SamBent
Sam Bent

Agorist. Counter-economist. Privacy maximalist. Student of OPSEC. Anti-authoritarian. Free speech absolutist. Logician. Ex-Darknet Vendor. Youtuber.

Public Key

npub1y7rvzdq5s5m65v2zygkvesdkln6gvdjrefu2jcjajx4fwjxsu3uqyhd0r3

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsz0pkpxs2g2da2x9pzytxvcxm0eayxxepu579fvfwer25hfrgwg7qpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsq3vamnwvaz7tmjv4kxz7fwwpexjmtpdshxuet5qyqqz8nhwden5te0wfjkccte9eshyarfduhxjmnx9e6ku6tzv5hxx6qpgdmhxw309a3xjarrda5kuu3kv3jn2mrtweurgarswajx67njv3nxgurvvy6hx7tpxfskvamsvdsky6n4wqe8surfx4j82mrzv9jzummwd9hkuf6e6ja

Publishing to

relay.damus.io

nos.lol

relay.primal.net

relay.artio.inf.unibe.ch

bitcoinr6de5lkvx4tpwdmzrdfdpla5sya2afwpcabjup2xpi5dulbad.onion

Author Public Key

npub1y7rvzdq5s5m65v2zygkvesdkln6gvdjrefu2jcjajx4fwjxsu3uqyhd0r3

Show more details

Last Notes

2026-07-21 21:29:39 CEST

Acoustic cryptanalysis. Extracting keys by listening to CPUs.
"Different operations produce different acoustic signatures that can reveal secret keys."
RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis by Daniel Genkin et al. (2013)
https://www.cs.tau.ac.il/~tromer/acoustic/
https://media.sambent.dev/img/3713d6d18ba7b8ee.jpg

2026-07-21 15:54:45 CEST

Buy direct from the rancher and everyone between you and him loses their cut. That's why they made it difficult.
https://media.sambent.dev/img/7b6a9b2a55d42fe7.jpg

2026-07-21 11:47:59 CEST

#OPSEC365 122/365
Private jets and most aircraft can be tracked in real time by anyone.
ADS-B transponders broadcast location data that hobbyist receivers capture and publish on sites like FlightAware and ADS-B Exchange. Elon Musk's jet, Taylor Swift's jet, and probably the aircraft you flew on last week are all trackable by anyone curious enough to look.
Search a tail number on flightaware.com and see where that plane has been.
#OPSEC365

2026-07-20 15:01:40 CEST

The Downfall of the EFF is sad to see.
https://media.sambent.dev/img/07fed582f9d2f4cb.jpg

2026-07-20 11:27:20 CEST

#OPSEC365 120/365
Photos of your pets often reveal your location and routine.
That daily walk photo has metadata showing your neighborhood route. The vet check-in confirms your area. The microchip registration contains your address. Pet accounts geotagged at dog parks reveal where you spend weekends.
Pet photos carry the same GPS metadata as anything else you post, plus the pattern of your walking routes and vet schedule.
#OPSEC365

2026-07-19 21:36:29 CEST

Opening port 18080 lets you seed the blockchain like a torrent, and the network gets stronger every time someone does.
https://media.sambent.dev/img/f9dce3ce64877109.jpg

2026-07-19 04:34:52 CEST

#OPSEC365 117/365
Your elementary school records might still exist somewhere.
FERPA (Family Educational Rights and Privacy Act) gives institutions wide latitude to retain records indefinitely. Disciplinary files, psychological evaluations, IEP documents, and test scores can resurface in background checks, legal proceedings, or data breaches decades later.
Most people have no idea what their schools kept or whether those systems are secure.
#OPSEC365

2026-07-18 21:45:02 CEST

First they KYC'd your bank.
Then your crypto.
Now they want to KYC your phone line.
https://youtu.be/DqutBRd6q94
https://media.sambent.dev/img/0810ec95ac7b9c99.jpg

2026-07-17 11:19:28 CEST

#OPSEC365 114/365
Boarding pass barcodes contain more than your seat assignment.
The PDF417 barcode on your boarding pass encodes your full name, flight details, frequent flyer number, and sometimes your booking reference. Anyone who photographs your discarded boarding pass or your Instagram post showing it can decode data and pull up your full itinerary.
Stop posting photos of boarding passes, and shred them when you're done flying.
#OPSEC365

