4 ms·

Would you insert a USB drive into your "secure" non-Internet connected machine if it came via the mail? I wouldn't. Part of the security is trusting the chain

by Nrsolis 13y ago

Would you insert a USB drive into your "secure" non-Internet connected machine if it came via the mail? I wouldn't. Part of the security is trusting the chain-of-possession. Once you no longer have that, you have lost the trust.

tlrobinson 13y ago
What are you running, Windows XP? If you're paranoid, use a "burner" computer to copy the file to your "secure" machine, then verify a signature and decrypt. A Raspberry Pi would probably be suitable.
- Nrsolis 13y ago
  Uh huh. You gonna trust that setup with your life? Why not just continue to trust the one person you're SURE can tip you to compromise? If Miranda ever gets his laptop/phone/drives back, they're as good as useless. Straight to the trash heap.
malandrew 13y ago
A micro-sim card is extremely easy to hide somewhere and you can guarantee some chain of possession by wrapping the card in some way that would indicate tampering. On top of that, you don't need to send things from person of interest A to person of interest B. Instead person of interest A can mail the tamper proof sim to non-person of interest C who is friends with person of interest B. In addition, it can be mailed with the return address and name of trust friend of person A that is not a person of interest him or herself. The chances of such a package being intercepted is slim to none.
- Nrsolis 13y ago
  Uh, if you KNOW you're on their radar, you can't trust the mail. And you're mailing a letter which involves a whole lot of people carrying it and handling it. You've got a whole alphabet of persons. Remember that this is a state level adversary. You're not going to get one past them. They know ALL the tricks. ALL of them. Please don't talk tradecraft to me. You are doing it way wrong. There is a way to use the mail, but not the way you are describing it.
  - fractallyte 13y ago
    C'mon - you can't just tantalize readers with a reply like that and leave it hanging! Educate us...
    - Nrsolis 13y ago
      "The first thing they teach you is: If there is any doubt, there is no doubt." "Who teaches you?" "I can't remember. That's the second thing they teach you."
    - Nrsolis 13y ago
      This should get you started: Assume nothing. Never go against your gut. Everyone is potentially under opposition control. Don't look back; you are never completely alone. Go with the flow, blend in. Vary your pattern and stay within your cover. Lull them into a sense of complacency. Don't harass the opposition. Pick the time and place for action. Keep your options open.
  - malandrew 13y ago
    "Please don't talk tradecraft to me." Fine I'm doing it wrong, but you don't have to be a dick about it by waving around someone's lack of knowledge in this space and then saying they are not even knowledgable enough to interact with you. Doing so does not raise the level of discourse.
    - Nrsolis 13y ago
      Dude. This is serious stuff. Try and understand that for the better part of Western History, getting caught with anything that might be considered a tool of espionage or meeting with the wrong person might be a death sentence. Hence, tradecraft. These are skills designed to make things like hand-offs of materiel (called the brush-pass) or an surveillance detection run (to make sure you're not followed) a kind of second nature. I'm sorry you were offended but I took your comment to be quite flippant. There is a reason why we have professionals for this sort of thing. If you're truly interested, go read up on the subject. There is a lot of good info that details what the training is like, and what skills you need to do this sort of work. Double-O-Seven it ain't. Good tradecraft keeps you ALIVE. It's not for amateurs.

by Nrsolis 13y ago

tlrobinson 13y ago

What are you running, Windows XP? If you're paranoid, use a "burner" computer to copy the file to your "secure" machine, then verify a signature and decrypt. A Raspberry Pi would probably be suitable.

Nrsolis 13y ago
Uh huh. You gonna trust that setup with your life? Why not just continue to trust the one person you're SURE can tip you to compromise? If Miranda ever gets his laptop/phone/drives back, they're as good as useless. Straight to the trash heap.

malandrew 13y ago

A micro-sim card is extremely easy to hide somewhere and you can guarantee some chain of possession by wrapping the card in some way that would indicate tampering. On top of that, you don't need to send things from person of interest A to person of interest B. Instead person of interest A can mail the tamper proof sim to non-person of interest C who is friends with person of interest B. In addition, it can be mailed with the return address and name of trust friend of person A that is not a person of interest him or herself. The chances of such a package being intercepted is slim to none.

Nrsolis 13y ago
Uh, if you KNOW you're on their radar, you can't trust the mail. And you're mailing a letter which involves a whole lot of people carrying it and handling it. You've got a whole alphabet of persons. Remember that this is a state level adversary. You're not going to get one past them. They know ALL the tricks. ALL of them. Please don't talk tradecraft to me. You are doing it way wrong. There is a way to use the mail, but not the way you are describing it.
- fractallyte 13y ago
  C'mon - you can't just tantalize readers with a reply like that and leave it hanging! Educate us...
  - Nrsolis 13y ago
    "The first thing they teach you is: If there is any doubt, there is no doubt." "Who teaches you?" "I can't remember. That's the second thing they teach you."
  - Nrsolis 13y ago
    This should get you started: Assume nothing. Never go against your gut. Everyone is potentially under opposition control. Don't look back; you are never completely alone. Go with the flow, blend in. Vary your pattern and stay within your cover. Lull them into a sense of complacency. Don't harass the opposition. Pick the time and place for action. Keep your options open.
- malandrew 13y ago
  "Please don't talk tradecraft to me." Fine I'm doing it wrong, but you don't have to be a dick about it by waving around someone's lack of knowledge in this space and then saying they are not even knowledgable enough to interact with you. Doing so does not raise the level of discourse.
  - Nrsolis 13y ago
    Dude. This is serious stuff. Try and understand that for the better part of Western History, getting caught with anything that might be considered a tool of espionage or meeting with the wrong person might be a death sentence. Hence, tradecraft. These are skills designed to make things like hand-offs of materiel (called the brush-pass) or an surveillance detection run (to make sure you're not followed) a kind of second nature. I'm sorry you were offended but I took your comment to be quite flippant. There is a reason why we have professionals for this sort of thing. If you're truly interested, go read up on the subject. There is a lot of good info that details what the training is like, and what skills you need to do this sort of work. Double-O-Seven it ain't. Good tradecraft keeps you ALIVE. It's not for amateurs.