BrianKrebsDec 24, 2022

Everything online gets leaked, lost, sold or stolen eventually. This is a fundamental reality that catches up with everyone. BTW this is not a recently acquired conviction: https://web.archive.org/web/20190216141214/https://twitter.com/briankrebs/status/1045091640480804864

But please, convince me I'm wrong if you can!

I know that over the years I've radically overhauled how I interact with companies I chose to do business with. For starters, I assume breach, which means that any information I share with them is likely going to be on the Internet at some point.

E.g., I no longer sign up for a new account somewhere without also doing it in a local, hardened VM and VPN.

I assume that the IP address I used to sign up there will be leaked in connection with my other account details, and probably the last IP I used. I assume records of what I'm doing or buying there will also be leaked.

Hell, I do pretty much all of my news reading now in the same kind of (separate) setup. No way I'm agreeing to run 97 pieces of Javascript from 22 uncertain destinations on the web. I know a lot of my readers unfortunately swear by ad blockers and rarely make exceptions (I'm not a big user of them myself for a variety of reasons), but being able to reset your system after a weekend of wantonly browsing the web is also nice.

Those are just a few basic examples. But I'm curious to hear from others -- How have the folks here altered the way they live and work online in response to the incessant reminders that everyone gets pwned?

Some food for thought over the, er...food coma the next few days :) Cheers!

briankrebs on Twitter

“Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing.”

Twitter
Show threadstoXe Dec 24, 2022

@briankrebs signing up for websites makes no sense to me in a vm. That honestly just sounds like you're looking for additional points to make.

Nowhere did I see you mention that you then re-access those websites through that specifically created VM, thusly obviating the need for it in the first place.

I want to think that this is all meant in good honest intentions but I mean it really sounds a little bit like fear mongering.

Maybe that's just what you have to do these days, and I don't mean that a shot at you, I mean generally, just to earn eyeballs.

I fully understand that the threat models are different for you and myself, but I don't understand the holes in yours as you laid them out.

Show threadAllison NixonDec 24, 2022
@stoXe @briankrebs Krebs is a case study in how far bad actors can go in targeting someone. The amount of retaliation he's gotten for his cybercrime reporting over the years is insane. He's basically a honeypot, for what those of us in the fraud space will see targeting regular people, but 2 years in advance.
Show threadD0xterDec 25, 2022
@nixonnixoff @stoXe @briankrebs krebs has had several attempts on his life. Idiots have swatted him multiple times in attempts to silence him. I respect that he refuses to be intimidated and continues to fight.
Show threadstoXe 
@D0xter @nixonnixoff @briankrebs but his actions do nothing to prevent it is what I'm saying
Dec 26, 2022 at 3:20pmWeb