2026-07-16 11:33:57 CEST

#OPSEC365 112/365
Facial recognition is running on you in stores, stadiums, and airports without your knowledge.
Clearview AI scraped billions of photos from social media to build a searchable database used by law enforcement and private companies. Madison Square Garden uses facial recognition to ban lawyers suing the company from attending events.
Walking through a public space puts your face into multiple of these systems at once.
#OPSEC365

2026-07-16 04:51:32 CEST

#OPSEC365 111/365
Your Tesla logs every trip, stop, and charge with timestamps and GPS coordinates.
All modern connected cars do this. GM, Ford, and BMW all collect driving data. Some sell it to insurers. Tesla's telemetry has been subpoenaed in criminal cases and divorces, placing drivers at specific locations at specific times.
Before you drive somewhere you'd rather not have on record, your car is taking notes.
#OPSEC365

2026-07-15 21:20:56 CEST

The network stays decentralized because random people in basements run nodes, and you should be one of them.
https://media.sambent.dev/img/08d96096fef1cd22.jpg

2026-07-15 19:46:22 CEST

Delisted from exchanges, banned from on-ramps, attacked by regulators, and still the default currency of every serious darknet market.
https://media.sambent.dev/img/e545182d3ce49278.jpg

2026-07-15 04:39:31 CEST

#OPSEC365 109/365
Smart meters report your electricity usage in near real time.
Usage patterns reveal when you are home, when you sleep, and how many people live with you. Utilities share this data for demand planning. Researchers have reconstructed household activities from smart meter data alone.
At fifteen-minute intervals, the meter mainly exposes occupancy and sleep schedule. Appliance-level identification needs sub-second sampling.
#OPSEC365

2026-07-14 15:52:18 CEST

Pick any darkweb handle...Instantly see every other forum the same actor used.775,621 usernames cross-referenced across 27 cybercrime forums, in one offline file with 3D link graphs.https://github.com/DoingFedTime/ThreatActorDB
https://media.sambent.dev/video/26509f74350bb256.mp4

2026-07-14 14:09:35 CEST

The CIA doesn't do interviews about Monero.Tell me more about your transparent fed coin and the L2 duct tape you bolt on to pretend it's private.Use Monero. Privacy at the protocol level since 2014.Maxis, chimp out below.Credit: Anthony Pompliano
https://media.sambent.dev/video/6fe379f09d074013.mp4

2026-07-14 04:03:55 CEST

They say MAC randomization protects you.
If it worked, they wouldn't bother collecting it.
Naval Academy researchers showed Apple's Bluetooth leaks the real MAC anyway.
https://youtu.be/wEfbhEVuvMM
https://media.sambent.dev/video/9137784df3706e0f.mp4

2026-07-14 01:00:11 CEST

#OPSEC365 107/365
Threat profiling separates adversary intent from capability. A stalker: high intent, low technical capability. A state actor: high capability, likely zero intent against you. A data broker: moderate capability, zero intent, indiscriminate collection.
Countermeasures should target the intent-capability combination of your actual adversaries: usually an ex-partner, an employer, or a data broker, not a state actor. #OPSEC365

2026-07-13 22:29:17 CEST

#OPSEC365 106/365
Indicators are observable actions an adversary can piece together to derive critical information. Your podcast history alone means nothing. Combined with location data, purchase history, and search queries, it builds a behavioral profile.
The aggregated profile is your real exposure. No single data point reveals much. The combination reveals nearly everything.
#OPSEC365

2026-07-07 14:09:09 CEST

- reply

"it works so it must not work"

2026-07-04 08:42:10 CEST

#OPSEC365 105/365
Interview scheduling apps reveal when employees are job hunting.
Calendly links shared with recruiters, interview blocks visible to curious coworkers, reference calls to colleagues who might mention it. The process of finding a new job creates signals that your current employer might notice.
Recruiter activity on LinkedIn is visible to your current employer's HR team.
Use personal email and phone for job searches. Schedule interviews outside work hours when possible. Create separate scheduling links for interviews. Be careful colleagues you trust with references until you're ready to announce.

2026-07-04 07:46:00 CEST

2026-07-02 07:00:00 CEST

#OPSEC365 103/365
Your sleep schedule is visible in your online activity patterns.
When you're last active on messaging apps, when you post on social media, when you send emails. Anyone tracking your activity can map when you wake up, when you go to sleep, and what timezone you're in regardless of what you claim.
Message timestamps alone are enough to establish your timezone, sleep schedule, and daily routine.
Some apps let you hide last active timestamps. Others you can't control. If timezone privacy matters, consider scheduling posts for times that don't match your actual schedule. Messenger apps with visible activity status broadcast when you're awake to everyone in your contacts.

