I would also like to recommend the following tools for OSX users:
Little Snitch 3
Personal firewall for outgoing connections. Must have.
obdev.at/products/littlesnitch/index-en.html
Micro Snitch
New tool which protects from cam/mic spying.
obdev.at/products/microsnitch/index-en.html
OSX Rkhunter
Rkhunter version for OSX with UI and updater.
antirootkit.com/software/OS-X-Rootkit-Hunter.htm
Stay safe!
DO NOT DEAL WITH THIS MEMBER
Jul 16, 2015 09:06 PM
(This post was last modified: Jul 16, 2015 09:12 PM by HIGH PAID FELLA.)
You didn't cover everything, but that's normal since that would be a ton.
Don't forget to mention web.skype, another server list for XMPP.
WebRTC isn't a bug/exploit/w.e, it's just something based on three things mainly:
getUserMedia, PeerConnection and DataChannels just to retrieve data or get access to thid party hardware from browser. Only Firefox, Google Chrome* and Opera* support it.
(* = partly supported)
For PGP I would suggest adding keybase.io to confirm somebody's PGP key, fingerprint, bitcoin adress, twitter, github, reddit , etc.
Regarding disk encryption I would add DiskCryptor as an alternative.
For IRC try always to use SSL on port 6697 so your chat/text is not plain text.
A web-based IRC client could be Kiwiirc or Mubbit.
For e-mail I would adding the tip to setup your own mail server and to warn people for killer.org, people have been saying they steal e-mail's and other data from their users.
An alternative for Hitman.Pro would be Malwarebytes Anti-exploit.
Really, you could write a book of 1000 pages regarding OPSec and online security but this is a good sum of basic information to have in mind.
Also the usage of iOS is very bad since the applications can ignore the PTPP settings or any other VPN or proxy.
(Jul 16, 2015 08:58 PM)l33tsec Wrote: I would also like to recommend the following tools for OSX users:
Little Snitch 3
Personal firewall for outgoing connections. Must have.
obdev.at/products/littlesnitch/index-en.html
Micro Snitch
New tool which protects from cam/mic spying.
obdev.at/products/microsnitch/index-en.html
OSX Rkhunter
Rkhunter version for OSX with UI and updater.
antirootkit.com/software/OS-X-Rootkit-Hunter.htm
Stay safe!
I'll check those out. I'll be honest, not a big OSX guy so anything I could add to this I'll look into.
Also as a suggestion maybe sometime later on you could add a section on the more physical bits of OPSEC. Like what network to use, not bragging, not making a DPR mistake and using your email on shit. But this guide seems more technical in nature so if you want to keep it that way that's fine.
(Jul 16, 2015 09:06 PM)HIGH PAID FELLA Wrote: -snip-
I'll go through some of this tomorrow. Like I said, some of it was rushed due to Null going up for sale but another part of it is opinion based. When it comes to the amount of detail, I could go very in-depth but if I did, it would of been 10+ posts long. It was actual hard to condense the most important information into the thread but any feedback I get will be look at and the thread will be constantly modified.
DO NOT DEAL WITH THIS MEMBER
(Jul 16, 2015 09:13 PM)ᴎᴀᴎᴏ Wrote: I'll go through some of this tomorrow. Like I said, some of it was rushed due to Null going up for sale but another part of it is opinion based. When it comes to the amount of detail, I could go very in-depth but if I did, it would of been 10+ posts long. It was actual hard to condense the most important information into the thread but any feedback I get will be look at and the thread will be constantly modified.
Alright, great to hear. Maybe parse all this information in a book in PDF format?
(Jul 16, 2015 09:14 PM)HIGH PAID FELLA Wrote: Alright, great to hear. Maybe parse all this information in a book in PDF format?
I was thinking about doing this, once again the whole Null being sold made me rush so still plenty of things need to be added, configured, editing, etc. Tomorrow I plan on working out a lot of the kinks and looking at anything users have to say about the thread and ideas.
DO NOT DEAL WITH THIS MEMBER
(Jul 16, 2015 09:26 PM)ᴎᴀᴎᴏ Wrote: I was thinking about doing this, once again the whole Null being sold made me rush so still plenty of things need to be added, configured, editing, etc. Tomorrow I plan on working out a lot of the kinks and looking at anything users have to say about the thread and ideas.
If you need any help regarding subjects or things needing to get added in your book I won't hesitate to help you.
How in the FUCK is exploit.im a good XMPP server?
https://xmpp.net/result.php?domain=explo...ype=client
Read in detail at how horrid it is.
Other than this, awesome and informative content.
For anyone that wants a good, privacy-supportive XMPP server, I own pod.so :^)
Bookmarked as I will continue reading this later. And thanks for telling about the different programs, I'll download a few of those for sure.
Bookmarked. Learned a thing or two and linking required software? Brilliant! Very detailed as said thanks OP
Wow, This helped me a lot!
Incredibly detailed and well written, You really do know how to teach people your stuff.
It's very easy to understand and easy to apply! And once again! Thanks! This is awesome!
I'd recommend adding obfsproxy which disguises Tor traffic using multiple methods.
(Jul 17, 2015 02:02 AM)Emoticon Wrote: How in the FUCK is exploit.im a good XMPP server?
https://xmpp.net/result.php?domain=explo...ype=client
Read in detail at how horrid it is.
Other than this, awesome and informative content.
For anyone that wants a good, privacy-supportive XMPP server, I own pod.so :^)
you do realize that's only because of ssl
DO NOT DEAL WITH THIS MEMBER
(Jul 17, 2015 06:26 AM)sinmar Wrote: I'd recommend adding obfsproxy which disguises Tor traffic using multiple methods.
you do realize that's only because of ssl
Yeah, my server is also perfectly setup using s2s, c2s and forced encryption but it gives me a F because I use a self-signed SSL which is ridiculous.
Jul 17, 2015 08:48 AM
(This post was last modified: Jul 17, 2015 08:48 AM by Emoticon.)
(Jul 17, 2015 06:26 AM)sinmar Wrote: I'd recommend adding obfsproxy which disguises Tor traffic using multiple methods.
you do realize that's only because of ssl
So it's alright to accept plaintext passwords pre-TLS?
You do realize Exploit.IM also stores passwords in plaintext and admins regularly hijack accounts.
You're literally standing up for a Jabber service solely because it has a "cool h4x0r name."
Read my full rant about Exploit.IM here: https://hackforums.net/showthread.php?tid=4910065
|
