5 ms·

Is opsec really as hard as all these people make it seem? If I were planning something shady there's probably a lot of stupid questions I'd need to Google for,

Is opsec really as hard as all these people make it seem? If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something. I dunno if that would protect me, but it's more than seems to have been done here.

dx034 9y ago
Once you start using Tor and public Wifi, you admit that what you're doing is illegal. I think in these cases, many people tell themselves that they operate in some kind of gray area.
- cyphar 9y ago
  Which is why you should aim to always use Tor. That's one of the points made quite often by the Tor Project -- anonymity is useless if you only use it when you're doing something shady. The same applies to people who only encrypt shady emails, rather than encrypting all of them.
  - stouset 9y ago
    GP meant that doing so would force those involved to be forced to reconcile with themselves the illegality of their behavior. Although ironically I think in this case your point actually still stands.
  - PhasmaFelis 9y ago
    I thought it was considered rude (or at least hell on transmission quality) to play videos, etc. over Tor.
- kobeya 9y ago
  > Once you start using Tor and public Wifi, you admit that what you're doing is illegal. Thankfully that’s not how law works. Also, I use Tor everyday, for totally legal things I want to keep private.
  - austinjp 9y ago
    It's not how law works -- currently, in some countries. But it is how suspicion works, and governments in the US and UK, for example, seem highly suspicious of their populous.
    - kobeya 9y ago
      In the US at least the law cannot devolve into suspicion being adequate burden of proof. This is a constitutional protection that has been strengthened, not weakened by the courts over time, with only infrequent temporary setbacks. It's unfortunate that's not how things operate on the other side of the pond, but that's connected to why the US is the way it is.
      - foota 9y ago
        Sure, but it doesn't mean that the police can't start investigating people they find suspicious.
      - mattmanser 9y ago
        Aren't you talking about criminal rather than civil law?
      - dreamcompiler 9y ago
        Salina v. Texas changed that. It's a horrendous decision. https://www.theatlantic.com/politics/archive/2013/06/supreme-court-salinas-v-texas-ruling-explained/314145/ https://www.theatlantic.com/politics/archive/2013/06/supreme...
      - PhasmaFelis 9y ago
        > In the US at least the law cannot devolve into suspicion being adequate burden of proof. Once an attacker knows or has guessed at your identity, they can focus their investigation and make it much easier to find admissible evidence against you. It's best to keep them from ever thinking of you in the first place, if you can. That means not doing anything visibly suspicious.
  - 9y ago
ithkuil 9y ago
Or just from home on your own computer, instead of your company laptop.
- deleted 9y ago
  [deleted]
oulu2006 9y ago
Could also just use DuckDuckGo! its my normal search engine so nothing out of the ordinary to be using it.
deleted 9y ago
[deleted]
ihavebadopsec 9y ago
I personally think that true OPSEC is impossible in the long-term, simply because it's too easy to slip up or look suspicious from having good OPSEC. I've met a few people that had pretty good OPSEC (to the point where I believe they had fake passports, fake backstories and so on). But they all cracked eventually, in one way or another. However, adequate OPSEC is quite doable (but still hard). As with all security, threat models are key. Is your threat model a state actor trying to reveal something about you? Is it a prosecutor or investigator that is particularly vicious? Is it someone you're in a personal relationship with? Is it an unknown adversary with unknown capabilities? And how long do you need to have your strong OPSEC? And so on. With the right threat model and timeline laid out, having strong OPSEC is not impossible. But it's still quite hard. All of that being said, I would not classify any aspect of Levandowski's behaviour as being passable as OPSEC.
tryingagainbro 9y ago
>>If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something.. Google will never find out what you do on your home PC, especially using TOR /some other engine (Google displays the captcha often on TOR). Even if they did, it would be illegal and /or super secret and they'd never reveal it in court. Now, if shady means that NSA is after you, not so sure. However, if you want to steal from Google and use their computer to search their search engine from their office...I guess you deserve to get caught. Let's not forget that Google has a right to safeguard their trade secrets and when you accept the job, you agree to their terms.
rasz 9y ago
>do it on public library wifi yes, one of many ways to get 'anonymous' internet, another is cash buying old cable modem, even unprovisioned they still log into cmts and give you dns access(hint hint) >and download a Tor browser no, you go swap meet/yard sale/goodwill/craigslist(using library computer) and cash buy old used($100) working laptop with preinstalled windows

dx034 9y ago

Once you start using Tor and public Wifi, you admit that what you're doing is illegal. I think in these cases, many people tell themselves that they operate in some kind of gray area.