2026-06-30 07:00:00 CEST

#OPSEC365 101/365
OPSEC Step 4 is risk assessment: compare the cost of a countermeasure against the probability your adversary will collect, analyze, and act on that information.
Most people either overcorrect — building fortress security against zero-capability adversaries — or undercorrect, ignoring real threats. Both failures come from skipping the calculation.
Most people skip the calculation entirely and treat OPSEC as an all-or-nothing practice.
Military OPSEC risk assessment has two components: identify the vulnerability, then select countermeasures based on cost versus probability of exploitation. NTTP 3-13.3M rates threat probability as High/Medium/Low. For personal use: not every exposure is worth correcting.

2026-06-28 07:24:00 CEST

#OPSEC365 099/365
Frequent flyer accounts track every flight for decades.
Miles earned, segments flown, destinations visited, seat preferences, travel companions when booking together. Airlines sell this data to partners and use it for profiling. Your complete air travel history exists in loyalty program databases.
Your loyalty number is a permanent index to every flight you've ever taken.
Some people skip loyalty programs for travel they'd rather not have recorded. Others use the benefits and accept the tracking. If you have old accounts with airlines you no longer fly, request deletion. That historical data still exists and could be breached or subpoenaed.

2026-06-28 07:12:00 CEST

2026-06-27 09:06:00 CEST

#OPSEC365 098/365
Banks store images of every check you deposit for years.
Mobile deposits capture high-resolution photos of checks showing signatures, account numbers, addresses, and handwriting. Banks keep these images for seven years or more. A breach exposes not just your account but everyone who wrote you a check.
Every check image in your bank's archive contains someone else's account number, address, and signature.
Checks are fundamentally insecure. They expose your bank account number and routing number to everyone you pay. For receiving payments, ACH transfers or payment apps create fewer artifacts. When you must use checks, know permanent images of both sides exist in banking systems.

2026-06-27 07:46:00 CEST

2026-06-26 16:38:00 CEST

Every "illegal" market used to be legal until someone in office decided they wanted a cut.
https://postiz.chadmarks.com/uploads/2026/03/02/5fdbb9619682978afde2ae737752c96b.jpeg

2026-06-26 16:28:00 CEST

Every "illegal" market used to be legal until someone in office decided they wanted a cut.
https://postiz.chadmarks.com/uploads/2026/03/02/5fdbb9619682978afde2ae737752c96b.jpeg

2026-06-26 07:24:00 CEST

#OPSEC365 097/365
Smart home devices remember previous owners.
Ring doorbells, Nest thermostats, and smart locks may retain links to previous accounts even after factory reset. The person who lived there before you might still have access to your doorbell camera or your thermostat schedule.
When you move into a home with smart devices, factory reset isn't enough. Remove them from previous accounts.
Contact manufacturers to fully dissociate devices from previous accounts. Some require proof of ownership. Better yet, replace smart devices entirely when moving into a new home, or remove them if the previous owner won't cooperate. You don't know who might still be watching.

2026-06-25 07:00:00 CEST

#OPSEC365 096/365
Google and Apple store years of your location history.
Every place you've been with your phone, timestamped and mapped. Google Timeline shows your movements going back years if you haven't disabled it. Apple stores significant locations in your device. This data reconstructs your entire life's movements.
Google Timeline has mapped your movements for years unless you've explicitly turned it off. Most people never have.
On Google go to myactivity.google.com and check Location History. On iPhone check Settings, Privacy, Location Services, System Services, Significant Locations.

2026-06-24 07:00:00 CEST

#OPSEC365 095/365
Your app store download history is a behavioral record — including everything you deleted.
Fertility trackers. Mental health apps. Debt tools. VPN clients. All retained under one account. Cronk's aggregation problem: unremarkable data points combine into disclosures more sensitive than any single item.
Apple and Google both respond to warrants for purchase history.
Maintain distinct accounts per context. Your install and delete timeline is a dossier of your private life.
Aggregation attacks don't require a breach. Your app history is accessible to any entity with legal process and to the platform itself for ad targeting in real time. Cronk's MINIMIZE/Exclude tactic: limit collection to what is operationally necessary.

