#operational security

[victusinveritas]

A soldier looking at a mirror with a sign reading "IF YOU TALK TOO MUCH, THIS MAN MAY DIE". at Camp Hood, Texas in January 1943. The sign was placed there to encourage people to not spread information that might be sensitive in the War effort during World War II.

Credit: Rishi Colors

historycolored.com⁠

[sergeant-macho-nacho]

Operational Security is extremely important to protect your digital privacy

Encryption, passwords, multiple burner devices, a VPN that make tracking your IP address more difficult, for example

I don't think Luigi Mangione shot anyone, but because he used social media like Good reads, Facebook, Reddit, untrustworthy Internet service providers, etc those social media websites either handed over his information freely or he was finked on by people who knew his online identity

Obviously I'm not advocating for terrorism, anarchy, sabatuers, or wha eva. I just don't want my tax dollars to be wasted because you got yourself locked up doing something stupid

This should seem obvious, but don't trust no body police have gone undercover in order to trick protesters into breaking the law

I bet you've never even heard about Ruby Ridge

[the-daughter-of-lilith]

Things to consider in regards to your privacy, remaining connected, and informed:

- Invest in a burner and Faraday bag if possible

- Use a separate identity on platforms (fakepersongenerator.com)

- Utilize throw away emails for sign ups (FastMail)

- Consider reformatting your device for a privacy focused OS like Graphene

- Utilize privacy focused apps like Signal and ProtonMail

- Keep up to date with news through sites like SoylentNews or GroundNews

- Use Brave or Firefox w/ privacy extensions

- Review privacy settings and permissions (Apply the Zero-Trust principal)

- Use a VPN that's not US based (ProtonVPN, Mullvad, etc.)

- Remove location metadata from your photo settings

- Consider all images can be geolocated

- Use a Virtual Credit Card (VCC) for purchases

- Use personal data removal services like Spokeo or Intelius

- Do not enable biometrics

- Airplane mode is your friend

- Join privacy based communities like r/privacy

[elumish]

I am once again asking people to spend at least five minutes googling classified information and how it works in the United States before writing the most nonsensical things about it into their stories.

[arkansec]

OSINT with NCPTF

Last night we talked with a representative of the National Child Protection Task Force.  This non-profit group uses Open Source Intelligence (OSINT) to help identify missing & exploited children as well as the traffickers & predators that target them.

Some of the tools that were discussed were:

OSINT COLLECTION

Image metadata Viewer - Online tool for viewing image metadata, which may include information on the camera/device that took the picture, geotagging, and other relevant details

The Ultimate OSINT Collection - A collection of tools by hatless1der in a single page.

WhatsMyName.app - Provides a place to search a single username across multiple websites & social media platforms.

UserSearch.org -  Search by username or email on Social Networks, Dating Sites, Forums, Crypto Forums, Chat Sites and Blogs.

Namechk.com - Search across 90 social media account platforms

knowem.com - Search across 500 social networks and other sites, including USPTO.

instantusername.com & CheckUsernames - check multiple social media networks to see if a username is available

host.io -  domain name data, including backlinks

epieos.com - Search for an email address to tell whether that address is associated with a Google ID, and what information that Google ID has made public.  Includes additional site searches, such as eventbrite, linkedin, adobe, and reverse-image extension.

Google Dorking - Information on how to do targeted searches inside documents, pages, and other google-indexed items with usernames, phone numbers, and other relevant data.

NOTE TAKING & VISUALIZATION

CherryTree - Alternative to OneNote

Hunchly - Note-taking & aggregation tool, records viewing history, tabs, and other artefacts while you view them.

BLOGS & TWITTER FEEDS

Blogs & Reading list for those interested in learning more about OSINT:

https://osintcurio.us/

https://webbreacher.com/

https://inteltechniques.com/

https://www.social-engineer.com/

Helpful Twitter Follows

hatless1der

webbreacher

inteltechniques

humanhacker

Justin Seitz

[grugq]

Using Google Voice (very few countries have it available), and using Twilio. Twilio can be configured to create a virtual number that’ll forward SMS and voice calls to the phone number you registered with — a telephony proxy. If you’re an international user, Twilio (or Wire, which uses usernames) is the only option here. Twilio costs $20 and acts as a proxy for a virtual phone number to your real phone number. Not exactly an anonymous solution. You’ve simply added a layer. There are alternatives to consider if you’re going to be spending money, particularly in the mobile app space. For example, a number of mobile apps offer a second number for a recurring monthly fee. Since you need to retain access to the number for your Signal account - essentially squatting it — to prevent someone else hijacking it for *their* Signal account. There is no perfect secure messaging solution that provides complete privacy protection. * Signal: Strong e2ee, but requires phone numbers for userIDs. This means it isn’t private, or you’ll end up paying for a second number just to secure and retain the account. * Wire: Strong e2ee, but it collects and retains a lot of metadata compared to Signal. Your user’s contacts, IP location, device type, plus all the communications based metadata. * Conversations/ChatSecure: both are XMPP clients that support OMEMO, a variant of the Signal protocol that runs over XMPP. Conversations, in particular, is quite alright on Android. If you stand up a private XMPP server with the correct modules then you’ll have the safest most private option. ChatSecure is hampered by a lot of things that iOS does to limit the capabilities of long running background apps that use network services. So here the problem is that you can’t use the more secure iPhone for your secure chat comms. Instead you have to use Android. CopperheadOS works, but Android has a lot of problems beyond the OS, the hardware is frequently designed as hostile to user privacy. The ideal solution, as I see it, is to take Wire and be able to stand up private networks. If there was a way to setup Wire servers as private instances, federate with like minded people (eg all hacker houses), then the user will gain control over the data and metadata exposure, which is the biggest issue with Wire. Signal is basically a PoC for the Signal protocol, sort of a MySpace of secure messengers. Wire has more potential right now, particularly as they’re open sourcing their server which’ll allow third partyWire networks. That’s what we need, that’s what I want. The other thing is to make new Wire clients. In particular one that has less attack surface and more privacy friendly features.

[victusinveritas]