Questions tagged [opsec]

OPSEC or Operational Security is about keeping information safeguarded and is commonly used by militaries or governments.

Filter by
Sorted by
Tagged with
449 votes
13 answers

Is it bad practice to use your real name online?

On some accounts I use my real name on-line (Google+/Facebook/Wikipedia/personal blog), others (Q&A/Gaming) I use an alias. My question is: Security and privacy wise, what can people do with my ...
blade19899's user avatar
  • 3,611
17 votes
2 answers

Is Tor over VPN a security risk?

In his talk about OPSEC, The Grugq stresses that you first have to go through TOR before connecting to a VPN. Otherwise, the VPN would be a direct link from the endpoint to you. He summarizes: TOR ...
Arbuiwer's user avatar
  • 171
13 votes
1 answer

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
Lex's user avatar
  • 4,257
11 votes
3 answers

Disable USB keyboard pluggability on MacBook

I'm concerned about USB devices being physically attached to my MacBook laptop when I am about to unlock my computer or while my computer is unlocked. My threat model involves an attacker who is ...
dionyziz's user avatar
  • 213
7 votes
2 answers

Shutdown if case opened

Assume the user has a full disk encrypted HDD in which their OS and files reside. They also have made attaching USB or any other device without first allowing it cause an automatic shutdown which ...
user5510281's user avatar
6 votes
3 answers

What are some ways to anonymize your writing style?

I imagine that if someone suspected an anonymous online persona of being a specific real person who also had writing samples available online (like a blog or social media) they'd be able to compare ...
user avatar
4 votes
1 answer

When reading PGP or other encrypted emails, is it wise to unplug my computers ethernet in order to use my private key?

I've never used PGP before so my logic may be a bit off. When receiving an email encrypted with my public key, would it not be best to unplug or disconnect my computer's internet before decrypting ...
watchy's user avatar
  • 41
2 votes
1 answer

Anonymity Stack: Home connection -> VPN -> Whonix(Tor) -> Socks5. Few questions on anonymity

So let's assume the following: 1. A host machine running a clean BSD-based OS that has no backdoors, malware, spyware or other potentially de-anonymizing harmful software. 2. One home internet ...
Stackexchange_fan's user avatar
2 votes
1 answer

Why is Pastebin still widely used by malicious actors for sensitive data dumps, given that it's public and easily parsable?

If you scrape Pastebin for research or even just out of curiosity, it quickly becomes apparent that there is an abundance of compromised data that is uploaded there by unknown malicious actors. My ...
Boblicon's user avatar
  • 131
1 vote
1 answer

How do enterprises deal with SSO and Google backing up WiFi credentials?

Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees. Logically, these credentials might also be usable for Wifi. ...
PhilLab's user avatar
  • 205
1 vote
2 answers

How to mitigate the risks of using new, third party imported electronic accessories?

As someone who is naturally good at recognizing risk and who are striving to maintain a wholistic view on security, I’m wondering how to evaluate and reduce the risks of hardware accessories (I.e. ...
dopeideas's user avatar
1 vote
3 answers

Can an unregistered phone with a prepaid SIM card be traced by the police? [closed]

Let's say that someone is using an unregistered phone — I mean just a phone that he bought in another country — with a prepaid SIM card. The person is sending messages only on WhatsApp, without making ...
Opi778's user avatar
  • 21
1 vote
1 answer

Would my hypothetical Opsec setup with the goal of compartmentalizing sensitive areas from an insecure sandbox be sensible?

The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance ...
NocturnalMoon's user avatar
0 votes
3 answers

Is there a way to answer security questions privately while in public?

Is there a strategy for answering security questions via telephone modestly securely while in an insecure environment? For example: I am at a coffee shop and am locked out of my account, I call the ...
Matthew Peters's user avatar
0 votes
2 answers

Not disclosing the password when tortured? [duplicate]

In Citizenfour, Edward Snowden says: Because some of these documents are legitimately classified, in ways that could cause harm to people and methods... Um, I'm comfortable in my technical ...
twowo's user avatar
  • 103
0 votes
1 answer

Red Teaming methodologies focused on op-sec and stealth

We are in the process of developing a Red Teaming team to offer as a service, and one of the biggest obstacles we are struggling with is how to maintain a good op-sec and stealth during engagements. ...
TheMikina's user avatar
0 votes
0 answers

Would fake GET request parameters be considered good opsec?

Let's say I was building a UI and wanted to provide my users with a tad bit more security in cases when their browser history or other personal data on their computer was compromised. If I was to add ...
Schquestoning's user avatar