#OPSEC365 221/365 Phone motion sensors leak more than you would expect. Academic research shows a phone's gyroscope and accelerometer can infer keystrokes typed on that same phone, identify a person by their walking gait, and pick out individual speakers in a room. Most of this stays lab-grade, but motion sensors get far less permission scrutiny than the mic or camera that would do the same job more directly. Treat motion sensor access like microphone access. #OPSEC365

#OPSEC365 220/365 Every USB device has a unique serial number that identifies it. When you plug a USB drive into a computer, the operating system logs the device's vendor ID, product ID, and serial number. That drive can be traced across every computer it's touched. Forensic analysis of machines reveals what USB devices have connected to them. USB serial numbers are logged in Windows registry entries that persist after the device is removed. #OPSEC365

The darkest twitter (pitch) disables new accounts due to spam. Quality over quantity.

#OPSEC365 219/365 Vulnerability analysis in OPSEC doctrine ranks vulnerabilities on two axes: operational importance and susceptibility to collection. The highest-priority items are both important AND easy for your adversary to collect. Low-importance data that's hard to collect isn't worth protecting. High-importance data that's trivially exposed is your immediate priority. A list of vulnerabilities without ranking gives you no place to start. #OPSEC365

SamBent Forge

HiddenForge 2.1.0 - sam/HiddenForge

> **Superseded by [2.1.2](https://sambent.dev/sam/HiddenForge/releases/tag/v2.1.2).** Upgrading needs nothing: same compose file, same keys, same a...

#OPSEC365 218/365 Shared links to cloud files often don't require authentication. That Google Drive link you shared to collaborate on a document might be accessible to anyone with the URL. Some cloud storage defaults to link access that doesn't check who's clicking. URLs can be guessed, leaked, or discovered through browser history. Check the sharing settings on cloud files before sending links and restrict access to specific accounts. #OPSEC365

#OPSEC365 217/365 Customer support is a backdoor for social engineers. Attackers call support lines pretending to be you, using info gathered from social media and data breaches to pass security questions. They request password resets, account changes, or info that helps compromise your accounts. Add extra security to accounts that allow it and expect that attackers will target support channels. #OPSEC365

#OPSEC365 216/365 Temporary email services aren't as anonymous as they seem. 10minutemail, Guerrilla Mail, and similar services let you create throwaway addresses, but the services themselves log IP addresses and usage. Anyone with access to the service's logs can correlate your temporary address with your real identity through connection data. For truly anonymous email, temporary services require additional layers of protection like Tor. #OPSEC365

#OPSEC365 215/365 Counter-surveillance starts with awareness of who might be watching. Professional surveillance involves multiple people, vehicle switches, and careful tradecraft. But most surveillance you'll encounter is amateur. A car that appears too often, someone who shows up at multiple places you go, or patterns that feel off deserve attention. Practice being aware of your surroundings without being paranoid. #OPSEC365