Pobody's Nerfect

What parts of your OPSEC have you been slacking on/poorly maintaining? Are there any levels of security you've simply given up on trying to do effectively? Or are you a 1337 n33t who is completely uncompromised in every possible way? There's always another layer of security possible, what's one thing you would like to be part of your OPSEC that you haven't been able to implement yet? Why haven't you? To an extent, I've given up on avoiding compromised social apps and programs, like Skype and Kik. It's just a waste of time to try to get people you know to use more secure alternatives for communication when they're already comfortable with what they have. Instead I just watch what I say when I use those services, which is far from a functional strategy, but the alternative is to completely drop my social life so some Somalian ad company doesn't know I like watching anime on the weekends. Maybe I just need better friends. I'm running windows 10 on one of my computers(secured as much as I can, I'm not THAT stupid), which I know is a horrible idea, but it's also a requirement for work, so I'm trying to live with it and compartmentalize the kind of internet activity I do on it. Since this machine is pretty powerful, I'm considering just biting the bullet and installing windows on some craptop I have sitting around and switching this to OpenBSD or something, but that's going to involve juggling a lot of files and configuration I don't have the time to do at the moment. Pic unrelated, I saw it in a google search and had a good laugh. inb4 I'm NSA adding all these to the "weaknesses" section of your dossier

Phone. The dumb thing is I only use it for reading books and listening to podcasts. All the 24/7 tracking and microphone are adding zero value to my life. If I could just find a non-cellular but phone sized tablet, I could use that instead and then also carry a phone with a removable battery in case I really do need to make a call. My other idea was to desolder the baseband chip from a smart phone but that would be an expensive experiment with dubious odds of success.

>>2021 Very similar situation here. Been thinking about the verysame thing. A note 2 with replicant, no gsm module, front/back camera, gps and microphones would be pretty great (use headphones with external mic if you need it). They're pretty cheap too (around 100$ refurbished on ali) Just the other day I was watching a video by one of the devs of osmocombb and apparently with their firmware it is possible to spoof GSM location. Downside is there isn't that much info on how to flash it (there is a page on their wiki but I think it is a little lackluster) and it only works with old motorola phones (2004-200X) and I think the GTA04. Oh also if the firmware crashes the battery can get overcharged and burn down your house. But theoretically this setup would be pretty good to maintain privacy/anonimity (with a prepaid card of course).

>possible to spoof GSM location you skipped the physics class in high school, didn't you? >anonymity with plaintext voicecalls and texts on old dumbphone heh, nope kiddo(Argue in good faith and avoid spilling soykaf.)

>>2022 OsmocomBB looks pretty cool, thanks for bringing it up. The I can see what you mean about the documentation. It might be challenging to get working. http://osmocom.org/projects/baseband/wiki/HardwareCP210xTutorial http://osmocom.org/projects/baseband/wiki/Flashing

>>2024 >>possible to spoof GSM location Congrats on not being able to read the whole sentence. That's what the devs said. Here is the video: https://m.youtube.com/watch?v=ihbRtTzc0NI I think they showed it too. >>anonymity with plaintext voicecalls and texts on old dumbphone Anonymity and privacy are 2 different things. If you buy a prepaid card with cash and they don't know your location how is it not anonymous? Sure there is a case to be made about it not being a very secure device but it should still be treated as a burner. You can't really do anything about the voice calls anyway. But if you still need a burner this seems the safest way.

>>2029 >https://m.youtube.com/watch?v=ihbRtTzc0NI 00:35:22 >Since we have full control, you can also do things like alter your position as it appears to the mobile network. Because there is this timing advance that is used between the telephone and the BTS which gives the network an indication of how far you are from the BTS and since we control the timing, we can just adjust our timing a little bit this way or a little bit the other way and then we appear closer or further away from the cell. Which is an interesting feature I guess..... [audience applause] >>2024 >heh, nope kiddo Knock that soykaf off. In the hacker world being correct is more important than being polite but being wrong AND being an asshole is totally not cool.

