3 ms·

I used to have my iPhone backup to my laptop, then my laptop back up to an encrypted USB hard drive, and that encrypted USB hard drive swapped out when I went o

I used to have my iPhone backup to my laptop, then my laptop back up to an encrypted USB hard drive, and that encrypted USB hard drive swapped out when I went out for groceries in a safe deposit box at my credit union. This is probably not a sustainable backup strategy, but you'd be amazed how many people abuse their access and how much power you can rapidly accumulate with what one supervisor described as "CIA level opsec". (Just be careful -- if you get hit over the head and forget your master password, you're gonna have a bad time!!)

night-rider 4y ago
> CIA level opsec Describing your backup solution for all to see on a public forum is also bad opsec as attackers can learn of your strategy and go after all your stuff. They just need the names of the software, the services you backup to, and run exploits against them, and you're finished.
- greggarious 4y ago
  >Describing your backup solution for all to see on a public forum is also bad opsec as attackers can learn of your strategy and go after all your stuff. They just need the names of the software, the services you backup to, and run exploits against them, and you're finished. They did, in the sense someone hit me in the head, I didn't use a passphrase stored in said head for multiple weeks, and then forgot it. But in the scheme I just described there was no "service", just coping files from one device to another + storing the encrypted backups offsite. If I'd described say, using Spideroak rather than Dropbox, maybe your argument would make sense, but as it stands it looks like you're repeating things you read elsewhere to appear smart and garner... upvotes? Repuation? To what aim, I'm not clear. So to be crystal clear: absent a flaw in the crypto, what I described means there is no service to exploit, and on your end, repeating only what others have written without practicing tradecraft is also bad "opsec" (whatever that means) since it betrays how little you've actually done and how desperate you are to appear otherwise. Also, since ambiguity is apparently not well tolerated in "public forums" -- I never was in the CIA... but I can see why people make that mistake, since there's that core assumption of competency that only those of us who've seen how the sausage is made know is laughably untrue. Have a Happy New Year, I'm off to rewatch "Burn After Reading" :-)

night-rider 4y ago

> CIA level opsec Describing your backup solution for all to see on a public forum is also bad opsec as attackers can learn of your strategy and go after all your stuff. They just need the names of the software, the services you backup to, and run exploits against them, and you're finished.

greggarious 4y ago
>Describing your backup solution for all to see on a public forum is also bad opsec as attackers can learn of your strategy and go after all your stuff. They just need the names of the software, the services you backup to, and run exploits against them, and you're finished. They did, in the sense someone hit me in the head, I didn't use a passphrase stored in said head for multiple weeks, and then forgot it. But in the scheme I just described there was no "service", just coping files from one device to another + storing the encrypted backups offsite. If I'd described say, using Spideroak rather than Dropbox, maybe your argument would make sense, but as it stands it looks like you're repeating things you read elsewhere to appear smart and garner... upvotes? Repuation? To what aim, I'm not clear. So to be crystal clear: absent a flaw in the crypto, what I described means there is no service to exploit, and on your end, repeating only what others have written without practicing tradecraft is also bad "opsec" (whatever that means) since it betrays how little you've actually done and how desperate you are to appear otherwise. Also, since ambiguity is apparently not well tolerated in "public forums" -- I never was in the CIA... but I can see why people make that mistake, since there's that core assumption of competency that only those of us who've seen how the sausage is made know is laughably untrue. Have a Happy New Year, I'm off to rewatch "Burn After Reading" :-)