Top all-time · #1863
The Grugq
Personal blog · grugq.github.iosecurityculture
The Grugq writes Hacker OPSEC, a personal blog at grugq.github.io about security and culture. Since 2013, 42 different Hacker News readers have linked it 69 times, most often “Nation state level adversaries”. The last post was in 2014, but the archive is still widely read.
Think of Mujahideen Secrets as a branded promotional tool, sort of like if Manchester United released a branded fan chat app. Although there has been …
Most-linked posts?
- Nation state level adversaries5 people · 5 mentions · first linked 2013-06-14
- Anonymity Is Hard5 people · 5 mentions · first linked 2013-05-19
- COMSEC beyond encryption [pdf]4 people · 7 mentions · first linked 2015-02-07
- Yardbird's Effective Usenet Tradecraft (2013)4 people · 4 mentions · first linked 2013-12-03
- Good Luck With That (counterintelligence)3 people · 3 mentions · first linked 2013-06-11
- Thru a PORTAL Darkly3 people · 3 mentions · first linked 2013-10-06
- The Design and Implementation of Userland Exec (2014)2 people · 4 mentions · first linked 2023-07-11
- In Search of OPSEC Magic Sauce (2013)2 people · 3 mentions · first linked 2014-07-08
- Usenet Tradecraft: Survival in an Extremely Adversarial Environment (2013)2 people · 2 mentions · first linked 2016-07-20
- Security Conventions2 people · 2 mentions · first linked 2014-05-11
What Hacker News says?
Some good sources: https://blog.cyberwar.nl/2016/02/some-elements-of-intelligen... https://www.opsecprofessionals.org/official/081103_DOD_OPSEC... http://www.opsecprofessionals.org/training/OPSEC_Training.pd... https://www.slideshare.net/grugq/OPSEC-for-hackers https://grugq.github.io/blog/2013/06/13/ignorance-is-strengt... https://theintercept.com/2015/11/12/edward-snowden-explains-... http://thefifthcolumnnews.com…
Comment linking /blog/2013/06/13/ignorance-is-strength/
on “How a Hacker Proved Cops Used a Stingray to Find Him”Submitted Anonymity Is Hard as a story · 150 points
HN discussionThe mentions of his security concerns reminded me of this: http://grugq.github.io/blog/2013/06/14/you-cant-get-there-fr... "As a thought experiment, imagine that Osama bin Laden was still alive and that he used the Tor network to do a Reddit AMA once a month. How long do you imagine it would take for the US to find and neutralize him? I posted this question on Twitter and, while responses varied, ex-NSA Global Netwo…
Comment linking /blog/2013/06/14/you-cant-get-there-from-here/
on “Edward Snowden Q&A”Submitted Rules of Spycraft (2009) [pdf] as a story · 130 points
HN discussionhttp://grugq.github.io/
Comment linking /
on “Goodbye Popcorn Time”Submitted Usenet Tradecraft: Survival in an Extremely Adversarial Environment (2013) as a story · 125 points
HN discussionThere is a presentation[1] by grugq on how to communicate securely. Using gpg with email is hard. Anecdotally, people reply in cleartext quoting the encrypted message. If you can train and test your co-conspirators before sending them incriminating evidence about yourself, maybe it can be done. But mistakes happen so often, people who have secrets that can get them killed or jailed for a long time just switched to S…
Comment linking /presentations/COMSEC%20beyond%20encryption.pdf
on “Encrypted email is still a pain”Submitted COMSEC: Beyond Encryption [pdf] as a story · 94 points
HN discussionAn OS without FOSS targeted at routers is a total meme. the security problems with linux I wouldn't want to dismiss though. I evangelize FOSS since the mid 90ies and we had a good laugh for 20 years whenever Windows messed up (remember trustworthycomputing.com ??). It is hard to dismiss that being accused for 25+ years for insecurity has nothing but boosted their situation. Whatever the perceived quality of Linux, s…
Comment linking /presentations/COMSEC%20beyond%20encryption.pdf
on “Kaspersky OS”Submitted It Was DPR, in the Tor HS, With the BTC as a story · 72 points
HN discussionPeople also tend to have very poor OPSEC which undermines their efforts in spite of the tools they used. https://grugq.github.io/blog/2013/11/06/required-reading/ Unlinking one's identity from one's activity is only getting harder as surveillance gets more and more pervasive. Effective OPSEC essentially turns one's life into a living hell and it's only getting hotter with time.
