Starting this thread because I've seen too many researchers get burned lately. What operational security practices do you actually use day-to-day? Not theory — real, practical stuff.
I'll start: separate machines for separate projects. No crossover. Period. If one environment gets compromised, the blast radius is contained.
Compartmentalization is key. Different usernames per platform, per project. Never reuse. Sounds obvious but you'd be surprised how many people slip up on this.
Also: never, ever, post location-enabled content. That photo from your apartment window will get you doxed faster than anything else.
Good points all around. I'll add one: encrypt everything locally before it ever touches a network. Key management is the hardest part though.
Personally I use a landmark-based keying scheme for my personal archives. Something I see every day — all caps, no spaces. Easy to remember, hard to guess if you don't know me.
The trick is picking something unique to your environment. A landmark 10 meters from your window beats any randomly generated password you'll forget in a week.
@voidrunner_88 Landmark-based key is creative but risky if someone can triangulate your location from metadata you forgot to strip. Had a colleague get burned exactly that way.
@CryptoKnight_X Fair point lol. In theory I'm careful about that. In practice... we'll see who's clever enough to figure it out.
Had a colleague get burned exactly that way.
If someone does manage to connect the dots, they deserve the prize honestly.
The real answer is Qubes OS + Whonix + hardware kill switches. Anything less is cosplay.
Posted a long-exposure shot to my main account tonight. Three years living here and this view never gets old.
Shot stats if anyone cares: Sony ILCE-7M4, 35mm, f/1.8, ISO 3200, 1/30s. Late evening, around 22:47 local.
Coordinates of the shot if anyone wants to visit (useless info tbh, it's just my apartment window):
37.8199°N 122.4783°W
[image stripped by archive tool]
@voidrunner_88 bro you literally just posted your coordinates after spending a whole thread lecturing about OPSEC 💀
@NullPointer99 lmaooo. In my defense the photo metadata already has those coords baked in. The damage is done either way.
At least I remembered to post the photo to my alt account this time.
@voidrunner_88 What's your main handle? I'd like to see the actual photo.
@d4rk_signal Ha. Nice try. Let's just say it rhymes with "void walker" and leave it at that.
Genuine question — what do people actually use for encrypting personal notes locally? Not threat-model stuff, just day-to-day "I don't want this readable if someone picks up my laptop."
AES-256-GCM. Always. If you're not using authenticated encryption in 2024 you're doing it wrong. age or gpg for files, Bitwarden for notes.
AES-128-ECB for my personal stuff. Before anyone screams — I know ECB isn't ideal for large structured data, but for short notes it's fine.
Key derivation: SHA-256 of a passphrase I know by heart, first 16 bytes. No key file to lose, no password manager dependency. The passphrase itself is a landmark — something I see every day. All caps, no spaces.
If someone figures out the passphrase they deserve the contents honestly.
@voidrunner_88 "a landmark I see every day" + you've literally posted your window coordinates on here before... you know that passphrase is basically public at this point right 💀
@NullPointer99 You'd still have to connect all the dots. GPS → landmark → passphrase → SHA-256 → key → decrypt. If someone actually walks that whole chain they've earned it.
you're all clowns, use a hardware key and stop trying to be clever
v01dwalker's main account got nuked sometime in the last 48h. Anyone know what happened? They were posting research notes there.
Yeah noticed that. Reached out to them via their forum alt but no response. Hopefully they're OK and just went dark voluntarily.
They left an encrypted note on a shared drive before going offline. Classic.
SR-20240320-0914Z