2026-06-22 07:00:00 CEST

#OPSEC365 093/365
Your toll transponder logs every highway you drive.
EZPass, SunPass, FasTrak, and other systems track your vehicle at every toll point with timestamps. This data persists for years and has been used in divorce cases, criminal investigations, and civil lawsuits. Your driving history is recorded and retrievable.
Toll records have appeared in divorce proceedings, criminal trials, and civil suits. The transponder doesn't know what kind of case you're involved in.
Some people use cash lanes when they want trips unrecorded, though cameras may still capture plates. Others keep their transponder in a signal-blocking bag and remove it only when they want the toll discount. The data exists regardless, but you can choose when to create it.

2026-06-17 21:37:57 CEST

- reply

There is a picture of the elevator in the backround retard.

2026-06-16 04:59:12 CEST

Three countries' intelligence tools sit in the quote your local cops bought, Italian hardware,
Israeli Unit 8200 spyware, US ex-special-forces resellers. The same gear used on foreign targets now tracks you on a public road you paid for.
https://www.youtube.com/watch?v=wEfbhEVuvMM

2026-06-08 15:57:46 CEST

Comment deserves way more attention.
http://social.kikurievy2gz765eyexqbgcdgv4t34md4wjk3aadnwoofjitbkgk3xqd.onion/@yuzuki
https://postiz.chadmarks.com/uploads/2026/06/08/6ff8f1e52a601b49c4e9cd5b366a49c9.png

2026-06-06 19:00:00 CEST

FBI, Europol, IRS, CipherTrace, Chainalysis, and Elliptic have all tried to break Monero's privacy,
six of the most well-funded surveillance operations on Earth,
and they're still publishing research papers instead of arrests.
https://postiz.chadmarks.com/uploads/2026/01/03/becd198f921d41083a9054fe1281fa054.jpg

2026-06-05 02:59:15 CEST

- reply

Meanwhile every darknet market and black market uses it for billions annually.
LOL

2026-06-05 02:58:14 CEST

- reply

😉

2026-06-05 02:41:49 CEST

Members of Congress have private gold elevators, private gyms, dining rooms, they exempt themselves from laws and have a lifetime pension after one term.
The people who fund all of it have to abide by an uncountable amount of laws (google it), pay late fees, get pulled over for going 5 mph over the speed limit.
https://postiz.chadmarks.com/uploads/2026/06/05/803a273cd36d910f71a510c4bee3eb10228.png

2026-06-04 07:00:00 CEST

#OPSEC365 075/365
Warranty registrations ask for data they don't need.
When you register a product for warranty, they ask for name, address, email, phone, purchase date, sometimes even income range. This data goes to marketing databases, not just warranty files. The warranty itself usually just requires proof of purchase.
The warranty doesn't require registration. The registration form exists to collect your data.
Most warranties are valid whether you register or not if you keep your receipt. If you do register, use minimal accurate information and skip optional fields. A separate email address for product registrations keeps spam and data collection segregated from your primary inbox.

2026-05-31 19:30:00 CEST

The government will let corporations pump high fructose corn syrup into everything on the shelf, despite heart disease being the #1 killer in America. But you need $35,000 in permits to sell homemade salsa to your neighbor, because you never paid off Congress with lobbyists.
https://postiz.chadmarks.com/uploads/2026/03/02/832f75b7efb3fa242cc9e8f2fe4b21029.jpeg

2026-05-30 18:00:00 CEST

Anyone with an internet connection can search your Bitcoin balance, trace your transaction history, and link it to your identity
but tell me again how "number go up" makes that a feature and not a catastrophic design flaw.
https://postiz.chadmarks.com/uploads/2026/01/03/4f6ddf12391f35daf6f40f3194ee2b31.jpg

2026-05-30 07:00:00 CEST

#OPSEC365 070/365
Most color printers embed invisible tracking codes on every page.
These machine identification codes, also called printer dots, encode the printer's serial number and timestamp on every printout in a pattern invisible to the naked eye. The NSA leaker Reality Winner was caught partly because of these dots.
If you're printing something sensitive, know that the printout itself may identify the printer used.
Black and white laser printers generally don't include these dots. If you must print anonymously, use a printer you don't own, purchased with cash, from a public location. The EFF maintains a list of printers known to embed tracking codes.

