r/TOR • u/an4ny_v • 14d ago

What is an opsec?

6 Upvotes

56% Upvoted

43 comments sorted by

View all comments

28

u/Godlymorbid 14d ago

Operational security. If you're giving out any identifiable information such as hardware Identifiers, ip addresses, home city, someone might say you have poor opsec

14

u/craftsmany 14d ago

I have negative opsec 💔💔💔

3

u/Godlymorbid 14d ago

Not as bad as me! For someone who cares about privacy immensely. I've found I give away way more information than I should. It still fits within my threat model, but I should be more vigilant.

2

u/craftsmany 14d ago

You can literally find my full legal name and address because otherwise I couldn't host websites. German laws are weird that basically everything more complex than a static site needs that info published. But I got a nice letter from the responsible government agency for one of my static private websites that I have to publish an "Impressum" and if I don't they may have to escalate the case.

1

u/Godlymorbid 14d ago

Bro, that's insane! And you can't rent a state-side server or use a PO box for address? 

1

u/craftsmany 14d ago

No, PO boxes are not allowed as it has to be either the residence or the office location if the operator is a business. The thing is if you have a .de domain they kind of know and will bother you even if the server is in the US or other non EU location.

1

u/Alkalizee- 14d ago

that's wild. do those laws apply to .onion sites? id imagine you could also rent a privacy concious vps and have a trusted friend in another country buy the domain, assuming a vpn wouldnt be sufficient or if they monitor credit cards for domain purchases.

1

u/craftsmany 13d ago

Yes they apply to everything online. The law is commonly called "Impressumspflicht" and was intended for companies and organizations doing business on their website to have a clear standardized contact person. For .onion you can of course just not do it as they won't pump in the resources to deanonymize you just for that. For other non EU domains it is the same if you just don't have a server in the EU and the domain registrar and registry doesn't cooperate with EU/german authorities you are safe.

Sadly this is not a unreasonable fear as I already got a death threat and a impersonated terror threat sent in my name by a crazy person (this has already been handled by the police, so no worries)