Some useful Privacy & OpSec guides

Scrolling through BF I see so many stupid mistakes made in opsec.

If you want to get into cybersecurity / 'hacking', that's great. It's real interesting stuff.
But you need to understand that in the eyes of law enforcement, you are easy pickings and they will jail you to fill a monthly quota.

I don't condone any sort of malicious / illegal computer use. If you're going to get into cybersec, don't go straight into 'black-hat' because
you WILL be caught. To your ISP, LE and hackers, you are not special. You are not invincible or invulnerable to being caught just because you
have had such experiences in real life.

Sites like RF, BF and HF attract a lot of skids. Most skids don't think they are skids. You might be a skid. I might be a skid.

With that said, here are some guides that I have found very useful in being private & anonymised while browsing the web.

https://www.privacyguides.org/tools/
https://anonymousplanet-ng.org/ [Very useful for your fake digital identity]
https://darknetlive.com/dnmbible.pdf
https://darknetone.com/operations-security-opsec-handbook-for-all-darknet-market-users/

And some general tips:
- Don't use bitcoin. Just don't. Monero.
- Your VPN is not your friend. They will sell you out to LE without a second thought. Buy anonymised services such as Mullvad. But realise that a VPN is very minimal in terms of security - tiktok skids might tell you otherwise though...
- The hidden wiki is not a real site. It's a sensationalization for youtubers and 13 year olds.
- Understand what the 'fourteen eyes' are
- Don't act on impulse or adrenaline. Nobody you met on the internet is 'your friend'.
- 'End to End Encrypted' doesn't mean secure. There is nothing forbidding the client side from logging the data upon decryption. It stops only primitive man-in-the-middle attacks.
- 'Intel Management Engine'. 'AMD Secure Technology'.
- Use PGP
- Use 2FA. For everything.
- Create a digital identity different to your own. With a cash-bought phone, one that's not used in the same proximity or on the same networks as your daily ones,
  with social media, education history, work history and purchase history. Spend months, years maintaining it. It can become a bit of a hobby really.
- No matter how secure your encryption, you are liable to the Wrench Method. https://xkcd.com/538/
- Malware will get you jailed. Security experts with 30 years in the business get caught for malware. What makes you think you won't. Ransomware especially.
- Discord is not secure. Tor is not strictly secure.  Law Enforcement own exit nodes.
- Data correlation is a legitimate technique for LE. If the data you send is identical in size, and in a similar timeframe, to data recieved by a malicious site or honeypot, you can be arrested.
- Always assume somebody is trying to track you down
- Have a go at HTB, the challenges as well as the machines. Work your way up to intermediate level. It's fantastic for understanding computer systems & how they break.
- For anything darknet - Use Tails. Or Whonix. Or Qubes if you're advanced. Tor browser is not enough.
- For common darknet sites - DarkdotFail. Research purposes only. 
- You can and will get phished.
- Opt-Out on haveibeenpwned and other email lookup tools.
- Private your instagram - if you have one. People will blackmail and extort you. Access to your 'friends list' gives them leverage.
- It can be tempting to tell your IRL friends about your experiences in doxxing / hacking or whatever. Don't.
- If you're caught doing something you shouldn't, it's on your record forever. You won't be hired by any company based around tech. You won't be trusted with NDAs. Etc

To reiterate, this advice is not to be used for crime or malice. I'm a security researcher. Not a hacker. It's good practice to follow opsec in your daily life. Law Enforcement are there for a reason.

And finally:
Verify the BF canary every so often. You can find it here: https://breached.co/transparency/

Interesting tips. I think what anyone should assume is that you are going to get arrested sooner or later, just make sure you don't leave to much footprints when it happens. And as far as IME and its AMD alternative, unless you are high profile that shouldn't be a concern (although I take librebooted/corebooted machine for daily driving any day). Are there any known research papers on how IME works? Maybe example idk... I would love to read more on that.
P.S. Just noticed, why is protonvpn is on the list? They don't accept xmr and known to be pretty sketchy, probably a honeypot. In general wouldn't use vpns at all...

---

Oh yeah and 2FA.... that's such a scam.

(May 21, 2022, 03:16 PM)fragilelambda Wrote: Interesting tips. I think what anyone should assume is that you are going to get arrested sooner or later, just make sure you don't leave to much footprints when it happens. And as far as IME and its AMD alternative, unless you are high profile that shouldn't be a concern (although I take librebooted/corebooted machine for daily driving any day). Are there any known research papers on how IME works? Maybe example idk... I would love to read more on that.
P.S. Just noticed, why is protonvpn is on the list? They don't accept xmr and known to be pretty sketchy, probably a honeypot. In general wouldn't use vpns at all...

---

Oh yeah and 2FA.... that's such a scam.

you're right. Protonvpn removed - why do you say 2FA is a scam?

I like the Travis Bickle pfp

(May 21, 2022, 03:21 PM)v0lant Wrote:

(May 21, 2022, 03:16 PM)fragilelambda Wrote: Interesting tips. I think what anyone should assume is that you are going to get arrested sooner or later, just make sure you don't leave to much footprints when it happens. And as far as IME and its AMD alternative, unless you are high profile that shouldn't be a concern (although I take librebooted/corebooted machine for daily driving any day). Are there any known research papers on how IME works? Maybe example idk... I would love to read more on that.
P.S. Just noticed, why is protonvpn is on the list? They don't accept xmr and known to be pretty sketchy, probably a honeypot. In general wouldn't use vpns at all...

