Security researcher writing on operational security, anonymity, counterintelligence and tradecraft against well-resourced adversaries.
Commenters point to it as an excellent source, citing the COMSEC presentation and the nation-state adversary material, and recommend reading the whole blog.
From http://grugq.github.io/blog/2013/06/10/good-luck-with-that/
The publicly available tools for making yourself anonymous and free from surveillance are woefully ineffective when faced with a nationstate adversary. We don’t even know how flawed our mental model is, let alone what our counter-surveillance actions actually achieve. As an example, the Tor network has only 3000 nodes, of which 1000 are exit nodes. Over a 24hr time period a connection will use approximately 10% of those exit nodes (under the default settings). If I were a gambling man, I’d wager money that there are at least 100 malicious Tor exit nodes doing passive monitoring. A nation state could double the number of Tor exit nodes for less than the cost of a smart bomb. A nation state can compromise enough ISPs to have monitoring capability over the majority of Tor entrance and exit nodes.
Other solutions are just as fragile, if not more so.
Basically, all I am trying to say is that the surveillance capability of the adversary (if you pick a nationstate for an adversary) exceeds the evasion capability of the existing public tools. And we don’t even know what we should be doing to evade their surveillance.
Not really. These things are hard to get right and stick to for prolonged periods of time. This requires practice and discipline.
Ordinary people (and even trained professionals [1]), get sloppy and make mistakes. Thus, this line from the presentation is golden:
"Amateurs practice until they get it right, professionals practice until they can't get it wrong.
[1]: Another excellent essay by the same person - grugq (of +HCU and Fravia+ fame) on the major OPSEC fuck-up by CIA in Lebanon and the factors that likely have lead to the full compromise of a big informant network, and possibly the deaths of a number of people [2]: http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/
[2]: http://www.wired.com/dangerroom/2011/11/pizza-cia/
added: even small things like complaining about freezing your ass off due to the cold weather, accidentally linking two nicknames, emerging at regular times (synced with a specific timezone) could be used to uncover your identitiy. As evidenced, slip-ups like could get you in jail. You can check the discussion from a few weeks back about the hassles of creating a truly anonymous page on Internet: https://news.ycombinator.com/item?id=5638988
Some good sources:
https://blog.cyberwar.nl/2016/02/some-elements-of-intelligence-work-73-rules-of-spycraft-allen-dulles-1960s/
https://www.opsecprofessionals.org/official/081103_DOD_OPSEC_Manual.pdf
http://www.opsecprofessionals.org/training/OPSEC_Training.pdf
https://www.slideshare.net/grugq/OPSEC-for-hackers
https://grugq.github.io/blog/2013/06/13/ignorance-is-strength/
https://theintercept.com/2015/11/12/edward-snowden-explains-how-to-reclaim-your-privacy/
http://thefifthcolumnnews.com/2017/03/tradecraft-introduction-to-opsec/
You might also enjoy my guides:
https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1
https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1
Many of these points can be summarised in one word: compartmentalisation
Your personas are isolated and segregated. They share no information, hobbies, interests and at a tech level they don't share connections, machines, browsers, apps.
Your anonymous personas use Tor in an isolating proxy configuration, where traffic is explicitly allowed and proxied rather than routing all by default (NAT) with explicit blocks (like a firewalls block all then allow vs allow all then block)
If you look at Opsec failures (read thegrugq[1]) you'll find that a very large number are the result of a lack of compartmentalisation and were found by establishing link(s) between known and unknown personas
[1] http://grugq.tumblr.com
The Grugq wrote a post [1] discussing TrueCrypt alternatives back in October of last year. It also mentions tc-play and cryptsetup, but additionally mentions tomb [2], which looks very interesting to me.
But while I once wrote for my mom a document with step-by-step instructions on how to create and use a TrueCrypt volume to keep some work documents secured, I don't see any alternative in either post that is going to be as accessible to normal folks (like her) as TrueCrypt.
[1] http://grugq.tumblr.com/post/60464139008/alternative-truecrypt-implementations
[2] http://www.dyne.org/software/tomb/
The mentions of his security concerns reminded me of this: http://grugq.github.io/blog/2013/06/14/you-cant-get-there-from-here/
"As a thought experiment, imagine that Osama bin Laden was still alive and that he used the Tor network to do a Reddit AMA once a month. How long do you imagine it would take for the US to find and neutralize him? I posted this question on Twitter and, while responses varied, ex-NSA Global Network Exploitation Analyst Charlie Miller guessed one to two months. I would be very surprised if it took more than three."