Sam Bent

#OPSEC365 225/365

Disabling read receipts doesn't always prevent the sender from knowing you read the message.

Some messaging apps send read receipts at the protocol level regardless of user settings. Others show typing indicators, presence status, or last seen timestamps that confirm you're active. The perception of privacy from turning off receipts may be false.

Test whether your messaging apps respect receipt settings in practice.

#OPSEC365

Proton put's out a memo...

• 'it's a heat piece'.

• ' it's a psyop'.

• 'marxist/communist'.

• '404...outlet for disgruntled employees'.

Interesting reactions.

#OPSEC365 224/365

Smartwatch health data reveals intimate patterns about your body.

Heart rate variability, sleep stages, menstrual cycle predictions, stress levels, and workout intensity are all captured by Apple Watch, Fitbit, and Garmin. This biometric data syncs to cloud servers open to the company and to subpoenas.

What your wrist records about your body is no longer only yours.

#OPSEC365

Wyoming charters banks that can't lend deposits, wrote the first DAO law, and files LLCs nobody's name is on. It's also the top US state for "monero" searches over five years, with 588,753 people to do it. Not a coincidence I'd bet against.

#OPSEC365 223/365

Chip cards are more secure but just as trackable as magnetic swipe.

EMV chips prevent card cloning at the point of sale, but the transaction still goes through the payment network with your card number, merchant details, and timestamp. The security improvement doesn't affect the privacy implications of card-based payments.

Don't confuse chip security with transaction privacy.

#OPSEC365

#OPSEC365 222/365

Airplane mode doesn't disable all radios on all devices.

WiFi and Bluetooth can be re-enabled manually while airplane mode is active, and often are by default. GPS is passive (receive-only) and is never disabled by airplane mode. Cell tower location can still be cached.

Verify which radios your specific device silences before relying on it.

#OPSEC365

#OPSEC365 221/365

Phone motion sensors leak more than you would expect.

Academic research shows a phone's gyroscope and accelerometer can infer keystrokes typed on that same phone, identify a person by their walking gait, and pick out individual speakers in a room. Most of this stays lab-grade, but motion sensors get far less permission scrutiny than the mic or camera that would do the same job more directly.

Treat motion sensor access like microphone access.

#OPSEC365

#OPSEC365 220/365

Every USB device has a unique serial number that identifies it.

When you plug a USB drive into a computer, the operating system logs the device's vendor ID, product ID, and serial number. That drive can be traced across every computer it's touched. Forensic analysis of machines reveals what USB devices have connected to them.

USB serial numbers are logged in Windows registry entries that persist after the device is removed.

#OPSEC365

The darkest twitter (pitch) disables new accounts due to spam.

Quality over quantity.

#OPSEC365 219/365

Vulnerability analysis in OPSEC doctrine ranks vulnerabilities on two axes: operational importance and susceptibility to collection. The highest-priority items are both important AND easy for your adversary to collect.

Low-importance data that's hard to collect isn't worth protecting. High-importance data that's trivially exposed is your immediate priority.

A list of vulnerabilities without ranking gives you no place to start. #OPSEC365

https://sambent.dev/sam/HiddenForge/releases/tag/v2.1.0

#OPSEC365 218/365

Shared links to cloud files often don't require authentication.

That Google Drive link you shared to collaborate on a document might be accessible to anyone with the URL. Some cloud storage defaults to link access that doesn't check who's clicking. URLs can be guessed, leaked, or discovered through browser history.

Check the sharing settings on cloud files before sending links and restrict access to specific accounts.

#OPSEC365

#OPSEC365 217/365

Customer support is a backdoor for social engineers.

Attackers call support lines pretending to be you, using info gathered from social media and data breaches to pass security questions. They request password resets, account changes, or info that helps compromise your accounts.

Add extra security to accounts that allow it and expect that attackers will target support channels.

#OPSEC365

#OPSEC365 216/365

Temporary email services aren't as anonymous as they seem.

10minutemail, Guerrilla Mail, and similar services let you create throwaway addresses, but the services themselves log IP addresses and usage. Anyone with access to the service's logs can correlate your temporary address with your real identity through connection data.

For truly anonymous email, temporary services require additional layers of protection like Tor.

#OPSEC365

#OPSEC365 215/365

Counter-surveillance starts with awareness of who might be watching.

Professional surveillance involves multiple people, vehicle switches, and careful tradecraft. But most surveillance you'll encounter is amateur. A car that appears too often, someone who shows up at multiple places you go, or patterns that feel off deserve attention.

Practice being aware of your surroundings without being paranoid.

#OPSEC365

#OPSEC365 214/365

Granting contact access doesn't expose your data. It exposes everyone else's.

Your address book is a social graph belonging to people who never consented. WhatsApp, LinkedIn, and TikTok have all used contact uploads to build graphs of non-users.

Cronk's aggregation problem: the app now knows your network position without you ever posting publicly.

