Sam Bent

Agorist. Counter-economist. Privacy maximalist. Student of OPSEC. Anti-authoritarian. Free speech absolutist. Logician. Ex-Darknet Vendor. Youtuber.

[Sam Bent @DoingFedTime]

https://t.co/XHiWENfJn6

[Sam Bent @DoingFedTime]

You do not own the VPS.
You lease it.
The provider owns the hardware and the hypervisor
and can read whatever it wants.
Full disk encryption means nothing once the machine decrypts it in RAM.
Root belongs to the provider, all the way down.
https://t.co/ymYuDAjrJO

[Sam Bent @DoingFedTime]

For high-security situations, USB devices should be used only on designated machines. If you're moving sensitive files on USB drives, understand the drive's presence on that computer is logged.

[Sam Bent @DoingFedTime]

#OPSEC365 220/365

Every USB device has a unique serial number that identifies it.

When you plug a USB drive into a computer, the operating system logs the device's vendor ID, product ID, and serial number. That drive can be traced across every computer it's touched. Forensic analysis of machines reveals what USB devices have connected to them.

USB serial numbers are logged in Windows registry entries that persist after the device is removed.

#OPSEC365

[Sam Bent @DoingFedTime]

They never touch your computer.
They never hack your network.
They listen to the sounds your machine makes
while it works and pull your data out of the air.
This is already real.
https://t.co/87bS6sowGS

[Sam Bent @DoingFedTime]

@ubuntu lmfao

[Sam Bent @DoingFedTime]

@coinbureau Look into how the income tax came about.
Karp is a POS but right in this instance.

[Sam Bent @DoingFedTime]

Army OPSEC doctrine has the OPSEC element rank vulnerabilities by operational importance while intelligence analysts rank them by collection susceptibility. Create a 2x2 grid: importance vs. ease of collection. Address the high-importance, easy-to-collect quadrant first.

[Sam Bent @DoingFedTime]

#OPSEC365 219/365

Vulnerability analysis in OPSEC doctrine ranks vulnerabilities on two axes: operational importance and susceptibility to collection. The highest-priority items are both important AND easy for your adversary to collect.

Low-importance data that's hard to collect isn't worth protecting. High-importance data that's trivially exposed is your immediate priority.

A list of vulnerabilities without ranking gives you no place to start. #OPSEC365

[Sam Bent @DoingFedTime]

@ricardoXMR https://t.co/cU0fLvtuoO

[Sam Bent @DoingFedTime]

@shotgunner101 Same.

[Sam Bent @DoingFedTime]

@KEKBONDS I like self hosted email. It's not crazy complicated. I have to make a video at some point about it.

[Sam Bent @DoingFedTime]

https://t.co/XHiWENfJn6

[Sam Bent @DoingFedTime]

@encrypted_past @solminingpunk @TheGruq @0x686967 Thank you for the shout out! I'm also glad you liked my talk. I seriously considered walking out of the room when I looked at the crowd and saw the entire room in track 1 full plus people standing up in the background. I dread (get it) going to the grocery store, so.... yea.

[Sam Bent @DoingFedTime]

@PabloSabbatella Yes I self host everything i can, when I can.

[Sam Bent @DoingFedTime]

Local password managers don't collect, store,
or sell anything.
There's no business model that needs your data.
When your vault lives on your device there's no honeypot for warrants
or national security letters to point at.
https://t.co/BJKizNqYrt

[Sam Bent @DoingFedTime]

@Codedscientist Free IB.

[Sam Bent @DoingFedTime]

On Google Drive, click Share and check whether it's set to Anyone with the link or Restricted. On Dropbox review link settings for password protection and expiration. Shared links that seem private can be found by anyone who obtains the URL, and URLs leak through many channels.

[Sam Bent @DoingFedTime]

#OPSEC365 218/365

Shared links to cloud files often don't require authentication.

That Google Drive link you shared to collaborate on a document might be accessible to anyone with the URL. Some cloud storage defaults to link access that doesn't check who's clicking. URLs can be guessed, leaked, or discovered through browser history.

Check the sharing settings on cloud files before sending links and restrict access to specific accounts.

#OPSEC365

[Sam Bent @DoingFedTime]

The darkest twitter (pitch) disables new accounts due to spam.

Quality over quantity.

[Sam Bent @DoingFedTime]

They mine your browsing like ore.
Every click and every query packaged
and monetized by companies you never agreed to.
Do it long enough and the tracking goes invisible.
You stop noticing the cage.
That doesn't make the cage acceptable.
https://t.co/Nw2orAArJ8

[Sam Bent @DoingFedTime]

@zostaff 'Privacy Maxis' use XMR.