Slashdot Mirror
OPSEC For Activists, Because Encryption Is No Guarantee
Nicola Hahn writes: "In the wake of the Snowden revelations strong encryption has been promoted by organizations like The Intercept and Freedom of the Press Foundation as a solution for safeguarding privacy against the encroachment of Big Brother. Even President Obama acknowledges that "there's no scenario in which we don't want really strong encryption."
Yet the public record shows that over the years the NSA has honed its ability to steal encryption keys. Recent reports about the compromise of Gemalto's network and sophisticated firmware manipulation programs by the Office of Tailored Access Operations underscore this reality.
The inconvenient truth is that the current cyber self-defense formulas being presented are conspicuously incomplete. Security tools can and will fail. And when they do, what then? It's called Operational Security (OPSEC), a topic that hasn't received much coverage — but it should.
Yet the public record shows that over the years the NSA has honed its ability to steal encryption keys. Recent reports about the compromise of Gemalto's network and sophisticated firmware manipulation programs by the Office of Tailored Access Operations underscore this reality.
The inconvenient truth is that the current cyber self-defense formulas being presented are conspicuously incomplete. Security tools can and will fail. And when they do, what then? It's called Operational Security (OPSEC), a topic that hasn't received much coverage — but it should.
How many pointless articles could be avoided if authors and editors understood the difference between a necessary condition and a sufficient condition? Of course comsec is not a solution per se, Ulbricht can tell you all about that! (And how many more pointless discussions could be avoided if everyone knew "per se" = "by itself".)
Wonder what the public key field is for?
If I'm the only one who can unlock your encrypted communications, then it's in my best interest to have everyone encrypt their communications, because then, I'll be the only one with total situation awareness.
It won't be in any of your interests, of course, because you'll be handing me my advantage on a silver platter... but you're all far too shortsighted to pay attention to such things.
Of course Obama and the NSA want you all using strong encryption. Stupid of you to give them what they want, though.
-1 Uncomfortable Truth
Mkay, and that has nothing to do with a predictable species living in networked habitrails.
The high tech equivalent would be to mention a network resource where access can be monitored. When the network resource is accessed, you know there is a problem.
Old school.
http://radicalsurvivalism.com/...
http://www.outofregs.com/postI...
In GOD we trust, all others we monitor.
It's called know what you're doing and don't be stupid.
Loose lips sink ships. If it is talked about, someone will sooner or later overhear it.
What else can happen when an unstoppable force collides with an immovable object?
Snowden confirmed our suspicions. And for that he lost his livelihood and his home. And in return for his sacrifice we....have done nothing.
We benefited from his revelations, and then we let him rot. We can't even be arsed into signing an online petition to help him out.
Given how we reward whistle blowers, I am surprised we have any at all.
The article misses one partial solution: be uninteresting. I've got a bank account in a non-US bank. It's got several hundred dollars in it. Nobody's going to bother to steal that. I've got a password I use all over the Internet, including Slashdot, but you can't do anything with it but post stupid comments. My bank password was a different one. I look just like a million other Amerians living overseas, and that is my ultimate protection. Of course, the cheaper hard disks get, the more data the NSA can store, so the protection is only partial. But for now it is a factor. Of 200 million Americans, how many are worth tracking?
- It is technically possible to air-gap the machine you use to access your email, by copying the email over from an insecure computer to the air-gapped machine.
- TAILS is great, but they probably at least try to break it since it's popular. Will they succeed? Maybe. So use an OpenBSD live CD, it's more secure anyway. Or get creative: use Whonix. The FBI's pedestrian attempt at drive-by malware would have fallen flat on its face with an adversary using Whonix.
- Firejail. Google it. Won't protect you against local kernel privilege escalation attacks, though.
Yes, contingency planning is good. Yes, single points of failure are bad. But you can get very, very good communication security if you really try.
vi ~/.emacs # I'm probably going to Hell for this.
So then you just have to send copies of your one time pads to everyone you want to have conversations with. What could go wrong?
It's bad enough you gotta bunch of guys out there who read too much goddamned Tom Clancy and use military/police-esque terms for everything whilst wearing their size XXXXXL tactical camo pants, but do we really want to start throwing around terms like OPSEC? Goodie, you know a new term/acronym; you're still not a badass.
If you were me, you'd be good lookin'. - six string samurai
You have a key that is far larger than the data you are encrypting, you never reuse parts of the key. The key is random garbage not generated by the computer, but sampled, e.g. random video mashes together or random noise audio mashed together. You transfer the private key by trusted method,
If you have a trusted communication method you could use the same method to send the actual message. (Exception being when you have a trusted channel once in a while)
Next is that video and audio are far too regular to count as reliable source of randomness. Have a look what work went into defining the entropy sources for the Linux pseudo random number generator. Things you thought should be more than random over a large stretch of time showed to be surprisingly predictable.
bickerdyke
...you are.
Here's a gem: You night to FIGHT for freedom. The government and their mohammedic friends are hell-bent on implementing Mohammedic Security (total surveillance, torture, kidnapping etc) here.
There is NOTHING WRONG with using TOR and turning off the NSA Beacon as much as possible. As long as you dont conspire to harm anybody else, that is.
And yeah, I get regular black helos, C130 overflights and the odd three-strange-persons visits in the train. When I was in Atlanta they once showed me about 50% of the USAF C130 flight after some internet posting.
I am defending Germanic Freedoms, including the Freedom Of Our Women and those crypto-Mohammedics can Go Fuck Themselves.
What does the future look like for open-source USB and hard drive firmware, and the ability to update our own? Something open-source router firmware?
Any pattern in the way you behave can be used against you. If you are not emitting a mobile phone signal, then you are suspicious. If you have an iPhone, and the logs suggest you regularly take the batteries out, then you are very suspicious. A modern spy would carry a mobile phone - not the latest security recommended one, but something dull - and would tweet and post pictures of what they are eating and listening to just to get the right watch profile. You would have to leave the phone behind when you want to do Spy Things, but you could leave it in the locker at the swimming pool, or something plausible like that. If you have to send crypto messages over this phone, keep the message very short, and plausible.
I don't think there are many real spies here on Slashdot, but there are probably people who would like to keep their data secure in a way that does not attract attention to themselves. Perhaps we should all use encryption whether we need it or not, so those that need it will no longer stand out.