Hesitant to recommend proton since they can't stay out of politics, I don't think mullvad has any similar slipups: https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...
Infosec 101 for Activists
41–50 of 220 posts
Re: Infosec 101 for Activists
#42Earlier quoted context omitted.
> if you are merely silent that means you waive your right to remain silent. This is not my reading. For those who want to read the actual details: https://supreme.justia.com/cases/federal/us/560/370/ Here are some nuggets from the case: "At no point during the interrogation did Thompkins say that he wanted to remain silent, that he did not want to talk with the police, or that he wanted an attorney." "Thompkins did…
whats the part youre disagreeing with? the context to me still says that remaining silent does not invoke the right to silence. unless tou break your silence to aay that you intend to be silent, yiu will be prosecuted for your silence
> The USSC recently decided that if you are merely silent that means you waive your right to remain silent.
I cannot seem to find any supporting text in the SCOTUS text that merely being silent waives rights. Quite the contrary, my quote indicates it that as soon as the I would assert my rights, even in the middle of the interrogation, the interrogation would have to halt. (Additionally, the interrogated Thompkins did speak and answer, it was just terce.)
>I wish I were making that up. You now have to repeatedly state it.
Again, I can find no evidence in the SCOTUS opinion that once I assert my right, I have to repeatedly re-assert it.
From your note:
> unless tou break your silence to aay that you intend to be silent, yiu will be prosecuted for your silence
I find nothing of sort in this case. I can remain truly silent, and my silence cannot be used as evidence of guilt. Of course I can still be prosecuted with other evidence. Griffin v. California (1965) , Doyle v. Ohio (1976), and Salinas v. Texas (2013) just to name a few.
If I missed these, please point me to it so I can correct myself.
Re: Infosec 101 for Activists
#43Earlier quoted context omitted.
Why don't you try that and report back?
A more constructive response is to explain why it won't work.
A more constructive response is to explain why it won't work, rather than telling me to explain why it won't work.
My first post in this thread has a link that explains why VPN services aren't trustworthy.
But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN.
Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing users to simply not use Tor.
The fact that more effort is spent attacking Firefox (i.e., the Tor Browser) than the network is a data point worth considering when deciding your threat model.
https://www.malwarebytes.com/blog/news/2024/10/tor-browser-a...
Meanwhile, if you want to do traffic correlation against a VPN service that you don't already own, just pwn the datacenter that the VPN company is hosted in and watch packets coming in/out of the VPN.
If you want to try to reframe the conversation to be about defending Tor, you can have that conversation without me. I'm not here to defend Tor, I'm here to advise against using VPN services especially if you have a threat model where Tor is more appropriate.
Recommending ProtonVPN over Tor to motherfucking activists is an act of malfeasance that makes me distrust anything coming from this webpage.
Re: Infosec 101 for Activists
#44Earlier quoted context omitted.
> Why? Because if I was running SIGINT at the NSA and collaborating with the FBI to arrest activists, the very first thing I would do is start up a bunch of VPN providers that bill themselves as "private" and then log everything aggressively. The second thing I would do is have useful idiots (i.e., influencers) spread vague anecdotes about Tor users being "de-anonymized" when VPN users are never "anonymized" to begin…
That's funny because if I was running SIGINT at the NSA I would do all of the above, and also compromise Tor
As if compromising Tor in the long-term is that simple.
Re: Infosec 101 for Activists
#45Earlier quoted context omitted.
[flagged]
Blocking a highway is not an act of violence, it is a form of peaceful protest. Like a diner sit-in. You are free to correct your post to explain all the acts of violence you saw which justify the term "riot".
There are multiple documented cases where emergency vehicles are blocked by "blocking a highway" as a "peaceful protest" that resulted in deaths. e.g., London (2022) - Mark Heap and Lisa Webber.
Re: Infosec 101 for Activists
#46For someone in the know: what's the credibility of the authors on this topic?
