this post was submitted on 19 Jun 2021
0 points (NaN% liked)

technology

23218 readers
2 users here now

On the road to fully automated luxury gay space communism.

Spreading Linux propaganda since 2020

Rules:

founded 5 years ago
MODERATORS
 

Please write me a dummies guide to staying out of gizmo. I have a VPN, but that's it rn.

you are viewing a single comment's thread
view the rest of the comments
[–] IlIlIlIlIlIlIl@hexbear.net 1 points 4 years ago* (last edited 4 years ago)

If the feds are your enemy, there's really not much you can do. (TLDR: They are powerful, you are not.)

Unless you are an asset so important to a foreign power that they will be willing to dedicate resources in order to protect you, if the feds want you dead: they will find you, and they will kill you.

Frankly, even if you are an asset so important, you will die anyways, as time is not on your side. They have so many chances to kill you, and you only have one life. Simply observe the assassination of Iranian nuclear scientists. Simply observe the assassination of Soleimani.

The feds will not hold back even when the optics are bad. Simply observe the persecution of Assange.

You can try to use VPNs. You can try to use Tor, even. It will not save you. VPNs will be coerced into collecting logs. Even if they are not, their ISPs definitely will. Tor specifically does not protect against global passive adversaries. The US government is specifically that: a global passive adversary.

The feds see all traffic in, the feds see all traffic out. You most likely live in America. That satisfies one end of the global part. This site uses Cloudflare as a CDN, which is an American company based in America. That satisfies the other end of the global part. (Also note that the feds have the capability of impersonating anyone on this site, as Cloudflare (by necessity of providing a CDN) terminates TLS connections. This effectively nullifies all encryption this site may use. The feds can simply (and may be already) intercept your password in plaintext and then replay that in order to impersonate you. I recommend the admins switch to DDoS-Guard instead, which provides the same services as Cloudflare but is based in Russia instead, but I digress.)

Being able to observe the flow of information both in and out is the fatal flaw of Tor: if you pour water in one end of the pipe and observe it coming out of another, you may make the assumption that those ends are connected.

Thus, Tor will not protect you against the American government.

If even Soleimani couldn't survive the ire of the feds, how can you?

However, this does not excuse you to be complacent and lack defenses against weaker attackers like fascists wanting to murder you.

I recommend using Tor in this instance: fascist paramilitaries are not global, passive attackers like the American government is, so Tor protects against them. The reason I say use Tor is so that if you mess up and accidentally click on an ip-logger or visit one of their sites, they won't be able to instantly send a squad of armed goons to your home to abduct and murder you. Tor also protects against rightoids wanting to SWAT you or cancel your internet connection (granted you remain careful and vigilant in the other aspects of op-sec).

Online, do not speak as if you are yourself: speak as if you are an imaginary person that is not you but shares the same goals as you. In other words: lie about personal details. Even better, you may contradict yourself in your (false) statements about personal details. Perhaps one day you were born in France, perhaps another you were born in Italy. Who knows? If you accidentally leak a personal detail of yourself, you must contradict it in a later statement so as to give doubts about the validity of your other known personal details. This is so that they will not connect your online identity to your real-life identity.

This is very important: if you do not separate your different identities, attackers can easily link your different identities together. This is called doxxing. You really do not want to get doxxed. Getting doxxed may (literally or figuratively) end your life.

I see many people on this site complaining about personal grievances or detailing personal events. While that in a vacuum is okay, in this context it is the worst thing you can possibly do. It is a blatant violation of the separation of identities which is effectively a death knell for op-sec.

If someone knows you in real life, or fuck it, if someone fucking follows your personal Twitter or wherever you deluge all your personal details, they will be able to link together your two identities. Congratulations, you've fucked up. They will be able to doxx you now.

Also you must not use insecure mediums of communication. Do not use Discord. Discord is an American company based in America. By virtue of using Google as their cloud provider, Discord sends all your messages in plaintext to Google. That way, the feds won't even have to ask Discord for your messages; they already have them all! Discord's desktop app (by virtue of being an electron app which loads arbitrary, unsandboxed JavaScript from Discord's servers) is also a RAT (remote access tool, an application that allows its controller to control all aspects (including but not limited to: webcam, microphone, screen capture, all your fucking files) of your computer remotely), as it executes arbitrary (all and any) code sent to it from the Discord servers. And since Discord is an American company based in America, the feds can coerce Discord into RATing your computer by sending you malicious code! Isn't that fun?

Also when protesting, cover your fucking face and remove the SIM card from your phone (and set it to airplane mode). You can bring the SIM card with you (for emergencies), but do not insert it into your phone. The feds triangulate all cellular signals sent from your phone to phone towers to figure out your exact, real-time location and link it to your personal identity. But I would just recommend not bringing your phone in the first place (and leaving it powered on with the SIM card in) and just bringing a camera instead, as it is pretty obvious to the feds that those who go dark when a protest starts and then go back online when it ends probably participated in the protests.