This is a rather interesting concept, first brought to my attention by:
Hackers As A High-Risk Population [29c3]
CCCen - Chaos Computer Conference, 2012
Overall I didn't like the video. I found it somewhat boring until the half way mark. This is because the leading information is a necessary foundation to build the relevant material upon. It does get a lot better.
One particularly curious topic was her bringing up the Autism spectrum, particularly Asperger syndrome. Over the years I've seen links between genius and various neuro-atypical "quirks". She cites a study where hackers are not on the Asperger side of the spectrum but more likely on the opposite side of the spectrum, with stronger emotions rather than with Asperger's weaker empathy.
Another video was recommended, which I haven't had time to watch:
I've written up parts from a rough transcript I found. Even reading through the points without watching the video gives an idea
WTF is it? OPSEC in a nutshell
- Keep your mouth shut
- Guard secrets
- Need to know
- Never let anyone get into position to blackmail you
- put the plumbing in ﬁrst
- create a cover (new persona)
- work on the legend (history, background, supporting evidence for the persona)
- Create sub-aliases
The 10 Hack Commandments
(Inspired by The Notorious B.I.G.'s Ten Crack Commandments lyrics.)
- Rule 1: Never reveal your operational details
- Rule 2: Never reveal your plans
- Rule 3: Never trust anyone
- Rule 4: Never confuse recreation and hacking
- Rule 5: Never operate from your own house
- Rule 6: Be proactively paranoid, it doesn't work retroactively
- Rule 7: Keep personal life and hacking separated
- Rule 8: Keep your personal environment contraband free
- Rule 9: Don't talk to the police
Rule 10: Dont give anyone power over you
Why do you need OPSEC?
- It hurts to get fucked
- No one is going to go to jail for you.
- Your friends will betray you.
- never ever ever do this
- Never trust anyone
- ProTip: Don't use your personal Facebook account to send defacement code to your friends
- Don't contaminate
- Keep personal life and hacking separate
- Never operate from your home
- Don't reveal operational details
Paranoia doesn't work retroactively
Problem: You are you.
Solution: Be someone else.
- Danger to personas is contamination
- Contact between personas (covers) contaminates both
Keep cover identities isolated from each other
- Fail safe technological solution
- TOR all the things!
- Back stop persona
- Primary cover alias as ﬁrst identity
Secondary cover aliases (eg. handles)
- Location revealing information
- Political events
- Amateurs practice until they get it right, professionals practice until they can't get it wrong
Practice makes perfect
Personal info is proﬁling info
Guidelines against proﬁling
- Do not include personal informations in your nick and screen name.
- Do not discuss personal informations in the chat, where you are from...
- Do not mention your gender, tattoos, piercings or physical capacities.
- Do not mention your profession, hobbies or involvement in activist groups
- Do not use special characters on your keyboard unique to your language
- Do not post informations to the regular internet while you are anonymous in IRC.
- Do not use Twitter and Facebook
- Do not post links to Facebook images. The image name contains a personal ID.
- Do not keep regular hours / habits (this can reveal your timezone, geographic locale)
Do not discuss your environment, e.g. weather, political activities,
VPNs vs. TOR
- VPNs provide privacy
- TOR provides anonymity
- Confuse the two at your peril
- TOR connection to a VPN => OK
VPN connection to TOR => GOTO JAIL
- Only safe currency is Bitcoins, because they come from nothing
- Purchase only over TOR
- Personal Onion Router To Avoid LEO [Law Enforcement Officers]
- Router ensuring all trafﬁc is transparently sent over TOR
- Reduce the ability to make mistakes
- Use mobile uplink
- Mobility (go to a coffee shop)
- Reduce risk of wiﬁ monitoring
Uses tricks to get additional storage space on
If you think, don't speak. If you speak, don't write. If you write, don't sign. If you sign, don't be surprised.
The talk mentions PORTAL, which is: