Secure communication devices
- Thread starter JohnnyDoe
- Start date
The more you do, the larger your attack surface becomes. The larger your attack surface, the more you have to protect. The more you have to protect, the greater the statistical chance something slips through and you get breached.
For most people who are genuinely OPSEC aware, the bar is surprisingly low:
Too many are actively booby-trapping themselves in the pursuit of flexing the latest encrypted phone, hardened OS, anonymous VPN stack, or obscure privacy gadget. While the examples are in tech, dependencies can also be environmental or human. Every additional black box you introduce is something you don't fully understand: unknown firmware, unvetted supply chains, telemetry you can't see, update mechanisms that could be subverted, or side-channels you never considered. The more opaque layers you stack for "protection," the less visibility you have into your actual attack surface and how well (or poorly) your defenses are really configured.
Security is, and always has been, incorporated on a SOP level. So assuming breach is inevitable (or has possibly already happened). Just live your life accordingly, constantly aware that your actions might be observed, logged, or reconstructed like Jim Carry's in The Truman Show.
For most people who are genuinely OPSEC aware, the bar is surprisingly low:
- Use strong, simple encryption where it matters (full-disk, messaging, passwords).
- Avoid leaving a digital footprint when doing anything sensitive or "stupid". You can even throw your phone away if you can bear the inconvenience.
- Ruthlessly minimize the technologies, accounts, and services you rely on.
Too many are actively booby-trapping themselves in the pursuit of flexing the latest encrypted phone, hardened OS, anonymous VPN stack, or obscure privacy gadget. While the examples are in tech, dependencies can also be environmental or human. Every additional black box you introduce is something you don't fully understand: unknown firmware, unvetted supply chains, telemetry you can't see, update mechanisms that could be subverted, or side-channels you never considered. The more opaque layers you stack for "protection," the less visibility you have into your actual attack surface and how well (or poorly) your defenses are really configured.
Security is, and always has been, incorporated on a SOP level. So assuming breach is inevitable (or has possibly already happened). Just live your life accordingly, constantly aware that your actions might be observed, logged, or reconstructed like Jim Carry's in The Truman Show.
Why not using pixel + graphene os?
Personally I do stay away from closed systems as there is always a risk for honeypot or sth similar (or like encro sky chat and so on)
Nitrophone (German based company) is also offering to remove all sensors/cameras in addition but also same risk / sb else had your phone before you have it.
Personally I run ios with Session for not that privat stuff and graphene os with session and Threema for stuff that really should stay āprivateā
āā
On the computer I would always recommend a volume encryption + a virtual machine (only work on the vm!), host and vm with a different vpn that works with a firewall/iptables based killswitch
Personally I do stay away from closed systems as there is always a risk for honeypot or sth similar (or like encro sky chat and so on)
Nitrophone (German based company) is also offering to remove all sensors/cameras in addition but also same risk / sb else had your phone before you have it.
Personally I run ios with Session for not that privat stuff and graphene os with session and Threema for stuff that really should stay āprivateā
āā
On the computer I would always recommend a volume encryption + a virtual machine (only work on the vm!), host and vm with a different vpn that works with a firewall/iptables based killswitch
Easy and effective!
100%
Exactly. Itās not that hard to remove mic, speaker and cameras yourself anyway.
All this is enough for 99% of the people, and free.
What I wanna add is:
if you are doing shady stuff for example, make sure to not use for example your private Facebook account in the same VM you are doing your stuff.
If you do - all your vpns/encryption whatever wonāt help you.
Setup above is enough for everything and I would say for 99.99% of police aswell to not be able to track you down by your ip and so on.
Also, a vpn router with killswitch (gli net has cheap and easy to handle devices) is never a bad idea.
if you are doing shady stuff for example, make sure to not use for example your private Facebook account in the same VM you are doing your stuff.
If you do - all your vpns/encryption whatever wonāt help you.
Setup above is enough for everything and I would say for 99.99% of police aswell to not be able to track you down by your ip and so on.
Also, a vpn router with killswitch (gli net has cheap and easy to handle devices) is never a bad idea.
I don't have an answer for this one š³
I can only think of this:
At the ānetwork level,ā itās no longer about one clever person staying clean.Itās about designing, or participating in, a system where:
š
PS. If they can get their hands on one guy and that guy can DOXX others...it's ALL over. It's a Domino Effect at this point
So the solution is having a network without having a network + zero trust.I don't have an answer for this one š³
I can only think of this:
At the ānetwork level,ā itās no longer about one clever person staying clean.
Itās about designing, or participating in, a system where:
š
PS. If they can get their hands on one guy and that guy can DOXX others...it's ALL over. It's a Domino Effect at this point
Like Bitcoin, or even better yet...Monero-type network.
The internet is far more centralized than most realize, full of chokepoints where traffic can be logged or intercepted. That said, you need to be doing something serious to attract real targeted attention.
