Sam_Bent

Sam_Bent

@doingfedtime.bsky.social

Agorist. Counter-economist. Privacy maximalist. Student of OPSEC. Anti-authoritarian. Free speech absolutist. Logician. Ex-Darknet Vendor. Youtuber.

167 followers18 following1K posts

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 221/365 Phone motion sensors leak more than you would expect. Academic research has shown that the gyroscope and accelerometer on a phone can infer keystrokes typed on that same phone, identify a person by their walking gait, and pick out individual speakers from voices in a room.

Sam_Bent
@doingfedtime.bsky.social

Keystroke inference from motion sensors works in controlled conditions and degrades quickly outside them. Gait identification across short distances has been demonstrated in published research.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 220/365 Every USB device has a unique serial number that identifies it. When you plug a USB drive into a computer, the operating system logs the device's vendor ID, product ID, and serial number. That drive can be traced across every computer it's touched.

Sam_Bent
@doingfedtime.bsky.social

For high-security situations, USB devices should be used only on designated machines. If you're moving sensitive files on USB drives, understand the drive's presence on that computer is logged.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 219/365 Vulnerability analysis in OPSEC doctrine ranks vulnerabilities on two axes: operational importance and susceptibility to collection. The highest-priority items are both important AND easy for your adversary to collect.

Sam_Bent
@doingfedtime.bsky.social

Army OPSEC doctrine has the OPSEC element rank vulnerabilities by operational importance while intelligence analysts rank them by collection susceptibility. Create a 2x2 grid: importance vs. ease of collection. Address the high-importance, easy-to-collect quadrant first.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 218/365 Shared links to cloud files often don't require authentication. That Google Drive link you shared to collaborate on a document might be accessible to anyone with the URL. Some cloud storage defaults to link access that doesn't check who's clicking.

Sam_Bent
@doingfedtime.bsky.social

On Google Drive, click Share and check whether it's set to Anyone with the link or Restricted. On Dropbox review link settings for password protection and expiration. Shared links that seem private can be found by anyone who obtains the URL, and URLs leak through many channels.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 217/365 Customer support is a backdoor for social engineers. Attackers call support lines pretending to be you, using info gathered from social media and data breaches to pass security questions.

Sam_Bent
@doingfedtime.bsky.social

Ask your critical service providers what social engineering protections they have. Some allow verbal passwords or security codes for support calls. Others are easily fooled by someone who knows your birthday and address.

Sam_Bent
@doingfedtime.bsky.social

Hotel room awareness: visual sweep on arrival: behind wall art, TV bezels, smoke detectors, power outlets. Check WiFi for rogue APs. Use the peephole cover. Assume hotel safes are accessible to staff. Sensitive calls happen outside the room.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 183/365 Sharing streaming credentials merges behavioral records under one identifier. The military OPSEC term for this is the mosaic effect: unremarkable data points combine to reveal health, political views, and psychological patterns.

Sam_Bent
@doingfedtime.bsky.social

Shared credentials produce shared behavioral attribution. If someone else watches content on your account implying a medical condition or political leaning, the inference attaches to your record. Netflix data has already been used in civil litigation.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 182/365 Your VPN provider sees everything your ISP would have seen. You moved the trust, not the exposure. In 2020, seven "no-log" VPN providers leaked 1.2TB of user data including connection logs they claimed not to keep.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 181/365 Audio watermarks can identify who leaked media. Netflix, Disney+, and movie studios embed inaudible watermarks in streaming audio that identify your account. If you record and share the content, the watermark traces the leak back to your specific stream.

Sam_Bent
@doingfedtime.bsky.social

These forensic watermarks survive most audio processing including format conversion and recompression. They're designed to catch leakers. If you're tempted to record and share content from your accounts, know the resulting file may uniquely identify you as the source.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 180/365 HUMINT collectors call it apparent withdrawal. The collector signals the conversation is ending, releases tension, then drops the real question as an afterthought. "One last thing before I let you go..." Your guard drops because the pressure seemed over.

Sam_Bent
@doingfedtime.bsky.social

"Just one more thing" is a recognized elicitation flag. So is a warm general conversation that lands on a precise operational question at the close. If you notice broad talk followed by a specific afterthought, treat it like the lead question. Because it is.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 179/365 HUMINT is the collection discipline most people forget to model against. Your adversary doesn't need to hack your devices if they can call your former employer, ask your neighbors, or socially engineer your friends for your new address.

Sam_Bent
@doingfedtime.bsky.social

NTTP 3-13.3 places HUMINT alongside SIGINT and OSINT in adversary collection discipline assessments. For personal threat modeling: map everyone in your life who has access to your critical info and assess how easily they could be socially engineered.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 178/365 Thermostat data reveals when your home is occupied. Smart thermostats from Nest, Ecobee, and Honeywell detect occupancy through sensors and adjust temperature accordingly. That data flows to the cloud.

Sam_Bent
@doingfedtime.bsky.social

Energy companies sometimes offer rebates for smart thermostats in exchange for access to usage data. Read the terms carefully. For thermostats you own, consider disabling occupancy features or using local-only devices.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 177/365 Tire pressure sensors broadcast your vehicle's presence. TPMS sensors in your tires transmit unique identifiers that can be read from nearby. Devices exist that log these IDs as vehicles pass, creating a movement record distinct from license plate readers.

Sam_Bent
@doingfedtime.bsky.social

TPMS tracking is less common than license plate readers but the capability exists. Each sensor has a unique ID that persists until you replace the tires. While not a mainstream monitoring concern yet, researchers have demonstrated tracking vehicles using these signals.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 176/365 Pregnancy and fertility apps share your most intimate health data. Flo, Ovia, and similar period tracking apps have been caught sharing data with Facebook and marketing partners. When Roe v. Wade was overturned, concerns emerged about this data being used for prosecution.

Sam_Bent
@doingfedtime.bsky.social

Some apps have committed to not sharing data with law enforcement, but terms of service change and companies get acquired. Local-only tracking apps like Drip don't upload data to servers. For maximum privacy, use a calendar or notes app that syncs only to your own devices.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 175/365 Password reset emails create a trail of your account activity. Every password reset request generates an email in your inbox and a log entry at the service. That trail shows when you got locked out, accounts you have, and roughly how you use them.

Sam_Bent
@doingfedtime.bsky.social

Attackers who compromise your email can search for reset emails to identify which services you use and then reset those passwords. Clear out old reset emails to reduce this attack surface. Enable two-factor authentication so email access alone can't compromise accounts.

Sam_Bent
@doingfedtime.bsky.social

#OPSEC365 174/365 Online petitions link your name to political positions permanently. Change.org, MoveOn, and similar platforms collect and often publish signer names. That petition you signed in 2016 is still attached to your identity.

Sam_Bent
@doingfedtime.bsky.social

Some petitions let you hide your signature from public view while still counting it. Read the privacy settings before signing. Your email address goes to the petition organizer and often to the platform's marketing partners.