A photo editor, game, or flashlight has no need for your contacts. Audit and revoke. #OPSEC365

Tor Project "We dislike mullvad donated to someone we dislike."

Also Tor: "We accept funding from the feds, and give DC talks about how cool it is that they talk to us."

#OPSEC365 213/365

Your notification center is a summary of your digital life visible on your lock screen.

Banking alerts, message previews, calendar reminders, and app notifications all appear where anyone glancing at your phone can see them. The locked screen shows a feed of your recent activity.

Review your notification settings and limit what shows when your phone is locked.

#OPSEC365

#OPSEC365 212/365

Gait recognition is being marketed as a way to identify you by how you walk.

Your stride length, pace, arm swing, and posture create a signature that does not change when you cover your face. Watrix, a Chinese vendor, has publicly claimed 50-meter identification at 94% accuracy with the face fully covered. That figure comes from the company itself and has not been independently validated in peer-reviewed research.

#OPSEC365

Regulation was written by the people it's supposed to regulate, and it's been that way since the beginning.

#OPSEC365 211/365

Shared computers retain browsing history across users.

Family computers, library terminals, and shared workstations keep history unless actively cleared. Private browsing helps during the session but doesn't erase what you did before remembering to use it. The next person at that computer can see what you browsed.

Always use private browsing on shared computers and clear history if you forget.

#OPSEC365

#OPSEC365 210/365

Bitcoin transactions are traceable despite claims of privacy.

The blockchain is a public ledger. Every transaction is recorded permanently. Chain analysis companies like Chainalysis correlate wallet addresses with identities. Law enforcement routinely traces Bitcoin transactions to identify users.

If you need financial privacy, understand that Bitcoin provides pseudonymity at best, not anonymity.

#OPSEC365

Things happen, we learn and adapt.

The most important lesson in life is to not make the same mistake twice.

Hope all the best for Dread, and Paris.

If the site ever shuts down, I will publish my archived backup.

#OPSEC365 209/365

Location stickers on social media stories reveal where you are in real time.

Instagram and Snapchat location tags show your current location to everyone viewing your story. Unlike posts, stories broadcast where you are right now, not where you were last week. Check-ins announce your presence to anyone following you.

Anyone watching can screenshot the tag before the story expires.

#OPSEC365

#OPSEC365 208/365

Remote work monitoring software may be tracking more than you realize.

Hubstaff, Time Doctor, ActivTrak, and similar tools capture screenshots, track keystrokes, monitor application usage, and sometimes record through webcams. Working from home with company monitoring means your employer can see everything on your work device.

Ask your employer what monitoring software runs on company devices and what it captures.

#OPSEC365

Every red flag in a toxic relationship is standard operating procedure for the federal government.

#OPSEC365 207/365

Lockheed Martin's Cyber Kill Chain breaks an adversary's progression into seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives.

Most people only think about the final stages. By the time you notice, the adversary has been in reconnaissance for weeks.

Map your environment at the reconnaissance stage, not after the exploit lands. #OPSEC365

#OPSEC365 206/365

In 1991, P&G suspected a leak to the Wall Street Journal. One grand jury subpoena to Cincinnati Bell swept every call from Cincinnati to WSJ's offices over months. Tens of millions of records came back, none belonging to a named suspect.

Grand jury subpoenas for phone records require no probable cause and no narrow targeting. The P&G case was widely reported by mainstream press after journalist outrage forced disclosure.

#OPSEC365 205/365

Your neighbors can tell when your devices are active on WiFi.

A neighbor with passive monitoring sees your access point's beacon frames, the rough timing of connected-device activity, and changes in your network footprint as devices come and go. Modern phones randomize their MAC in probe requests and skip broadcasting saved SSIDs, so the phone leaks less than older posts suggest. The access point still gives plenty away.

#OPSEC365

#OPSEC365 204/365

Sports betting apps collect extensive financial and behavioral data.

DraftKings, FanDuel, and state gambling apps require identity verification including SSN, track your betting patterns, and retain detailed financial records. This data reveals your income level, risk tolerance, and potentially problematic behavior patterns.

State gambling regulators share player data with law enforcement. The financial records are subpoenable.

#OPSEC365

#OPSEC365 203/365

Wedding websites broadcast personal details to anyone who finds them.

The Knot, Zola, and personal wedding sites include full names, dates, venues, registries linking to home addresses, and often how the couple met. These sites are indexed by search engines and rarely secured with passwords.

The full names, venues, and registries stay publicly searchable for years.

#OPSEC365

#OPSEC365 202/365

In 1980 a Los Alamos scientist visited a Chinese institute. He deflected classified questions for hours. They threw a cocktail party in his honor: toasts, applause, drinks. After enough rounds he offered an analogy about neutron bomb thresholds.

Hadnagy documents this case. The alcohol, the flattery, and the pressure of being toasted each lowered the scientist's threshold one step at a time. Conferences and happy hours are collection environments.

#OPSEC365 201/365

Timestamps reveal your timezone regardless of what you claim.

