antiaall3s, to opsec
@antiaall3s@chaos.social avatar

Communication habits among leftist #activists that i no longer understand:

Why still use twitter, instagram, facebook to promote stuff? Steal your data, you are their product.
Use the Fediverse instead. (Blsky no better)

Why still use telegram, whatsapp to chat, organise? Encryption iffy, cannot be trusted.
Use @signalapp instead.

Why still use GoogleDocs to collaborate on texts, documents? Steal your data, track you.
Use @cryptpad instead.

We have the tools for better #OpSec.

xyhhx, to opsec
@xyhhx@438punk.house avatar

re: my recent boost (linked below)

mics (machine identification code) are nearly invisible marks most printers add to anything they print, as a means of tracking where each peice of printed material was printed from - down to the exact printer. not model, the individual printer

it's allegedly to curb counterfeit money, but obviously it can be used to connect material you print for, say, activism or political stuff down to the exact printer you used. if you're going to bureau en gros to print, or if you used a printer you bought, it can be traced to you

the @eff has some material that tried to identify printers that do or do not use mics, but it's no longer maintained:

https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-dots

makeuseof.com has another informative article on the subject including possible mitigations:

https://www.makeuseof.com/machine-identification-codes-printer-privacy-risk/

some mitigations they suggest include:

these are both only useful to technically savvy people i think tho

anyway stay vigilant gang

#opsec #privacy #activism

https://infosec.exchange/@jxhn/112400527690021252

MagicLike, to hosting
@MagicLike@mstdn.social avatar

I got a DM about how to host a Website as anonymous as possible, especially viewed from the outside with as little attack surface as possible. I already threw a bunch of my ideas in the room, but maybe you can think of something I haven't thought of...
Please just answer to this post if something crosses your mind from security over hoster to the website itself, I will link it to the person.

:boost_requested:

@askfedi

Forcen,
@Forcen@raru.re avatar

@MagicLike @askfedi This is sort of relevant, tips how to blog anonymously: https://mullvad.net/en/help/how-blog-anonymously
It doesn't involve hosting but lots of the tips are useful.

endareth, to apple
@endareth@disobey.net avatar

Reminder that everyone with an account should enable Advanced Data Protection to ensure all your data stays encrypted: https://support.apple.com/en-au/guide/iphone/iph584ea27f5/ios

ianonymous3000, to privacy
@ianonymous3000@mastodon.social avatar

🚨 Attention iOS & iPadOS users! 🚨

I've just updated my ultimate hardening guide, and I need your help to make it even better! 🙏

Check it out here: https://github.com/iAnonymous3000/iOS-Hardening-Guide

Please let me know:
✅ Is it easy to follow?
✅ Any areas need more detail?
✅ Suggestions for improvement?
✅ Most helpful tips?

Show your support by starring the repo! ⭐️

#privacy #opsec #cybersecurityawareness #hardeningguide #ios #ipados

outlyer, to opsec Catalan
@outlyer@mastodont.cat avatar

Així que Espanya va enviar una de les seves ordres xusques a Suïssa (d'aquelles que anomenen terroristes a Tsunami –LOL), Suïssa va requerir a #ProtonMail i això va acabar descobrint la identitat d'una persona (a través del seu mail de recuperacio i un requeriment a Apple), i en la seva detenció.

Aneu amb compte i no doneu per fet que un servei segur/encriptat us converteix en anònims.

(Notícia de fa mínim dos setmanes que pel que sigui no m'havia arribat fins avui)

#opsec

xevhi,
@xevhi@techhub.social avatar
protonprivacy,
@protonprivacy@mastodon.social avatar

@xevhi @outlyer Note that the recovery address (which was the only thing we had access to and could provide regarding this account) is an optional recovery method, and not the only one we offer: https://proton.me/support/set-account-recovery-methods

nikita, to opsec German
@nikita@social.tchncs.de avatar


Are privacy and the messaging app still secure

Every year this gets called into question, yet rarely is the full story ever told. In this video, Josh explains what's really happening with these privacy and security apps as well as how it affects YOU directly.

, 𝚛𝚎𝚜𝚙. 𝚍𝚊𝚜 𝚐𝚊𝚗𝚣𝚎 𝙳𝚛𝚞𝚖𝚖𝚑𝚎𝚛𝚞𝚖 𝚒𝚜𝚝 𝚖𝚒𝚗𝚍. 𝚜𝚘 𝚠𝚒𝚌𝚑𝚝𝚒𝚐 𝚠𝚒𝚎 𝙰𝚙𝚙𝚜 & 𝙲𝚘.

https://invidious.fdn.fr/watch?v=9ZLMDMk5rzk

Tutanota, to opsec
@Tutanota@mastodon.social avatar

Are you a journalist, activist or whistleblower in need of an anonymous email account that doesn't require a personally identifiable recovery email address or phone number?