I see https://infosecforactivists.org/#acknowledgments and https://github.com/InfosecForActivistsTeam/infosec-activists... but I don't see their experience following their own advice.
The document by itself looks unpolished. Tor, for example, should be at least referenced once, even if they recommend against it.
Re: Infosec 101 for Activists
#47Earlier quoted context omitted.
Blocking a highway is not an act of violence, it is a form of peaceful protest. Like a diner sit-in. You are free to correct your post to explain all the acts of violence you saw which justify the term "riot".
There are multiple documented cases where emergency vehicles are blocked by "blocking a highway" as a "peaceful protest" that resulted in deaths. e.g., London (2022) - Mark Heap and Lisa Webber.
That does not a riot make.
It is still a peaceful protest, whether you like it or not, contingent on the definition of "peaceful" being the absence of violence.
You do not have to like the outcome of a protest, but if it is not a violent one, you are expected here to describe it in accurate language.
You are not doing that.
To illustrate my point: your logic dictates that not pulling over for an emergency vehicle is tantamount to assault. It is not, and should never be in any rational society. Agree? Disagree?
Re: Infosec 101 for Activists
#48Earlier quoted context omitted.
Blocking a highway is not an act of violence, it is a form of peaceful protest. Like a diner sit-in. You are free to correct your post to explain all the acts of violence you saw which justify the term "riot".
There are multiple documented cases where emergency vehicles are blocked by "blocking a highway" as a "peaceful protest" that resulted in deaths. e.g., London (2022) - Mark Heap and Lisa Webber.
That's what makes it effective. That's the point. A protest that doesn't affect anyone is just performative. Protests aren't to spread the word. It's to jam up the gears, aka, sabotage, to make leaders act. "You're just making us late to work, it's not causing us to join your side!" Jamming up commerce and the functions of a city is how you get people to act. Not by filling out a permit to have a block party in a park. That's a rally, not a protest.
Re: Infosec 101 for Activists
#49Earlier quoted context omitted.
That video, unfortunately, is out of date. The USSC recently decided that if you are merely silent that means you waive your right to remain silent. I wish I were making that up. You now have to repeatedly state it. The USSC has been off the rails for at least ten years.
Just playing devil’s advocate here, but this idea of having to invoke your fifth amendment rights reminds me of a “Silent Man” (David Hampson) in the UK who would be arrested multiple times for blocking traffic by standing in the middle of the road. I’m not sure of the details, but in the process he would never speak to anyone at all (not even to his lawyer or psychiatrists, or just to confirm his name). It does seem…
Speech doesn’t have to be verbal.
Re: Infosec 101 for Activists
#50This is pretty much the 101 on how to get "caught". It is laughable that they recommend using ProtonMail and ProtonVPN and that there is not a single mention of things such as TOR.
Regarding Proton specifically:
- Proton has been lying about them not logging their users IP and other information in the past. It got caught red-handed in 2021 when they transmitted the data of a user to a french intelligence agency called DGSI. Source(s): https://therecord.media/protonmail-forced-to-collect-an-acti...
- Now they say: "Privacy by default", what they mean by it that by default they do not log the user's information but if an agency asks them to log then they "are required by law" to log the user's data. But the user has no way to know if he is still in the "privacy mode" or has switched to the "surveillance mode".
- It is actually possible that they log everything and use the "by default" wording as a "plausible denial". By saying that your account had been flagged earlier by law enforcement or an intelligence agency.
- All Proton mail traffic goes through Cloudflare. Let that sink in. Yes, they says that the traffic is encrypted using https and that Cloudflare can't see it's content, which might be true. But even if it is true Cloudflare gets to see a ton of interesting meta data, such as the end user's IP, the exact time and the length of what the user is being sending or receiving. Source: So even if you are in Switzerland and you use ProtonMail which is in Switzerland too, your connection still gets tunneled through an American company. Source: https://x.com/andyyen/status/1884907496705339544