9 Common Opsec Pitfalls People Don't Think About

Here some common opsec pitfalls that people don't always know about:

1. Pin codes are not an effective security method. Given how people use smartphones in a different manner compared to desktops and laptops, they tend to use pins for the sake of convenience. Unfortunately, pins are extremely easy to bruteforce in usually less than a minute even if they are longer than 4 digits. They are just like inexpensive locks people use for the front door — they only keep out nosy neighbors, but that's about it. Yes, it is far more inconvenient to use a password on your phone, but it's necessary if you want to protect the data on it. Even cheaper and more affordable commercially available forensics tools have the necessary functionality to brute force a pin.

2. Monero is not untraceable. When you read about Monero, it is generally touted as an untraceable privacy coin, but that is incorrect. It would be better to put a little asterisk next to the tag line as the fine print is what matters the most. When someone first starts using Monero, they hear about its untraceable nature and use it much like any other coin without really understanding the pitfalls. There are EAE attacks, malicious nodes that track your IP address and transaction info, poisoned output attacks, timing analysis, and — assuming you purchased your Monero — both the source and destination are aware of the amount, timing, and the source also knows the address it sent the Monero to. Similar to malware, it is unlikely for any one attack to yield any definitive results. However, if used together, the threat actor can acquire a substantial amount of information, which is enough to deanonymize you in some cases.

3. Then there are third party payment gateways. Many service providers and vendors uses gateways like Cryptomus or Coingate. If you are making payments to two different vendors for two different identities using the same Monero coins with both vendors using Coingate as their payment gateway, it is possible to assume the coins passed through the same origin. To make matters worse, if you bought those coins from a CEX, it is also possible for the payment gateway provider to collaborate with the CEX to acquire data of both ends. Even if you proxy the coins through one or more wallets, it is still possible to identify where the coins once were. This requires cooperation between the two actors. However, since many of them use some form of chain analysis software, the transaction data likely feeds directly into a centralized system. While it isn't necessarily definitive, it can be used to gather additional evidence. This is particularly true when this process involves many transactions from the same origin. If you are a vendor or service provider and want to preserve your customer's privacy, host your own payment gateway.

4. Only shell into your darknet web server via Tor. I've come across several users now who use a VPN or no protection to shell into their web server while using Tor for any browsing and online interaction relating to their service. This completely defeats your opsec strategy to remain anonymous. When you host anything on the darknet, you should treat everything related to it with an equal amount of care. If you use Tor, you keep on using Tor. Another example is developers using code editors and other tools for their darknet work without firewalling or running any relevant connections over Tor. You don't know what data is being sent when these tools phone home and the data is likely transmitted in the background. Once again, if you are using Tor, you should set up your dev environment to use Tor as well.

5. Tor is traceable. Contrary to what some may believe about Tor being anonymous and untraceable, it isn't. I'm not just talking about malicious nodes, but also about all the other parties involved in hosting Tor nodes. This includes the web host, the data center, and the ISP. All of them have access to the network and both the host and data center have physical access to the server itself. All of them have the capability of logging network activity. It gets even worse when all three hops route through the same country. Germany has deanonymized users before by requesting data from the ISPs and cutting the node operators out of the equation entirely. There is also far more cooperation between nations now than there used to be. Maybe you'll wanna throw a North Korean server in there somewhere and pay a little fee to little rocket man to preserve your anonymity. Seriously, it would be a great business model. The Taliban really ought to look into building some data centers as well.

6. Not using FDE for your web server. Similar to what I said about smartphones, people treat web servers differently from their own physical devices. However, they still require security. While web based attacks, such as SQL injections and XSS attacks, are commonly discussed, the security of the server itself is rarely ever talked about. It is possible to use FDE for your web server by treating it just like your desktop environment, which requires installing the OS from the iso. There are also many grub parameters to explore, such as init_on_free. You can find many more kernel hardening options in the Tails docs, Arch Wiki, and the Kicksecure / Whonix docs. You can automate the process, if you need to move your data and services across servers frequently. Keep in mind, FDE and many hardening configurations are practically useless for a VPS or VDS. I suggest getting a dedicated or bare metal server for hosting the back–end of your service.

7. Your clipboard is accessible. The Tor Browser does have some security measures to prevent your clipboard from being read. Websites can read your clipboard using navigator.clipboard, but only if it was written to the clipboard using the same function. If you copied the data from somewhere else, a Paste button will appear to confirm if you want to paste the data. However, the same is not necessarily true for any other application you are running. While the Tor Browser protects you to an extend, it is possible to write data to your clipboard without confirmation. Imagine you want to install some tool. It shows you some code to paste into your terminal, likely using curl or wget. It shows you the code, but there's a button next to it. The button copies the supposed code to your clipboard, but changes it. You blindly paste it into your terminal without verifying it leading to an infection. Be careful with your clipboard or use Qubes OS or VMs with clipboard isolation.

8. Don't mix identities. It happens more often than you think. You reuse an email address for another identity or maybe a phone number, a server, username, or even a contact. Right at that point, you have merged your identities into one and there isn't always a way to undo it. It is one of the unfortunate aspects of the darknet — you have to compartmentalize everything and can only rarely bridge the gaps without consequences. If you intend to host a darknet service that may or may not get you into hot water, create a new identity rather than relying on your existing one and keep it separate at all times.

9. One environment for one identity. Do not reuse environments for multiple identities. There is just far too much that can go wrong. Maybe you use git and you accidentally use another profile to make the push. Or you make a payment using a third party payment gateway which you access using the Tor Browser. You end up reusing the exact same session and profile for the same payment gateway, but for another identity and another service. Well, you fucked up. Or maybe you are new to PGP and store your personal and darknet keys in the same chain. You send your PGP public key to someone using gpg --export without thinking about it. However, you just exported all public keys in the chain. If you send the export to another user, they now have all of your stored public keys. Maybe you just happened to have someone else's public key in there, but it could also be a dead giveaway as to who you are.