My circle of friends started using signal instead of Facebook. Previously I lost out a bit on what's going on but now I can communicate and have privacy

>>2031 Couldn't have said it better myself. There is nothing worse in this community than condescending assholes, and IME the people who are sup3r1337 posers are the ones who act the most superior.

>>2029 >m.youtube.com If you need a one-time burner to send or receive sms (this is how you really keep anonymity, more will generate correlation metadata), then any cheapest chinkphone will do the job, you don't need software freedom for that. Most "sim for cash" sellers are police fuds, especially if it is illegal to sell non-identified sim cards in your country. Your privacy and anonymity ends when you make a voice call, no matter to what number and from what location. Phone carriers already have your voice samples, if you happened to use voice calls for last 3 years or so. If you need to receive texts or some soykaf, use online services, they sell numbers for few cents. >>2031 >blah-blah one cell Read about how triangulation works and think why it is really a bad idea to alter your location through timings if there are more than one cell listening to your signal. It could be mitigated by using a directional antenna. >le hacker world etiquette m'lady Boot off, we are not on reddit. This is basic stuff, and if you happen to post on lainchan and not on yahoo answers, you are supposed (supposedly supposed) to know basic high school stuff already. >>2032 Signal (and anyone who taps their servers) knows your number, time and people you talk to, literally by their numbers, and if only one of them has identity-linked number, then you are busted. Second, it uses google push notifications. Third, protocol and all software stack are designed by one team, therefore they can put backdoors very easily and compromise everyone. If you want to be free from corporations and jews with dreadlocks, use tox, if you don't want isp to spy on you, use xmpp. People nowadays must be literal braindeads if username creation is too hard for them, but phone number is okay and considered convenient.

>>2044 >you don't need software freedom for that. The original posts (>>2021 >>2022) were about cellphones, an item we all carry everyday, run untrusted code at the deepest levels and can listen to everything that happens around you and track you everywhere you go. That's why people are talking about an open source base band with spoofed timing offsets. It looks like you're answering a bunch of unrelated questions no one asked in a desperate attempt to prove you're not an idiot. It didn't work. >Most "sim for cash" sellers are police fuds >Phone carriers already have your voice samples, if you happened to use voice calls for last 3 years or so. You are obviously just making this up. >It could be mitigated by using a directional antenna. No it can't. Your cellphone is already in range of multiple base stations. Putting a directional antenna on it won't change that. >you are supposed (supposedly supposed) to know basic high school stuff already. Take a look at the dumb soykaf you post before you start accusing others of ignorance.

>>2044 >Most "sim for cash" sellers are police fuds Even in paranoid fascist states like China that's unlikely. Selling fake sims and hoping someone does something interesting with it is a soykaf idea, even by law enforcement standards. It's more likely that the guys selling are simply trying to make money. >Phone carriers already have your voice samples, if you happened to use voice calls for last 3 years or so. I'm calling bullsoykaf on this too. Telecom companies have literally no incentive to do this, even if it were free to store voice samples for 10s of millions of customers (which it definitely fuarrrking isn't).

>>2021 Why not use Airplane mode indefinitely?

>>2031 >totally not cool maaaan >in the hacker world(Don't spill soykaf; try using complete sentences; you don't seem like much of a hacker.)

>>2054 >Why not use Airplane mode indefinitely? Airplane mode seems like a half-assed legal thing to me. No one would actually notice if it wasn't working correctly so I'm not sure if I would trust it unless I can test it somehow.

>>2059 A faraday cage is the best way to be sure.

>>2055 >le hacker world etiquette m'lady It's not so much etiquette as checking your facts before insulting everyone who doesn't agree with you. People might not mind your juvenile-4chan-gangster-wannabe style of writing if you actually had someone of value to contribute to the discussion. At the moment you're just underage cancer.

