiFER: Memoirs of a Mongol [3] The Billion Dollar Spy [4] https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol47no3/article02.html https://www.cia.gov/library/center-for-the-study-of-intellig... [5] https://archive.org/stream/sovietatomicespi1951unit/sovietatomicespi1951unit_djvu.txt https://archive.org/stream/sovietatomicespi1951unit/sovietat...
- camperman 10y agoThe principles The Grugq outlines here are explained in lots more detail in his OpSec for Hackers presentation. It includes a detailed analysis of how Lulzsec violated these principles which is why they were caught: http://www.slideshare.net/grugq/opsec-for-hackers http://www.slideshare.net/grugq/opsec-for-hackers
- r721 10y agoI recall Twitter was suspending accounts for logins using Tor - I assume, it's no longer true? Or it's sufficient to provide phone number to safely login via Tor?
- mysticmarvel 10y agoYou must verify your account with a mobile phone if you sign up using Tor. You can use an email address if it's not over Tor.
- Shivetya 10y agoI would go so far as to make sure you know who is near you when you engage in any such activities because when a government begins to limit its suspects to a small number of people they can catch you in the most innocuous places; like a public library
- saycheese 10y agoDoes Twitter have a Tor .onion address for accessing their system?
- intoverflow2 10y agoConsidering the fact they lock accounts for "suspicious behaviour" that don't provide a phone number and keep it that way until you do provide one. I'd say they don't care about your privacy.
- angry_octet 10y agoBecause it is always possible you will fail your Tor discipline, I would add some defense-in-depth aspects, in case your browser is compromised and your network address is revealed. - Use separate hardware. A cheap laptop and a cheap phone. - Burn the receipt and chuck the packaging. - Cash. Pay in cash. - Buy from small stores with no CCTV, or better yet, from people like migrant workers. - You can buy stored value cards (debit cards) without ID, and some you can load with cash at ATMs. (Also good to buy from travellers.) - Once you have a debit card you can pay for data without going to a store. - If you turn on your Wifi tethering and other devices are in range you have created an event in their logs. Just use a cable. If you must, change the SSID regularly and use Android 6 which has MAC randomisation. Never have any other SSIDs saved, especially not your home network. - Turn the phone off when not in use. Removing the battery is advisable. - Don't connect to 3G near your home or work or where there is pervasive CCTV or not many people. - If your commute is logged (via your cellphone, number plate recognition / tolling, personally identified public transport like Oyster cards) then your location can be correlated against when your persona was online. - It might seem that transmitting from different locations is a good idea. But not really, it gives a more unique history. - Run Tor on the laptop. Run nothing on the phone, its just a radio. - If you want to use Signal, get another burner phone. - Invest in some numbered wafer seals or tamper bags. Keep your kit in them when cached. - Don't tell fibs to federal agents. Record all interactions with them.
- stevarino 10y agoYou make a lot of interesting points with frequency analysis, but these facts can be used for your benefit. For example, if you're concerned about transit systems being used to identify you, try leaving the devices in a safe location for several hours and have them respond on a timer system. Any analysis ran across millions of users will end up filtering you out, lowering your own suspicion factor and increasing the adversaries uncertainty when facing big data. How a system fails is just as important as how it performs when it comes to security, the young-adult novel Little Brother by Doctorow goes into this in good detail.
- angry_octet 10y ago
- sogen 10y agoNice seven samurai avatar :)
- protomyth 10y ago#8 cropping might not be adequate as many photos have meta-data attached (e.g. EXIF) - you probably want to at least view that or delete it entirely before posting a picture.