When you post at what you say is 9am but the metadata shows UTC offset, anyone can calculate your actual timezone. Photo timestamps, email headers, social media posts all carry timezone information. Someone tracking you can determine your general location from when you're active.

Consistent 3am activity on a US-based account suggests a different timezone than the one you claim.

#OPSEC365

#OPSEC365 200/365

Forwarded emails often contain more metadata than the person forwarding intended to share.

Email headers include the original sender's IP address, email client, timezone, and the full chain of who received and forwarded the message. The person you forward to can extract information about everyone in the thread.

Check email headers before forwarding sensitive messages and consider copying content to a new email instead.

#OPSEC365

#OPSEC365 199/365

Under 18 U.S.C. §3123, an investigator certifies only that information 'is relevant to an ongoing criminal investigation.' Basic toll records come by subpoena. No warrant. No notification.

Court supervision ends when the order issues. This is standard procedure practiced by every federal investigative agency.

#OPSEC365 198/365

Digital receipts map your purchase history more precisely than paper ever could.

Email receipts are searchable, timestamped, and never lost in a drawer. That complete purchase history going back years reveals your financial situation, preferences, and lifestyle in fine detail to anyone who accesses your email.

Your inbox is a complete purchase history. Anyone with access to your email has access to everything you've bought.

#OPSEC365

#OPSEC365 197/365

Public records don't expire and they don't forget.

Every property you've owned is in the county assessor's database with your name and address. Business registrations list you as agent. A dismissed court case is still indexed on PACER and CourtListener. A lien from 2011 is still there.

Aggregator copies survive even after an official record is sealed.

#OPSEC365

#OPSEC365 196/365

Health insurance claims reveal your medical history to multiple parties.

Every claim goes to the insurer, gets reported to industry databases like MIB, and may be shared with employers for self-insured plans. Procedures, diagnoses, and medications become part of your permanent health record beyond your doctor's office.

The MIB shares claim history across insurers. One claim can affect your rates with carriers you've never used.

#OPSEC365

#OPSEC365 195/365

Password managers often include emergency access features.

Bitwarden, 1Password, and LastPass let you designate emergency contacts who can request access to your vault after a waiting period. If you've enabled this, someone else can potentially reach all your credentials.

If you turned it on and forgot, a designated contact may be one request and one waiting period away from everything.

#OPSEC365

#OPSEC365 194/365

Smart doorbells record conversations from people walking past.

Ring and Nest cameras with audio capture snippets of conversation from neighbors, delivery workers, and passersby. That private conversation you had on the sidewalk might be recorded in someone else's cloud storage without your knowledge or consent.

A Ring camera covers the street, the neighbor's driveway, and anyone who walks past, not just the front door.

#OPSEC365

This has existed for over 10 years.

None of this is about protection or any cause that has to do with protecting you.

Notice how both still exist?

It was never about either of those things, just like ID confiscation (aka 'age verification) isn't about age.

There is a reason signaltrace, axon and flock appeared as they did.

#OPSEC365 193/365

Cross-cut shredding is not enough for high-sensitivity documents.

After the 1979 seizure of the US embassy in Tehran, Iranian student militants painstakingly reassembled strip-shredded classified documents by hand and published them in dozens of volumes. Modern reconstruction software does the same job for cross-cut shreds in minutes.

For anything that matters, burn it or use a micro-cut shredder rated P-5 or higher.

#OPSEC365

#OPSEC365 192/365

Video call recordings capture everything in frame and earshot.

Zoom and Teams meetings get recorded, often by default in corporate settings. Your facial expressions, background, voice, and any visible documents are preserved. Meetings you thought were ephemeral may sit in cloud storage accessible to IT and management.

Side conversations and visible documents end up in storage you don't control.

#OPSEC365

Stack XMR while normies argue about which surveillance coin will pump next.

#OPSEC365 189/365

Your Bluetooth device name is a persistent surveillance identifier.

In a noted ISS exercise, Jenkins scanned Bluetooth signals on a train and noted five device names. An hour later at an art gallery, one name reappeared. A monitoring operator was on the train.

#OPSEC365 182/365

Your VPN provider sees everything your ISP would have seen. You moved the trust, not the exposure. In 2020, seven "no-log" VPN providers leaked 1.2TB of user data including connection logs they claimed not to keep.

Choose a VPN based on jurisdiction, independent audits, and revenue model.

#OPSEC365

#OPSEC365 180/365

HUMINT collectors call it apparent withdrawal. The collector signals the conversation is ending, releases tension, then drops the real question as an afterthought. "One last thing before I let you go..."

Your guard drops because the pressure seemed over. The question that follows is the one they came for. The entire preceding conversation was setup.

#OPSEC365 179/365

HUMINT is the collection discipline most people forget to model against. Your adversary doesn't need to hack your devices if they can call your former employer, ask your neighbors, or socially engineer your friends for your new address.

Military OPSEC doctrine explicitly lists human intelligence as a primary threat vector. Your digital defenses are irrelevant if your human network leaks.

#OPSEC365