>>2046 >open source base band with spoofed timing won't happen/obscurity placebo There are different standardized rules for every electronic device that emits radio waves, FCC or similar state orgs won't allow you to use equipment with unpredictable behavior dropping RF spaghetti on all frequencies at 5W, what really matters is having a transparent open protocol between bsp and main processor, with ability to physically disconnect them. It is mostly achievable, doesn't even matter if black box runs proprietary code written by MOSSAD lizards, if it is a blackbox and doesn't affect your kernelspace and main system memory. But there is second obstacle: >muh emergency calls They are always present, even in airplane mode, a foolproof Big Brother hotline. Add a non-removable battery and voila. Or maybe like a law in Indianistan which forces all legally sold cell phones to have this kind of link in order to "perform emergency rescue operations" by allowing BSP to get precise GPS data and other stuff from DMA. >Your cellphone is already in range of multiple base stations Assuming you remove embedded antennas first. Not rocket science. >>2047 >It's more likely that the guys selling are simply trying to make money Same as good dindunuffin boys who sell VPN services for poor brown people from oppressed totalitarian regimes and claim not to keep logs, but suddenly when police or feds are onto them, they spit out everything. >Telecom companies have literally no incentive to do this It's not a big amount of data. You really underestimate the surveillance state, more likely they have to. I'm not sure in what 3rd world sharthole you live in, but in my country if you ever happened to call any service that requires identity confirmation like banks, hospitals, your carrier support line, police, etc, then your call and voice fingerprint are more likely to be recorded for selective QA or biometric authentication, combined with passphrase and pin. How it used to be: you call a line and presented by robot voice telling you to press buttons to go through menu, then a wageslave picks up a phone and asks you a few questions, now you can give the robot (it now has intelligence of a chatbot and a cute female voice instead of prerecorded one) voice commands and during final stage you spell your number password, if someone finds out your secret password or your dad's maiden name they won't be able to block your account or reissue the credit card plus their voice fingerprint goes to fraudsters database, so it's a win-win for both banks and police.

>>2063 >There are different standardized rules for every electronic device that emits radio waves, FCC or similar state orgs won't allow you to use equipment with unpredictable behavior dropping RF spaghetti on all frequencies at 5W, This has nothing to do with OSmocomBB spoofing the GSM timing advance. Dropping fake knowledge out of context like this doesn't make you sound smart by the way. > what really matters is having a transparent open protocol between bsp and main processor, with ability to physically disconnect them. Presumably you mean DSP. The DSP only does the lowest level work, most of the protocol stack resides in another microcontroller. I take your point but the problem is that the baseband processor is usually embedded on the same SoC as the application processor so separating them is not possible or practical depending on where you are in the supply chain. >It is mostly achievable No it's not. >Assuming you remove embedded antennas first. Not rocket science. Show me where this embedded antenna is then (assuming you're not just full of soykaf). https://www.ifixit.com/Teardown/Nexus+4+Teardown/11781

>>2063 >Same as good dindunuffin boys who sell VPN services for poor brown people from oppressed totalitarian regimes and claim not to keep logs, but suddenly when police or feds are onto them, they spit out everything. Don't substitute the topic. SIM cards are not comparable to VPN services on any level. >in my country if you ever happened to call any service that requires identity confirmation like banks, hospitals, your carrier support line, police, etc, then your call and voice fingerprint are more likely to be recorded for selective QA or biometric authentication, combined with passphrase and pin. Citation needed. If you didn't make this up it should be easy to link to a 3rd party source. Also bear in mind that in your previous post you said it was the telecom companies keeping this data, not the people you were calling.

>>2064 >where this embedded antenna is perimeter spring pads for induction charger 4 spring pads for NFC antenna one white wire with MHF IPEX connector on the board and antenna on the bottom plastic cover Disconnect that wire and add your own external. Your good to go.

I don't update android at all, I use weak passwords and my router credentials are admin:admin I regret nothing

>>2065 >cite this >cite that >not related You are not one to lose an internet argument aren't you? Not even the guy you're replying to, but that tech is available in 2nd world. https://books.google.com.tr/books?id=tDahxsLAQmoC&pg=PT294&lpg=PT294&dq=norway+voice+recognition&source=bl&ots=vHTb7CtAEc&sig=Ii97i-KTjqlK1qHfL34AFfW70BI&hl=tr&sa=X&ved=0ahUKEwjp2sy6jKnWAhXM1RoKHUg2ApMQ6AEIHTAB#v=onepage&q=norway%20voice%20recognition&f=false