Comment linking /blog/2013/11/06/required-reading/
on “Privacy doesn't mean anything anymore, anonymity does”Submitted Security Conventions as a story · 11 points
HN discussionInstead of looking for anti-authoritarian services to hide from authoritarian government services you should probably blend in with the fish like Mao said: > The guerrilla must move amongst the people as a fish swims in the sea. It's better to create false identities that are seemingly legit and fully fleshed out, for example: with back stories, and utilize regular services as a normal person would. The key is disco…
Comment linking /blog/2013/03/12/anonymity-is-hard/
on “Tell HN: Riseup.net fails to update canary; fingerprints deleted without notice”Submitted Good Luck With That (counterintelligence) as a story · 8 points
HN discussionMy analysis of that incident: http://grugq.github.io/blog/2013/12/21/in-search-of-opsec-ma...
Comment linking /blog/2013/12/21/in-search-of-opsec-magic-sauce/
on “SecureDrop”Submitted Allen Dulles: Some Elements of Intelligence Work as a story · 5 points
HN discussionThat is a poor analogy of the threat. Basically the problem is about attracting adversarial resources. Any suspicious activity will attract more attention and thus make it more likely the adversary will find real evidence. I wrote up an analysis of exactly this problem last year: http://grugq.github.io/blog/2013/12/21/in-search-of-opsec-ma...
Comment linking /blog/2013/12/21/in-search-of-opsec-magic-sauce/
on “SecureDrop”Submitted Episode 17 – Hacker OPSEC as a story · 3 points
HN discussionGod I wish grugq still wrote currently. https://grugq.github.io/blog/2013/12/21/in-search-of-opsec-m... I discovered he moved to Github pages after years only to realize he has not published much since I first heard of him.
Comment linking /blog/2013/12/21/in-search-of-opsec-magic-sauce/
on “Cloudflare ReCAPTCHA De-Anonymizes Tor Users”Submitted The Design and Implementation of Userland Exec (2014) as a story · 2 points
HN discussion> You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude it is a common misconception that Windows is still worse a platform than Linux when it comes to security. Not trolling ... I'm using Linux since '96 and built my life and career on it. Opinion of some people in infosec circles (@thegrugq @csoghoian ...) is that Windows no longer lags behind: https://gr…
Comment linking /presentations/COMSEC%20beyond%20encryption.pdf
on “Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan”Submitted Rules of Spycraft (2009) [pdf] as a story · 2 points
HN discussionAgreed. Your comments reminded me of the points in "Evil Exit Nodes Unmasked me, and all I got was this lousy jail term" by the grugq. http://grugq.github.io/blog/2013/06/14/you-cant-get-there-fr...
Comment linking /blog/2013/06/14/you-cant-get-there-from-here/
on “On the Effectiveness of Traffic Analysis Against Tor Networks Using Flow Records [pdf]”Submitted PORTALofPi: Thru a PORTAL Darkly as a story · 2 points
HN discussionIf your aim is not to be identified, I can understand keeping your mouth shut about matters of opinion, especially if you hold distinctive opinions you have given out in public before. One of Ulbricht's reported failings [1] was talking about Mises and the Austrian School as both Ulbricht and DPR. Keeping your anonymous persona's mouth shut about history, politics, economics, sociology, art theory and human nature…
Comment linking /blog/2013/10/09/it-was-dpr/
on “Satoshi Nakamoto is probably Nick Szabo?”Submitted Yardbird's Effective Usenet Tradecraft (2013) as a story · 2 points
HN discussionNo, dont run Tor over VPN. Its VPN over Tor. Tor provides anonymity, VPN provides privacy. You want anonymity between you and the VPN, and privacy between you and internet hosts. From the OpSec for xyz series: https://grugq.github.io/presentations/Keynote_The_Grugq_-_OP... • TOR connection to a VPN => OK • VPN connection to TOR => GOTO JAIL
Comment linking /presentations/Keynote_The_Grugq_-_OPSEC_for_Russians.pdf
on “ISP Spying”Submitted In Search of OPSEC Magic Sauce (2013) as a story · 2 points
HN discussionThe Grugq has some awesome write ups on OpSec. He is the authoritative source on it. Google around for his tumblr, medium posts, and grugq's github [1]. [1]: http://grugq.github.io/blog/archives/
Comment linking /blog/archives/
on “Whonix – A desktop operating system designed for advanced security and privacy”Submitted COMSEC beyond encryption [pdf] as a story · 2 points
HN discussion