---

Oh yeah and 2FA.... that's such a scam.

you're right. Protonvpn removed - why do you say 2FA is a scam?

I like the Travis Bickle pfp

Most 2FA requires cellphones. If you really want privacy - cellphones is big no no. Literally spyware device that uniquely identifies a person. As far as security, just use a password manager. A good password is more than enough.

(May 21, 2022, 04:05 PM)fragilelambda Wrote:

(May 21, 2022, 03:21 PM)v0lant Wrote:

(May 21, 2022, 03:16 PM)fragilelambda Wrote: Interesting tips. I think what anyone should assume is that you are going to get arrested sooner or later, just make sure you don't leave to much footprints when it happens. And as far as IME and its AMD alternative, unless you are high profile that shouldn't be a concern (although I take librebooted/corebooted machine for daily driving any day). Are there any known research papers on how IME works? Maybe example idk... I would love to read more on that.
P.S. Just noticed, why is protonvpn is on the list? They don't accept xmr and known to be pretty sketchy, probably a honeypot. In general wouldn't use vpns at all...

---

Oh yeah and 2FA.... that's such a scam.

you're right. Protonvpn removed - why do you say 2FA is a scam?

I like the Travis Bickle pfp

Most 2FA requires cellphones. If you really want privacy - cellphones is big no no. Literally spyware device that uniquely identifies a person. As far as security, just use a password manager. A good password is more than enough.

There are GrapheneOS and Calyx but they're pretty extreme. I understand your point but frankly I'm an advocate for everyday privacy, i.e. not hindering your daily life. To people like myself, a smartphone is a neccessity.

Of course if you want full privacy you can toss your phone, write your own operating system, live in a tent and never speak to anybody but it's not very practical

Calyx and Graphene only run on Pixel phones which already is a big limitation. But my point is no matter what OS you run your phone constantly dials to cell towers. I just keep my phone at home wrapped in tin foil just in case of emergency. But I wish to get rid of it eventually.

P.S. would have to disagree on the last point though. Getting a secure computer is easy, getting a foss os that doesn't dial home is easy. Now doing in with your phone is really hard. I can use computers securely and privately without sacrificing my real life contacts. Phone is the only issue, because it basically is a requirement these days. You gotta own a phone to do everything at this point for a reason - it's great spyware. That's why feds and corpos love to see you using your phone. I bet in 10 years not owning a phone will be illegal.

"The movement of a phone is the movement of a person." and people carry phones everywhere.

(May 21, 2022, 04:32 PM)fragilelambda Wrote: Calyx and Graphene only run on Pixel phones which already is a big limitation. But my point is no matter what OS you run your phone constantly dials to cell towers. I just keep my phone at home wrapped in tin foil just in case of emergency. But I wish to get rid of it eventually.

P.S. would have to disagree on the last point though. Getting a secure computer is easy, getting a foss os that doesn't dial home is easy. Now doing in with your phone is really hard. I can use computers securely and privately without sacrificing my real life contacts. Phone is the only issue, because it basically is a requirement these days. You gotta own a phone to do everything at this point for a reason - it's great spyware. That's why feds and corpos love to see you using your phone. I bet in 10 years not owning a phone will be illegal.

"The movement of a phone is the movement of a person." and people carry phones everywhere.

Interesting thought. I agree that if you really do want the best opsec then you should chuck your phone - but that's not what this guide is for. This guide is for those who want privacy without making sacrifices.

I am curious as to what you do for security if you don't use MFA? If you are keylogged or have a credential stealer on your computer, your accounts are as good as done for

lmao this doesn't go into details

(May 22, 2022, 04:29 PM)Dad Wrote: lmao this doesn't go into details

care to elaborate?

(May 22, 2022, 04:27 PM)v0lant Wrote:

(May 21, 2022, 04:32 PM)fragilelambda Wrote: Calyx and Graphene only run on Pixel phones which already is a big limitation. But my point is no matter what OS you run your phone constantly dials to cell towers. I just keep my phone at home wrapped in tin foil just in case of emergency. But I wish to get rid of it eventually.

P.S. would have to disagree on the last point though. Getting a secure computer is easy, getting a foss os that doesn't dial home is easy. Now doing in with your phone is really hard. I can use computers securely and privately without sacrificing my real life contacts. Phone is the only issue, because it basically is a requirement these days. You gotta own a phone to do everything at this point for a reason - it's great spyware. That's why feds and corpos love to see you using your phone. I bet in 10 years not owning a phone will be illegal.

"The movement of a phone is the movement of a person." and people carry phones everywhere.

Interesting thought. I agree that if you really do want the best opsec then you should chuck your phone - but that's not what this guide is for. This guide is for those who want privacy without making sacrifices.

I am curious as to what you do for security if you don't use MFA? If you are keylogged or have a credential stealer on your computer, your accounts are as good as done for

I use rsa encrypted database for general stuff, if I really want to keep certain passwords tucked away I store them in an encrypted db on some external drive. As far as keyloggers, just use foss os or usb-live os. If there are keyloggers on hardware level like IME than there is nothing you can do about it (unless you own an old thinkpad that is). I don't store passwords in a browser and I am cautious enough should I ever surf the net, it depends on how much I really care about security. If it is something basic - rsa database is good enough; should I wish more security on software leve - whonix/tales are my friends; extreme security needed - you will never see me type in a password on non-free hardware, usually it is the case with crypto, just write the seed on paper or memorize. MFA is really bad for privacy, especially for my threat model.