grugq

14 ms·

91.
by grugq 10y ago
no. never sold anything to "3rd world dictators."
92.
by grugq 10y ago
He lived a full life, taught a lot of people, was great fun to hang out with. He greatest sadness was that the cancer robbed him of his pleasure of food and wine in his last years. https://en.wikipedia.org/wiki/Fravia
93.
by grugq 10y ago
yeah, a study of the literature will show that it is a constant problem for people that start to assume a secret identity. There is a class of people that are actually better at this than others[0]. For police that go undercover flow long p
94.
by grugq 10y ago
1) physical location It depends a lot on how intense you expect the investigation to be. Strong protection comes from using a network connection that is not linked to you, in addition to using technology that masks your IP address. If there
95.
by grugq 10y ago
Guess I'll save my "dialectical materialism and Torah: an incognito exploration of Jewish working class identity" for a later post...
96.
by grugq 10y ago
Culturally, there is a huge difference between American nuclear families and Thai extended families. As was mentioned in TFA, when someone in Bangkok is unable to support themselves they fall back on their extended family as a support netwo
97.
by grugq 11y ago
see: https://news.ycombinator.com/item?id=7106953
98.
by grugq 11y ago
To elaborate, the security precautions you take are entirely dependent on the threat you face (or believe you face). If you're Dread Pirate Roberts, creating a detailed diary of you criminal activities is a terrible idea [1]. If you&#x
99.
by grugq 11y ago
Yes.
100.
by grugq 11y ago
I am a public figure. If you want to contact me via PGP you can find my key easily. When you contact me, you encrypt your message and include your public PGP key. This eliminates the threat of a man in the middle attack. Only one side needs
101.
by grugq 11y ago
YubiKey now has OpenPGP smartcard functionality. The new YubiKey NEO can even operate over NFC with OpenKeychain for Android. You can use K-9 and store your PGP key on a physical token (the YubiKey). Quite useful if your threat model includ
102.
by grugq 11y ago
Correct. There is a section that addresses signing. In short: don't do it. OP: From addresses are not to be rotated. Each communications channel should be in a compartment. Compartmentation requires minimizing the amount of information
103.
COMSEC: Beyond Encryption [pdf](grugq.github.io)
94 points by grugq 12y ago|51 comments
104.
by grugq 12y ago
I commented on this back when Facebook paid out $30k for that RCE. I know the Facebook security team points to this comment all the time. Maybe more people should read it: https://news.ycombinator.com/item?id=7106953
105.
by grugq 12y ago
FWIW I don't agree with the assessment of the OP. While there are some security firms that do have contracts, the vast majority of NSA capability is internally developed (or developed under contract by defence contractors). As for the
106.
by grugq 12y ago
Yes, you're right. However, that's another issue. The question was "do terrorists take pictures of their targets?" and the answer is "yes they do". If the question is "are there terrorists in the USA?&quot
107.
by grugq 12y ago
Here's one example from JI http://en.m.wikipedia.org/wiki/Singapore_embassies_attack_pl... Here's a reconnaissance manual: http://ruckus.org/article.php?id=809 In general, blacklisting or whi
108.
by grugq 12y ago
Here is a recent example: http://www.propublica.org/article/how-hezbollah-trained-an-o... There are others.
109.
by grugq 12y ago
http://www.stratfor.com/weekly/detecting-terrorist-surveilla... This is a good start on the terrorist attack cycle and the surveillance techniques that are used. One of the problems with defense is that you had to prot
110.
by grugq 12y ago
Yes they do. The competent ones will have surveillance teams that are different from the operational teams. (A team can be a single person, obviously). Look for a copy of the "terrorist recognition manual", the 2nd ed. has leaked
111.
by grugq 12y ago
My analysis of that incident: http://grugq.github.io/blog/2013/12/21/in-search-of-opsec-ma...
112.
by grugq 12y ago
That is a poor analogy of the threat. Basically the problem is about attracting adversarial resources. Any suspicious activity will attract more attention and thus make it more likely the adversary will find real evidence. I wrote up an ana
113.
by grugq 13y ago
yeah, I actually started that campaign. You'll notice it is the tweet he is replying too ;)
114.
by grugq 13y ago
No, my argument boils down to "cryptostorm doesn't know who you are". They isolated their accounting (the part that has to collect money and ties an individual to an account) from their VPN service. They compartmented their o
115.
by grugq 13y ago
Unfortunately, it doesn't matter what beliefs the owners of a Swedish VPN have. The FRA law [0] means that any data which goes over Swedish links will be logged. One can only assume that the iPredator service is heavily monitored by th
116.
by grugq 13y ago
I should have been more clear, I mean a minimal Debian install for RaspberryPi. I don't want to create a full debootstrap image and make that available (it comes to almost 512mb after adding all the software, WTF!). I am familiar with
117.
by grugq 13y ago
I stand corrected. It makes sense since OTR is basically the gold standard of how to encrypt messages between two people. My main point, really, is that the content is not that relevant most of the time. It is far more interesting to see wh
118.
by grugq 13y ago
They aren't. TextSecure is an updated version of OTR. It is provides a means of securing content between two individuals, but it doesn't do anything to protect against traffic analysis or metadata analysis (it can't, really,
119.
by grugq 13y ago
And it is still shit and will continue to be shit because it has massive technical debt and is fundamentally flawed. Why throw good money after bad?
120.
by grugq 13y ago
Thanks for letting me know. ;) There is an issue for the torrc that is open on github, but it hasn't been applied yet. You might want to test it and see if it works for you. https://github.com/grugq/PORTALofPi&#x2F

More ›