>>2723 >You are not one to lose an internet argument aren't you? I'm here to learn, not to watch some 12 year old make things up and pass it off as fact. Your book only mentions voice recognition on a single line. >Voice recognition where unique voice matching enables individual verification used in telephone banking by Chase Manhattan Bank. I don't doubt that one or two banks do this. What I was calling bullsoykaf on was this: >Your privacy and anonymity ends when you make a voice call, no matter to what number and from what location. Phone carriers already have your voice samples, if you happened to use voice calls for last 3 years or so. >in my country if you ever happened to call any service that requires identity confirmation like banks, hospitals, your carrier support line, police, etc, then your call and voice fingerprint are more likely to be recorded for selective QA or biometric authentication, combined with passphrase and pin.

>>2723 >2nd world Norway is a 1st world county. The 2nd world (Soviet Union, Eastern Bloc, etc.) mostly does not exist anymore.

How much security is enough? Is there some point where the simple presence of security measures will mark you as a possible target? I think we all agree that basic measures for privacy are a good thing. Put a password on your PC and phone, don't use an unsecured windows 98 computer for online banking and so on... On the other hand every hardware you use is probably closed source and the best and secured FOSS can do nothing to protect you if your mainboard chipset or CPU is compromised. I get it that using linux is way better for information security than windows 10, but using linux on an intel CPU won't make you fireproof either. So at which point is it enough? When does paranoia start? For my daily stuff i use a linux laptop with encrypted harddisk. Noscript and an ad blocker in Firefox for browsing. Thunderbird with enigmail for mail. Some office and math tools, thats it. I have a soykafty old windows 10 notebook for things that need windows, like updating the maps on my GPS device or playing some old games from time to time.There is nothing noteworthy on it, so i don't see a problem in using windows. Same for a phone. I'm using threema, so most of my messages are encrypted. But it is a regular android phone, so the encryption is on a weak base and will not be very effective if someone targets the phone. The thing is: I'm a regular boring dude with a regular boring job, so the messages i get range from "will you be at work on friday?" to "let's go hiking on the weekend". Even if someone hacks it there is not much damage done. The point is, my security is far from perfect. I could establish a much better system, but from my understanding the effort to get a more secure system rises exponentially, while the security itself will be not that much better because of insecure hardware. In my opinion packing a gun/knive at night or in soykafty districts is a much more effective improvement in everyday personal OPSEC than "bulletproofing" ones 10 year old libreboot thinkpad X61....

>>2725 Read the rest of the list.

>>2726 >In my opinion packing a gun/knive at night or in soykafty districts is a much more effective improvement in everyday personal OPSEC than "bulletproofing" ones 10 year old libreboot thinkpad X61.... Threat models are a personal thing, It's good for you that you have boring hobbies and completely trust the police/government. Don't be so surprised when people think different to you. Especially on /sec/.

>>2726 >On the other hand every hardware you use is probably closed source and the best and secured FOSS can do nothing to protect you if your mainboard chipset or CPU is compromised. I get it that using linux is way better for information security than windows 10, but using linux on an intel CPU won't make you fireproof either. So at which point is it enough? When does paranoia start? I'd like to hear some opinions on this. If your hardware is compromised, what's the point of securing your software? Obviously basic security is a must as he said, but at what point is it just diminishing gains?

>>2732 >If your hardware is compromised, what's the point of securing your software? If your house cannot survive a nuclear missile then wasn't the point of locking your doors? >at what point is it just diminishing gains? It's all down to you and your threat model. https://ssd.eff.org/en/module/assessing-your-risks