You can reduce your exposure by owning your own hardware and infrastructure where possible. But once your data leaves your network and travels over someone else's pipes, you're leaking metadata. Zero-trust sounds great on paper, but it only works if you actually control the infrastructure to enforce clear trust boundaries.
The smartest practical approach is to blend in. With governments rolling out widespread age verification, millions are about to flood VPN providers. Once that happens, your encrypted traffic to those same VPN nodes will be lost in the massive herd of people just trying to watch porn privately.
Nothing is secure. Nothing. A one time pad system with truly randomly generated key of sufficient length is the closest to secure in communications.
All you can do is make life difficult for the scrubs of the world like @gh0p
@compromised knows his stuff here. Limit the attack surface. Compartmentalize to limit the consequences of the inevitable breaches. Make yourself a hard target in subtle ways that donāt stand out. Blending in with crowd works well right up until you get noticed, though.
All you can do is make life difficult for the scrubs of the world like @gh0p
@compromised knows his stuff here. Limit the attack surface. Compartmentalize to limit the consequences of the inevitable breaches. Make yourself a hard target in subtle ways that donāt stand out. Blending in with crowd works well right up until you get noticed, though.
@jafo I have stories I could tell about é»č¦ and åč¶. å½å® collect everything and are watching. They just have not felt a need to do anything yet. But if you are 鬼佬 then they have a file on you. Guaranteed. And you are one misunderstanding or greedy official away from č¢«å¤±čøŖ.
There are several types of state actors which are going to be the highest threat level. My favorite quote is āa government bureaucracy canāt find its own ass with both hands but they can keep adding hands until they find someoneās assā. Security police or counterintelligence police are the absolutely highest threat, but can be hardest to be noticed by. Can be, because there are several categories of this type.
Your Kripo/Vopo/ę°č¦/financial police/local police are going to be a considerably lower threat level than the above on a technical level and in competence, and they are going to be less thorough and more arbitrary in who they decide to notice, which are generally going to be either the āeasyā ones or the āhigh profileā ones. They have the resources to be dangerous if you fall into those categories.
Your private professionals have a higher level of technical ability and competence than the above, but generally donāt have the resources, mandate, nor desire to target specific individuals. Itās often just bad luck to gain their notice, and some moderate amount of hardening will generally cause them to move on to easier targets. Most are looking for scores or something specific, and they want easy targets requiring minimal effort for the former while you are very unlikely to be the latter. There are also not so many truly competent people in this category across the world.
The rest are the scrubs. A moderate amount of hardening will prevent them from accomplishing anything. They are a low threat to anyone intelligent.
- The government that can, but generally wonāt unless you cross some reasonably well understood lines (US, EU)
- The government that can, but generally wonāt except under circumstances that can be quite arbitrary (China, Russia)
- The government that can and generally always will (North Korea, former DDR)
- The government that cannot (Africa, South America, Southeast Asia)
Your Kripo/Vopo/ę°č¦/financial police/local police are going to be a considerably lower threat level than the above on a technical level and in competence, and they are going to be less thorough and more arbitrary in who they decide to notice, which are generally going to be either the āeasyā ones or the āhigh profileā ones. They have the resources to be dangerous if you fall into those categories.
Your private professionals have a higher level of technical ability and competence than the above, but generally donāt have the resources, mandate, nor desire to target specific individuals. Itās often just bad luck to gain their notice, and some moderate amount of hardening will generally cause them to move on to easier targets. Most are looking for scores or something specific, and they want easy targets requiring minimal effort for the former while you are very unlikely to be the latter. There are also not so many truly competent people in this category across the world.
The rest are the scrubs. A moderate amount of hardening will prevent them from accomplishing anything. They are a low threat to anyone intelligent.
I believe you, but it would not be worth their time. Too many eyes at the University and in business etc etc.
Also, after the Bo Xilai incident, the prosecutions of é»č¦ have increased dramatically. They are being hunted down. China court cuts Gu Kailai sentence to life in prison. Published 14 December 2015
Furthermore, I am a really easy person who does business with many companies here, including Huawei, Tencent and some other big ones, so it would have to really be a crazy é»č¦
PS. I don't talk to cops ever and I have some attorneys here that make sure I never have to. Not had a problem in +30 years coming here in and out. Now, living here is majestic for me. We'll see.
Last edited:
Donāt be Iranian.
Most people never have problems in China. People are put to sleep by that. When people do have problems it goes from 0 to āoh shitā in a heartbeat. Youāve been there a while so you know the score. But one can also go from living in Hong Kong to having to fly through Narita or Dubai because one canāt even set foot in the airport for a flight connection.
Let me ask you this:
(1) If you were me, how would you go about NOT to be entangled with dirty cops or dirty politicians or dirty/criminals in general?
(2) What steps would you take to NOT only protect yourself, but to discourage an "unauthorized" approach to have "tea"?
I might not be the right one to ask about this. I wouldnāt ask an incel how to make it with a woman either. š¤£