2026-05-29 07:00:00 CEST

#OPSEC365 069/365
Gym access logs track when you work out down to the minute.
Card scans at entry and exit, equipment check-ins, class registrations. If your gym sells data or gets breached, your fitness schedule becomes part of your public profile. Combined with other data, this reveals when you're not home.
Your gym knows when you're not home. So does whoever buys their data.
Some gyms sell aggregated data to brokers. Others have been breached repeatedly. If your gym requires a membership card, you're logged every time. Vary your schedule occasionally, or choose gyms with less surveillance.

2026-05-25 01:26:35 CEST

Agorism doesn't ask permission.
The LP has been on the ballot since 1972 and the federal government is larger now than when they started.
Acting outside the system compounds, voting inside it doesn't.
https://postiz.chadmarks.com/uploads/2026/05/24/95a5a7d235486d0bdbb813a109c41ee26.png

2026-05-24 15:45:00 CEST

Every dollar they take is time you worked that you'll never get back.
https://postiz.chadmarks.com/uploads/2026/03/02/4a913d4e8d3910b1de2b283b7215cc98c.jpeg

2026-05-24 07:00:00 CEST

#OPSEC365 064/365
Vigilant Solutions and Flock Safety run private ALPR networks logging every plate passing their cameras at gas stations, apartment complexes, and highway ramps. Over 5 billion plate records sit in private databases.
Law enforcement subscribes to query this data with GPS and timestamps, retained for years. Your driving patterns are compiled without a warrant ever being requested.
ALPR readers mount on freeway overpasses, traffic lights, and police vehicles. You cannot defeat them, but you can reduce what they compile on you. Vehicle registration under an LLC separates your name from the plate in query results.

2026-05-23 18:00:00 CEST

Coinbase can blacklist your Bitcoin based on where it's been,
miners can refuse your transactions, and your "decentralized" money has a permanent criminal record,
Monero solved this with stealth addresses and ring signatures in 2014.
https://postiz.chadmarks.com/uploads/2026/01/03/f1e7cc4ecd2a7eac0edb66100dcdb3563.webp

2026-05-21 07:00:00 CEST

#OPSEC365 061/365
Your airline reservation contains more than flight times.
The Passenger Name Record includes your full name, payment card, contact details, seat preferences, meal choices, and any special requests. Airlines share this data with governments, marketing partners, and security agencies. It persists long after your flight lands.
Most fields on a booking form are optional. None of them need to be filled honestly.
Skip the loyalty programs if you don't want your travel history tracked. Use gift cards purchased with cash for booking. Avoid special requests that make your record unique. The more generic your PNR looks, the harder it is to build a profile from it.

2026-05-20 14:31:20 CEST

Haveno Brought Back the Arbitrator Multisig and Attackers Just Hijacked It
At 03:43 UTC on May 20, woodser opened an eight-line patch in TradeProtocol.java, and by the time it went up the exploit was already running against live RetoSwap trades.
https://www.sambent.com/haveno-brought-back-the-arbitrator-multisig-and-attackers-just-hijacked-it/
https://postiz.chadmarks.com/uploads/2026/05/20/d3a10b73749bd03610b88ed1032829a3d74.jpg

2026-05-20 07:00:00 CEST

#OPSEC365 060/365
The ABC system is how surveillance teams avoid burning their operators.
In mobile surveillance: A is the eyeball vehicle directly behind the target, B follows in a covering position, C works parallels. Handovers rotate who has direct visual, preventing any single operator from being seen too long.
Counter-surveillance principle: one sighting of a person or vehicle proves nothing. The threshold is two independent sightings at non-coincidental locations. In a well-run ABC team, no operator holds the eyeball long enough to trigger threshold alone.

2026-05-18 07:00:00 CEST

#OPSEC365 058/365
Every business card you hand out is a data collection opportunity.
Name, title, company, phone number, email address, sometimes personal cell and LinkedIn. You give these freely to strangers at networking events, and those cards end up in databases, on desks of people you don't remember meeting, or in piles sold to data brokers.
Most business cards contain more information than any single recipient needs.
Some people use cards with only their name and email, nothing else. Others use QR codes that link to a contact form instead of giving direct numbers. The point is deciding what you want someone to have before handing over a printed summary of how to reach and identify you.