Tuta has you covered. 👉 https://tuta.com/blog/anonymous-email

This is anonymity done right. 😎
#anonymous #opsec #privacy #encryption

JenMorency, to opsec
@JenMorency@toot.community avatar

#Opsec Matters: #Encrypted services #Apple, #Proton and #Wire helped #Spanish police identify #activist https://techcrunch.com/2024/05/08/encrypted-services-apple-proton-and-wire-helped-spanish-police-identify-activist/ "The legal requests sent to Wire, Proton & Apple are related to a case where Spanish authorities believe that a pseudonymous member of the #Catalan pro-independence movement Tsunami Democratic was helping the group plan some kind of actions or demonstrations at the time when King Felipe VI was planning to visit the region in 2020." They were ID'ed thru recovery e-mails.

ianonymous3000, to Cybersecurity
@ianonymous3000@mastodon.social avatar

📚 Just completed the 'Basics of Personal Threat Modeling' course by @privacyguides 🛡️

Threat modeling is crucial because it helps identify and prioritize the most probable security and privacy risks. It enables focused resource allocation, tailored defenses, and heightened awareness.

Check it out: https://learn.privacyguides.org

image/png

privacyguides,
@privacyguides@neat.computer avatar

@ianonymous3000 glad you liked the course 🙌​

arcadetoken, to Cybersecurity
@arcadetoken@autistics.life avatar

Please be super careful using public wi-fi, even with a VPN. Zero day in existence for over 20 YEARS was announced impacting VPN use with regards to rogue or compromised DHCP servers on the LAN, which allows redirection of VPN traffic. If you can avoid public network use (i.e. using a cell service/hotspot instead of a public wifi network in a cafe, store, etc.), just avoid it. https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/?comments=1&comments-page=1

#cybersecurity #vpn #opsec

datenwolf, to opsec
@datenwolf@chaos.social avatar

Some people should not be allowed anywhere near networked computers. Just participated in some EU research project kick-off meeting…

> We have a 250TB storage system for our data with "RAID-6 backup".

> You can reach it under hʇʇp://foobar‍.‍fnord‍.‍fail (it's a HTTP 301 redirect to some IP in a university's address range; no TLS; plaintext HTTP).

Ã̵͔̏̐͗̍a̸͍̅̑̔̚a̶͔̲͛̔̄͘r̸̠̙̻͚̾̑͂r̴̭̞̫̜̍̇g̵̘͚͙̫̊̿͠g̸̢͍̣̗͊̒̏̓̕ǵ̶͍̠͔̲̟̔̎͌̓h̶͔͈̜̦̋ḩ̴̱͆͠ḣ̴͉h̶̞̺̟͂̈́̀ ← my headspace

#itsec #opsec

datenwolf,
@datenwolf@chaos.social avatar

I mentally crossed that threshold where I think, that every publicly funded project by law should be enforced to have at least one hire with 𝕒𝕝𝕝 𝕥𝕙𝕖 𝕔𝕖𝕣𝕥𝕚𝕗𝕚𝕔𝕒𝕥𝕚𝕠𝕟𝕤¹ on the payroll with the sole role of managing the IT stuff.

¹: I don't care that having the certs doesn't mean, they're actually competent. I'd be perfectly contempt with some checklist checking button pusher who at least memorized by rote some "best practices" and does a 40% job. That'd still be better, than current affairs.

ArneBab,
@ArneBab@rollenspiel.social avatar

@datenwolf wouldn’t it suffice (or be better) to require Universities to have enough permanent IT staff who will support projects?

And to require them to sign-off the IT plans of any project?

froyed, to security
@froyed@mastodon.social avatar

Proton have a _ service:
email
VPN
calendar
cloud storage
password manager

They should do a 2FA service like Authy next.

mjgardner, (edited )
@mjgardner@social.sdf.org avatar

@froyed The paid version of #ProtonPass does have an integrated #2FA authenticator, synced across your devices via their cloud storage and end-to-end encrypted along with everything else. What else do you need #Authy for?

froyed, to security
@froyed@mastodon.social avatar

Many video game anti-cheats act essentially like malware.

This is because they are given Kernal level permissions which allows the software to monitor the system.

Many popular online games use anti-cheat. Be aware.

wagesj45, to Meme
@wagesj45@mastodon.jordanwages.com avatar

I HATE PASSKEYS! I DON'T WANT TO "UPGRADE" TO PASSKEYS!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • anitta
  • InstantRegret
  • mdbf
  • osvaldo12
  • magazineikmin
  • tacticalgear
  • rosin
  • thenastyranch
  • Youngstown
  • Durango
  • slotface
  • everett
  • kavyap
  • DreamBathrooms
  • JUstTest
  • khanakhh
  • ethstaker
  • cubers
  • normalnudes
  • tester
  • GTA5RPClips
  • cisconetworking
  • ngwrru68w68
  • megavids
  • provamag3
  • Leos
  • modclub
  • lostlight
  • All magazines