DEF CON 22 - Zoz - Don't Fuck It Up!
Why Hacker News recommends it
It is the usual cite for why good OPSEC is so hard, including entry and exit point correlation and digital exhaust.
What it is
Zoz's DEF CON 22 talk on operational security in the age of pervasive surveillance. He shows how hard it is to avoid mistakes even for people who should know better.
Recommended by 3 HN commenters across 6 different months, 2016 to 2021.
What Hacker News said
Strong rec pdkl95 · 2019-02 · on ““Reverse location” search warrants identify all cellphones near a crime scene”
According to Zoz in his excellent DEFCON 22 talk "Don't Fuck It Up!"[1] on the difficulties of OPSEC, this type of correlation has been in use for years. >[2] Matching entry / exit point – we know specifically they look for that, so don’t match the last use and first use of phones, overlap it. [1] [this video] [2] [LINK]
Strong rec bluejellybean · 2019-08 · on “The Gig Economy (2018)”
I'm always reminded of Zoz's awesome talk "Don't Fuck It Up!"[0]. There's a ton of sketchy shit you can unfortunately (or fortunately depending on who you are) do online but not getting caught is still a non-trivial task. Successfully hiding is dependent upon the people who you're trying to hide from and your sophistication in hiding. [0] [this video]
Recommends pdkl95 · 2016-06 · on “Cops can easily get months of location data, appeals court rules”
> leaves their cellphones at home while committing crimes, using burner phones for any contact they need during that time That's getting a lot harder to do in practice. OPSEC is hard when you have to care about stuff like overlapping usage of the burner so the movement logs of the regular phone stopping don't correlate with when the burner starts moving. Zoz gave a great overview[1] of modern cellphone OPSEC at DEFCON 22. [1] [this video]
Recommends _asummers · 2016-07 · on “Cloudflare ReCAPTCHA De-Anonymizes Tor Users”
There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up". [this video]
Recommends pdkl95 · 2016-09 · on “Tracking the Owner of Kickass Torrents – Schneier on Security”
OPSEC in the age of mass surveillance is incredibly hard. Zoz gave[1] has a very good overview of modern OPSEC. Staying anonymous requires an attention to detail that most people probably cannot do. The hindsight bias is realizing how serious the situation might be and the level of OPSEC that is required. When the torrent site was first created the risk level wasn't known and most people didn't understand how hard it is to avoid the ubiquitous sensors of the surveillance-industriual-complex. Yes, more people probably should have assumed this level of risk much earlier, but that's easy to say now when we know names like Prism and XKEYSCORE. [1] (note: contains rude/strong language) [this video]
Recommends pdkl95 · 2018-09 · on “‘Five Eyes’ Nations Quietly Demand Government Access to Encrypted Data”
> you're only fucked if your OPSEC is weak The problem is that actually implementing not-weak OPSEC is much harder than most people understand (even those with technical backgrounds). For example, is your "secret" activity on TOR easily tied to your non-secret activity from a search of network entry/exit times (i.e. "secret" activity is the complement "non-secret" activity)? I recommend Zoz's DEFCON talk, "Don't Fuck It Up!"[1], for a very good overview of how hard OPSEC has become. [1] [this video]
Cites fuck_dang · 2016-01 · on “NSA Chief Hacker Explains How to Avoid NSA Spying”
Our friend Zoz of Defcon fame has a talk about NSA spying that enumerates and gives details to some of the ways that the NSA can 'see' you. [this video]
Cites pdkl95 · 2016-08 · on “Facebook recommended that a psychiatrist’s patients friend each other”
That would create very conspicuous network exit/entry points at the office. According to Zoz's DEFCON 22 talk[1] about modern OPSEC, these are specifically targeted by various agencies, so I'm sure Facebook finds entry/exit data points just as interesting. [1] (warning: strong language) [this video]