>>2723 >>2724 >>2725 I'm not him, but can confirm it's plausibility. Exact thing in Russia. 2nd world, here we go Voice analytics, voice recognition, robotic speech synthesis are widely tested and somewhere already deployed in call-centers. Use online translation for help: http://www.speechpro.ru/ https://habrahabr.ru/company/speechpro/blog/205880/ https://habrahabr.ru/company/speechpro/blog/184832/ https://habrahabr.ru/company/croc/blog/235565/ https://habrahabr.ru/company/speechpro/blog/177299/ https://habrahabr.ru/company/speechpro/blog/311790/ >Your privacy and anonymity ends when you make a voice call, no matter to what number and from what location. Phone carriers already have your voice samples, if you happened to use voice calls for last 3 years or so. See, we have this thing called SORM. Read on Wikipedia for more insights. SORM is a set of rules and equipment all, I repeat ALL communication providers, need to follow and install on their premises. The rules include writing and storing all metadata for 3 years and, since next year this is why all mobile carriers and ISPs suddenly announce datacaps, hello America, writing and storing all traffic for 6 months, it also performs wiretapping selected person after court or FSB order. The equipment itself does traffic filtering and DPI. >https://www.dentons.com/en/insights/alerts/2016/july/19/russias-new-anti-terrorist-law >>2726 >threema Using proprietary "private messengers" is not the best OpSec even if you have nothing to hide. >On March 9, 2017 Threema was included into the Register of organizers of information dissemination in the Internet operated by the Federal Service for Supervision of Communications, Information Technology, and Mass Media of the Russian Federation. According to the Russian Federal Law of 6 July 2016 No. 374-FZ “On Amending the Federal Law “On Counteracting Terrorism” and Other Legislative Acts of the Russian Federation in terms of Additional Measures on Counteracting Terrorism and Maintaining Public Safety” from 1 July 2018 organizers of information dissemination will be obliged to retain in the territory of the Russian Federation the Internet users’ text messages, voice information, images, sounds, video and other electronic messages for up to six months following the end of their reception, transmission, delivery and (or) processing (i.e. shall retain the content of communication). Organizers of information dissemination shall disclose this information to authorized state agencies that perform investigative activities or ensure national security That's what I was talking about. Westerners wouldn't believe what Huxley-Orwellian nightmare Russia is. I think, we can compete with Britbongs on par with it. Especially when talking about sprawl megacities like Moscow, as I remember from my last trip, compared to outskirts and remote sub-100k towns like my own. In Moscow you can't make a move without centralized surveillance systems keeping an eye on you. Buses, metro, streets, apartment blocks, lifts, offices, everything streams live video feed to internet system every citizen can register to with their passport and watch yes, we have internal passports, a concept foreigners can't wrap their brain around, government already phases them to single ID-esignature-paycard. E-government, centralized medical and school records system, mandatory GPS trackers for every new manufactured automobile, body scanners on all metro/commute train stations. There are basically few corporations control all information channels in the city. Need search? Yandex. Need maps? Yandex. Weather forecasts and mapping? Yandex. When the next bus is coming? Yandex. Need taxi? Yandex and Uber, oh, nevermind, they signed an agreement for joint-cooperation. Wanna take a walk through the city center and enjoy historic sights? GPS spoofing signal right from the Kremlin. I don't want cyberpunk nightmare back, it's not like what you read in those fancy 80's fiction books, not same at all. I never asked for this reality. This post is paid for by Яndex® LLC

>>2728 I'm not surprised at all, that's why i asked for other peoples opinion on that topic. Boring in the sense of being a hacker victim. But advocating for carrying a gun is a sign of trusting everything and everyone? Strange world you are living in. >>2733 That is exactly what i mean. Most people here are pretty average. That might be different if you live in north korea or something but the threats for most people are more in line of: - somebody stealing their laptop --> HDD encryption - everybody reading their mails --> encrypted messaging - advertisers logging their internet usage --> adblock/noscript - mom finding the porn collection --> HDD encryption + password on login screen - some random company screening their personal data --> use linux instead of win10 and so on... My point is, that if you are alone there is only so much you can do. Choose the software with the better track record, use your brain and implement basic security. I get the argument FOSS vs. proprietary software and i don't want to promote proprietary software here, but the main argument for FOSS security is that everyone can check the code for possible backdoors. Well, have you screened the linux kernel for backdoors? Do you have the time for that? Do you have the technical knowledge? Would you recocnise a backdoor? I certainly won't, so all i can do is trust the developers and the community. Are they more trustworthy and competent than commercial developers? I cannot answer that, so i must go under the assumption that all software can be compromised with enough efford. Would not be the first time that a security compromising bug is found in linux. Due to vast field usage of the different softwares i can assume that linux + basic security measures is good enough for my needs, but not foolproof. I am simply not capable of eliminating remaining technical risk. And even if i have the perfect IT security, what if the attacker just comes through my front door and beats my with a crowbar until i give over my passwords? On the other hand OP talked about OPSEC, which is kind of the whole security package, not just informational security. It depends on what your operation is, but assuming your operation is your daily life there are some other areas where you can improve your general security. I mean i can spend all my waking hours in improving my computer security setup and then accidentally kill myself because i neglected the maintenance of my motorcycle. I surely would get a lot of benefit from my information security in that case.