2026-05-16 17:00:00 CEST

The most respected cypherpunk in Bitcoin's history told you transparent ledgers are designed to harm individual privacy,
and the Bitcoin community pretends they never heard him,
Monero is what Hal was actually describing.
https://postiz.chadmarks.com/uploads/2026/01/03/371446ad76ee89ce282f238027803dc0.jpg

2026-05-16 07:00:00 CEST

#OPSEC365 056/365
People can identify your location from tiny background details in photos.
A GeoGuessr player found a streamer's exact location from a photo of her ceiling. Power line styles, vegetation types, store signs, and even the angle of shadows narrow down where you are. Determined people treat this like a game, and they're very good at it.
Look at your recent photos and ask what background details could reveal where you live.
Unique architectural features, visible street signs, store logos, and distinctive plants all provide clues. Even indoor photos can reveal window views or reflections. If you're concerned about location privacy, photograph against plain backgrounds or in nondescript settings.

2026-05-15 19:30:00 CEST

Civil disobedience is only celebrated when it's old enough to be in a textbook.
https://postiz.chadmarks.com/uploads/2026/03/02/7d259210a7850e011e2e105376508ff89c.jpeg

2026-05-11 15:00:00 CEST

Return-to-libc attacks when stack protection made shellcode harder.
"Return-to-libc attacks allow code execution without injecting any code onto the stack."
- 𝗕𝘆𝗽𝗮𝘀𝘀𝗶𝗻𝗴 𝗦𝘁𝗮𝗰𝗸𝗚𝘂𝗮𝗿𝗱 𝗮𝗻𝗱 𝗦𝘁𝗮𝗰𝗸𝗦𝗵𝗶𝗲𝗹𝗱 by Bulba and Kil3r (2000)
https://phrack.org/issues/56/5.html
https://postiz.chadmarks.com/uploads/2025/10/02/46f5fa7c0a2ca2f35932a542b4da78103.png

2026-05-10 07:00:00 CEST

#OPSEC365 050/365
Your car's infotainment system remembers everywhere you've been.
Navigation history, paired phone contacts, call logs, text messages if connected via Bluetooth. Rental cars retain previous drivers' data. Used cars come with the previous owner's information. And when you sell or return your car, your data stays behind.
Factory reset your infotainment system before selling, trading, or returning a vehicle.
Every car handles this differently, but look for Reset or Factory Defaults in the settings menu. Don't just delete your phone from paired devices, wipe the entire system. For rental cars, avoid pairing your phone at all or use a clean burner phone for navigation instead.

2026-05-07 07:00:00 CEST

#OPSEC365 047/365
Your smart TV shares a network with your laptop, phone, and NAS. That's a compartmentalization failure.
ACR runs by default on Vizio, Samsung, and LG — fingerprinting your viewing. A TV with a vulnerable update path is a lateral pivot into your LAN.
Cronk's SEPARATE strategy: partition contexts with different trust levels. Your TV needs internet. It has no need to see your other devices.
VLAN your IoT tier. Your TV doesn't need to know your NAS exists.
Implementation: create an isolated IoT VLAN with internet-only egress, no routing to your primary LAN. A smart TV's legitimate function requires only outbound streaming access — zero visibility into personal devices.

2026-05-06 17:00:00 CEST

Every atomic swap is another transaction that never touched Coinbase, Kraken, or any compliance department.
https://postiz.chadmarks.com/uploads/2026/01/04/16aef1e2218f11bc95b10b2583f4f918.jpg

2026-05-05 22:23:14 CEST

- reply

When Bitcoin's subsidy reaches zero, hashrate follows revenue. Fee markets that can't currently fill blocks aren't going to secure a multi-trillion dollar network on voluntary tips.
Tail emissions solve the problem.
Bitcoin hasn't.

2026-05-05 22:22:15 CEST

- reply

Finnish Customs seized Silkkitie's Monero and publicly stated they couldn't crack it. "Computationally expensive with no guaranteed outcome" is what winning looks like against an adversary with law enforcement resources and a financial incentive to break it.

2026-05-05 15:00:00 CEST

I built pq-ratchet: Forward secrecy + quantum resistance in one Rust crate.
Signal's Double Ratchet gives every message its own key steal one, you decrypt nothing else.
ML-KEM-768 (NIST FIPS 203) layered on top of X25519 means quantum computers can't break it either.
crates.io/crates/pq-ratchet
sambent.dev/sam/pq-ratchet
github.com/DoingFedTime/pq-ratchet
sambentamhhtuyazvbsfi2zoia346x3d7gdn6e52av23qn5v4wqwpiqd.onion/sam/pq-ratchet
https://postiz.chadmarks.com/uploads/2026/05/03/4533d9273410813bce34f075e9107a5101010.png

2026-05-04 07:00:00 CEST

#OPSEC365 044/365
Rental applications require a complete financial strip search.
Social security number, bank statements, employer contact information, pay stubs, previous addresses, references. Landlords and property management companies collect this data, often share it with screening services, and rarely have strong security.
Ask how your rental application data is stored and when it will be deleted.
You can't avoid providing this info if you want to rent, but you can ask questions. Does the screening company retain your data? Is it encrypted? Will it be deleted after the decision? Most won't answer satisfactorily, but the question itself signals you're paying attention.

