Cyber OPSEC Video

Cyber OPSEC (YouTube Video: 43 minutes)

Learn how hackers gain access and how to take basic steps to protect yourself. In this video, a "friendly hacker" and his cohorts will lead you through cyberspace to uncover common mistakes and misgivings as well as the OPSEC measures you can take to protect yourself and your critical information.

Sabotage, Booby-Traps and Direct Action

Among activists and protestors are those who use direct action and sabotage to advance their cause.

From the 1993, Ecodefense: A Field Guide to Monkeywrenching to the more current Earth First Direct Action Manual 3rd Edition there are guides readily available on-line that teach users how to sabotage machinery, damage vehicles, and disrupt commercial operations such a logging, mining, and hunting, as we see in the Earth First Wolf Hunt Sabotage Manual. The March 2017 web-site Earth First! Mechanic's Guild offers updates to Ecodefense.

Awareness of these tactics is important for those who work in these commercial industries, for conservation law enforcement / game wardens working in wilderness areas, and as we see in the Earth-First "Death Manual" for ‘off-roaders’ who ride in wilderness areas. (Note: that the off-road community titled this the "Death Manual", not Earth First.

You don’t have to work in a wilderness area however to be a target of sabotage and direct action, as we can see from the Animal Liberation Front Guide to Direct Action (2010).

Targets of the Animal Liberation Front and Earth Liberation Front can be seen in this table from the May 2013 report An Overview of Bombing and Arson Attacks by Environmental and Animal Rights Extremists in the United States, 1995-2010. 

Recipes for Disaster: An Anarchist Cookbook is a 625 page manual discussing a wide range of topics of interest to activists and those interested in direct action.  A Step-by-Step Guide to Direct Action provides additional information. In February 2018, I listed other related resources in a blog post Anarchists, Activists, and Saboteurs.

ALF / ELF activists are not the only ones that may pose a safety concern. Marijuana growers frequently set booby-traps to protect their outdoor grow sites.  These traps may be fairly simple, like punji pits and cartridge traps, or they may be more complex.

 

By studying these tactics and techniques we can be safer during any encounter with them.

 

 



Stop Using 6-Digit iPhone Passcodes

Now that police and Federal agents can allegedly crack iPhones protected with passcodes made of six numbers, it’s time to use longer, harder to guess and crack alphanumeric passphrases.

Cops all over the United States are racing to buy a new and relatively cheap technology called GrayKey to unlock iPhones. GrayShift, the company that develops it, promises to crack any iPhone, regardless of the passcode that’s on it. GrayKey is able to unlock some iPhones in two hours, or three days for phones with six digit passcodes. That’s why security experts are suggesting people stop using passcodes of only six digits altogether. (Motherboard, April 16, 2018)

 

How to switch to a longer numeric passcode

If a 6-digit numeric passcode isn't secure enough for you, but an alphanumeric password is too much of a hassle, you can set a custom numeric passcode, which simply means more than 6-digits.

Launch Settings from the Home screen.
Tap Touch ID & Passcode.
Enter your existing passcode.
Tap Change Passcode
Re-enter your existing passcode.
Tap Passcode Options.
Tap Custom Numeric Passcode.
Enter your new passcode numbers, as many as you can remember for daily usage.
Re-enter your passcode numbers.

How to switch to a stronger alphanumeric passcode

If the strongest phone access security is what you're after, this is what you'll want to switch to an alphanumeric passcode. The alphanumeric passcode should be long enough that it's extremely difficult to crack with current technology, but not so long that you can't remember it or enter it accurately when you need to. A strong passcode should be 12+ alphanumeric characters. 

Launch Settings from the Home screen.
Tap Touch ID & Passcode.
Enter your existing passcode.
Tap Change Passcode
Re-enter your existing passcode.
Tap Passcode Options.
Tap Custom Alphanumeric Code.
Enter your new long, strong alphanumeric password.
Re-enter your new long, strong alphanumeric password.

Signal Messenger Registration Lock

 



For increased security, you can enable a Registration Lock PIN in Signal. You will be asked to enter this PIN the next time you register your phone number with Signal.

Using a Registration Lock PIN adds an additional layer of verification to the registration process that can help prevent someone from using Signal with a phone number that doesn't belong to them.

If you don't already use Signal Private Messenger to secure your private communications, you might be interested in my earlier blog posts:

Signal Private Messenger

Signal Desktop

Harvesting Facebook Photos For A Massive Facial Recognition Database

Forbes (April 16, 2018) has uncovered that over the last five years a secretive surveillance company founded by a former Israeli intelligence officer has been quietly building a massive facial recognition database consisting of faces acquired from the giant social network, YouTube and countless other websites. That database forms the core of a facial recognition service called Face-Int, now owned by Israeli vendor Verint after it snapped up the product's creator, little-known surveillance company Terrogence, in 2017. Both Verint and Terrogence have long been vendors for the U.S. government, providing bleeding-edge spy tech to the NSA, the U.S. Navy and countless other intelligence and security agencies.

Jennifer Lynch, senior staff attorney at the Electronic Frontier Foundation, said that if the facial recognition database had been shared with the US government, it would threaten the free speech and privacy rights of social media users. This could impact the travel and civil rights of tens of thousands of law-abiding travelers who would then have to prove they are not the terrorist or criminal the system has identified them to be.


A YouTube video from 2015 advertises this facial recognition database.

AxCrypt

AxCrypt-2  is one of the world’s most popular encryption programs with over 20 million downloads worldwide. AxCrypt offers both a free version for personal use, and paid Premium and Business editions. The free version uses 128 bit AES encryption, with the option of 256 bit AES encryption in the Premium and Business editions.

AxCrypt is available as an installable program, or as a standalone program that is directly executable - no installation required. I like the standalone version, but others have said they prefer the convenience of the installed version of AxCrypt.

The very first time you launch AcCrypt you must sign in with your email and then enter a confirmation code sent to your email address. You also must create a single master password. Like the master password for your password manager, it needs to be both strong and memorable. This is the password you use to sign in online, and also the password that unlocks the product on your PC.

There are many advanced features available in AxCrypt, making it a useful program for secure file exchange within a team or small group working on a secure project. AxCrypt integrates seamlessly with Windows to compress, encrypt, decrypt, store, send and work with individual files.

The  old, legacy version of AxCrypt-1 is available on the Axantum web-site.  

AxCrypt-1 was a great program, for file encryption, but lacked the advanced features of AxCrypt-2. While you can still use AxCrypt-1, you should be aware that it is no longer supported.

If you want a simple file encryption program that works like AxCrypt 1, you might consider AESCrypt.

Graphite - Blockchain-based Software

Do you need a private place to work and collaborate on projects?

Graphite  provides a decentralized and encrypted alternative to G-Suite and Microsoft Office. Graphite is blockchain-based software to enable truly private and user-owned personal and business applications for creating, sharing, and communicating.

Graphite lets you create documents and spreadsheets, maintain a contacts list, and have end-to-end encrypted conversations using its messaging service. 

In order to use Graphite you will need a Blockstack account.
Blockstack is free for personal use.

Similar to Keybase, Blockstack lets you verify your on-line identity by proving your account on Twitter, Facebook, Github, HackerNews, or providing your Bitcoin address or PGP public key. You may also choose to use Blockstack without providing any identifying information other than an e-mail address.

Graphite is a secure means of collaboration and communication with others, or a way of securely maintaining your documents on-line so that you can access them from anywhere. Because of Graphite's decentralized nature, your documents are safe (as long as you protect your pass-phrase) even if your computer is stolen, lost, seized, or destroyed.