- If you just want to use your smartphone as a tiny computer, there's absolutely no reason to have a sim card in it. You can still use internet and make voip calls via wifi. - You can spoof mac, s/n, IMEI pretty easily these days. - If using airplane mode or just turning off wifi, bluetooth, gps, ir, etc, or even turning off the phone and removing the battery leaves you feeling paranoid, put the phone in a copper case. It's not going to be communicating with anything from there, no matter how backdoored the h/w or s/w are. - You can at least partially mitigate a phone's software unknowns by using an open source rom you compile yourself. And the fewer binary blobs you add to make h/w features work, the better. A non-working camera or mic isn't going to spy on you. - It only takes a couple of minutes to restore a nandroid backup of a fully functional rom if you want everything to work, and vice-versa.

>>2744 >People on this board actually leave their basements sometimes - Visit your local McDonald's/Starbucks/internet hotspot and use their wifi - Or put a sim card in it. Use it. Take it out. Lol, it's unbelievable I even need to say this. >Can you prove that base station sees the same spoofed IMEI? People have been spoofing blacklisted IMEIs of stolen phones and using them successfully for years. Again, it's amazing I even have to say this. >Someone skipped their physics classes at school. Faraday cage needs ground. Lol. You don't need to ground a Faraday cage to block RF. Don't you remember the part about it being impossible to do any experiment inside a Faraday cage that can determine whether it's grounded or not? People do ground them for other reasons, but that's not one of them. >Using Android Studio? So you trust software written by datamining corp, aha. You'd rather use the backdoored stock ROM? >Sure, Indian I just made a nandroid backup of the fully functional custom ROM on my phone. 2m 14s. Then I restored it. 3m 45s. I guess you could add on the 20s or so it took me to reboot into recovery and push the buttons. You can do this anywhere with a decent charge on your battery. How long does it take you?

>>2739 >Boring in the sense of being a hacker victim. But advocating for carrying a gun is a sign of trusting everything and everyone? Strange world you are living in. Don't misrepresent people's arguments like that. >>2726 specifically said government and police, not "everything and everyone". Also, you should take "boring hobbies" into context on an anonymous /sec/ board. >advocating for carrying a gun That's pretty soykaf "opsec" to be honest. At best it might save your life in a violent confrontation but it also makes you vulnerable to being arrested for carrying a weapon, murder/attempted murder etc. Real opsec would be to avoid situations where you need to risk your life or jail time for no reason in the first place.