cyphar 9y ago
Which is why you should aim to always use Tor. That's one of the points made quite often by the Tor Project -- anonymity is useless if you only use it when you're doing something shady. The same applies to people who only encrypt shady emails, rather than encrypting all of them.
- stouset 9y ago
  GP meant that doing so would force those involved to be forced to reconcile with themselves the illegality of their behavior. Although ironically I think in this case your point actually still stands.
- PhasmaFelis 9y ago
  I thought it was considered rude (or at least hell on transmission quality) to play videos, etc. over Tor.
kobeya 9y ago
> Once you start using Tor and public Wifi, you admit that what you're doing is illegal. Thankfully that’s not how law works. Also, I use Tor everyday, for totally legal things I want to keep private.
- austinjp 9y ago
  It's not how law works -- currently, in some countries. But it is how suspicion works, and governments in the US and UK, for example, seem highly suspicious of their populous.
  - kobeya 9y ago
    In the US at least the law cannot devolve into suspicion being adequate burden of proof. This is a constitutional protection that has been strengthened, not weakened by the courts over time, with only infrequent temporary setbacks. It's unfortunate that's not how things operate on the other side of the pond, but that's connected to why the US is the way it is.
    - foota 9y ago
      Sure, but it doesn't mean that the police can't start investigating people they find suspicious.
    - mattmanser 9y ago
      Aren't you talking about criminal rather than civil law?
    - dreamcompiler 9y ago
      Salina v. Texas changed that. It's a horrendous decision. https://www.theatlantic.com/politics/archive/2013/06/supreme-court-salinas-v-texas-ruling-explained/314145/ https://www.theatlantic.com/politics/archive/2013/06/supreme...
    - PhasmaFelis 9y ago
      > In the US at least the law cannot devolve into suspicion being adequate burden of proof. Once an attacker knows or has guessed at your identity, they can focus their investigation and make it much easier to find admissible evidence against you. It's best to keep them from ever thinking of you in the first place, if you can. That means not doing anything visibly suspicious.
- 9y ago

ithkuil 9y ago

Or just from home on your own computer, instead of your company laptop.

deleted 9y ago
[deleted]

oulu2006 9y ago

Could also just use DuckDuckGo! its my normal search engine so nothing out of the ordinary to be using it.

deleted 9y ago

[deleted]

ihavebadopsec 9y ago

I personally think that true OPSEC is impossible in the long-term, simply because it's too easy to slip up or look suspicious from having good OPSEC. I've met a few people that had pretty good OPSEC (to the point where I believe they had fake passports, fake backstories and so on). But they all cracked eventually, in one way or another. However, adequate OPSEC is quite doable (but still hard). As with all security, threat models are key. Is your threat model a state actor trying to reveal something about you? Is it a prosecutor or investigator that is particularly vicious? Is it someone you're in a personal relationship with? Is it an unknown adversary with unknown capabilities? And how long do you need to have your strong OPSEC? And so on. With the right threat model and timeline laid out, having strong OPSEC is not impossible. But it's still quite hard. All of that being said, I would not classify any aspect of Levandowski's behaviour as being passable as OPSEC.

tryingagainbro 9y ago

>>If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something.. Google will never find out what you do on your home PC, especially using TOR /some other engine (Google displays the captcha often on TOR). Even if they did, it would be illegal and /or super secret and they'd never reveal it in court. Now, if shady means that NSA is after you, not so sure. However, if you want to steal from Google and use their computer to search their search engine from their office...I guess you deserve to get caught. Let's not forget that Google has a right to safeguard their trade secrets and when you accept the job, you agree to their terms.

rasz 9y ago

>do it on public library wifi yes, one of many ways to get 'anonymous' internet, another is cash buying old cable modem, even unprovisioned they still log into cmts and give you dns access(hint hint) >and download a Tor browser no, you go swap meet/yard sale/goodwill/craigslist(using library computer) and cash buy old used($100) working laptop with preinstalled windows