>>2747 Actually i think you did not read my post to which he replied. I listed some basic security measures (including some means of self defense) that in no way suggest that i think government and police is to be unconditionally trusted. So yeah not really misrepresenting anything, just a slight sarcastic remark. Also i meant "boring hobbies" in the right context. For example climbing mountains is anything but boring, but what do you think a hacker will find on the devices of a person participating in this hobby? Some Maps? Some instructions on how to use mountaineering equipment, tie knots, etc? Weather reports? As i said not boring in the conventional sense, but not an appealing target for some hacker. >soykaf "opsec" Of course you should only carry a gun if it is legal (as for example in large parts of the USA). For other parts of the world there are lots of (nonlethal) alternatives. And of course you should not use it when it is not absolutely neccessary. I can totally understand your concern about being arrested, but if soykaf hits the fan so bad that you need to use a gun, ask yourself: would you rather be on trial for attempted murder or be the one who is murdered? And who is talking about risking ones life or jail time for no reason? I did not at one point suggest to run around with a loaded gun, hold it in peoples faces and shoot around like a madman. I'm thinking about situations where someone breaks into your home (or "basis of operation" to keep the context), you get mugged, raped or simply walk unknowingly into the wrong neighborhood where some drugged guy wants to smash your head in because he thinks you're some kind of monster from outer space. I personally do not carry a gun and i live in a civilized country where the physical threat level is quite low, but i still like to carry some kind of means of self defense if i'm out at night. But my question from before still stands: what good is perfect IT security if your attacker can simply break in your front door and beat the soykaf out of you until you tell your passwords? I mean, look at history. Did the Stasi or Gestapo leave people alone because they could not decrypt your messages? Did they leave people alone if they had a suspicion, but could not find anything because it was perfectly hidden? No, they just beat the soykaf out of people, put them into forced labor camps or in front of a firing squad. So yeah, how is physical security not an important part of OPSEC?

>>2748 Goal 1 should always be to not be suspicious in the first place. Anything even marginally illegal, such as strong organized opposition to your government, should be completely underground. Use a sneakernet if you have to.

>>2748 >not an appealing target for some hacker You have a credit card, you are an equally good target as anyone else. >Also i meant "boring hobbies" in the right context. No you didn't because you keep talking about "hackers" like they are the only threat. >how is physical security not an important part of OPSEC? You are the only person in the thread harping on about this. Try grinding your ax somewhere else if you find that no one actually cares.

>>2748 >how is physical security not an important part of OPSEC? Look at the definition of OPSEC on wikipedia "In a more general sense, OPSEC is the process of protecting individual pieces of data that could be grouped together to give the bigger picture (called aggregation). " The idea of opsec is to protect information or data from moving into the wrong hands by using security protocols/practices on that information. It isn't really about protecting yourself from Tyrone while walking around South Central LA. If your operation requires you to be in a dangerous situation, then yes protect yourself. Nobody is saying otherwise. If your operation requires you to move really important data from place to place (so if you are in a Snowden-style situation for example) you best be prepared to shoot to kill whoever might try to grab the encrypted Laptop you are moving on your person. That is fine, and if the information you are attempting to secure is worth killing for/dying for that is a reasonable OPSEC requirement. Those are examples of discussing weapons in relation to OPSEC, but you just keep discussing normal person bs about how you carry around weapons just cuz. That is fine and all, I'm American, that is our right as Americans, but it isn't pertinent to a discussion about OPSEC for most people. tl;dr -> if you aren't Jason Bourne, physical weapons aren't going to factor into your OPSEC model.

>>2750 > credit card Isn't this a perfect example where "bulletproofing" ones own security comes with dimishing returns? If you own a credit card, you will have a contract with a bank, so they will have your data. All the companies where you pay something by credit card also have your data. Add some payment providers and so on and you will have a lot of entities that are in posession of your credit card data. All of them will also posess a lot of other credit card data, unlike your own device which will, at best, contain your own data. Credit card fraud is a crime that is commited hundred of times everyday, so there is plenty of experience. Most of the time credit card data gets misused it is because of the following: - Somebody physically copying your card (like processing your "payment" in a backroom of the bar) - Manipulation of ATMs/payment devices - Some guy running an online shop in his garage misconfiguring his infrastructure and leaving his customer database open to the net - Massive security breaches of companies / payment providers / banks / etc (did somebody say equifax?) All of them are risks outside of your reach (if you want to have and use a credit card of course, not having a card means no risk). While it may be possible that someone targets your device to steal your credit card data, the real risk is really low. There are more lucrative targets and to be honest more lucrative methods in extracting cash from end users. Think more of cryptotrojans like locky. With those things you get money transfers authorised by the victim via anonymous money transfer services (mostly cryptocurrency). You can target anyone with a vulnerable system independent of the person having a credit card or having the credit card data stored on their device. Also the attackers forego the risk of detection while actually using the credit cards to transfer money. Luckily you need just to have a backup of your data to compensate if you are targeted. Which is one of those things i suspect many people are slacking in their OPSEC.