2026-05-04 01:45:00 CEST

Twelve years of public school and they never once taught you what agorism, counter-economics, or voluntary exchange means. That wasn't an accident.
https://postiz.chadmarks.com/uploads/2026/03/02/a8567657015a796965bb19896514568e.jpeg

2026-05-02 19:00:00 CEST

Secure means your funds can't be seized without your keys,
private means no one sees your balance or transactions,
untraceable means chain analysis is useless,
Monero is the only cryptocurrency that delivers all three by default.
https://postiz.chadmarks.com/uploads/2026/01/03/e1014d20a33f3e594c86446c736848804.jpg

2026-04-30 07:00:00 CEST

#OPSEC365 040/365
Your clipboard holds a copy of everything you've cut or pasted.
Passwords you copied from password managers, addresses, phone numbers, sensitive text from private conversations. Some devices keep clipboard history across apps, and some apps can access it without asking.
Clear your clipboard after pasting sensitive information, especially on shared or work devices.
On iPhone the clipboard clears when you copy something new, but keyboard apps may log history. On Android clipboard history can persist and sync. Windows keeps history if enabled.

2026-04-29 07:00:00 CEST

#OPSEC365 039/365
Court records are public, and they contain more than you'd expect.
Divorce filings with financial details, lawsuits naming parties and allegations, bankruptcy records listing assets and debts. Search tools like PACER for federal courts and state court websites make these accessible to anyone willing to look.
A dismissed case, an old civil filing, a lien — all still indexed in state court databases years after resolution.
You can't seal records since they're embarrassing, but you should know what exists. Some people proactively search themselves before job interviews or business deals so they're not surprised.

2026-04-28 21:30:00 CEST

Your bank works for the government. Monero works for you.
https://postiz.chadmarks.com/uploads/2026/03/02/6a3ce2a3259cc5410dee77bc20102a9977.jpeg

2026-04-28 07:00:00 CEST

#OPSEC365 038/365
Property records are public in most jurisdictions.
Your home address, purchase price, the name on the deed, property taxes owed. Anyone can search county records and find where you live, how much you paid, and when you bought. Some states make this searchable online for free.
Your name, address, transaction history, and assessed value are in your county assessor's database, searchable for free by anyone.
LLCs and trusts can hold property instead of your personal name, but they add complexity and cost. Some people use nominee services for privacy. The simplest approach is knowing what's public and adjusting other behaviors accordingly.

2026-04-27 07:00:00 CEST

#OPSEC365 037/365
Your voice is a biometric you can't change.
Banks use voice verification, smart assistants recognize you by speech patterns, and deepfake technology can clone your voice from a few seconds of audio. That podcast appearance, that YouTube video, that voicemail greeting all provide samples.
Every call made through a VoIP carrier was processed by servers that logged it.
Voice authentication is convenient but vulnerable. Unlike passwords, you can't change your voice after it's compromised. Some people opt out of voice verification entirely and use alternative authentication. Others limit how much audio of themselves exists publicly.

2026-04-26 07:00:00 CEST

#OPSEC365 036/365
Someone behind you at the coffee shop can watch you type your password.
Shoulder surfing is low-tech and effective. ATM PINs, phone unlock codes, laptop passwords. All it takes is the right angle and a few seconds of attention while you assume nobody is looking.
Next time you enter a password in public, check what's behind you first.
Position yourself with your back to a wall when possible. Tilt screens away from observers. Use biometrics for quick unlocks and save complex passwords for private settings. Some people use password managers with auto-fill to avoid typing passwords where others can see.

2026-04-25 18:00:00 CEST

Monero devs spent years quietly building FCMP++
while Zcash devs spent years lobbying regulators and tweeting about compliance
one project shipped privacy,
the other shipped press releases.
https://postiz.chadmarks.com/uploads/2026/01/03/e2e3eec2685b8d61084251c4effc206e1.jpg

2026-04-24 07:00:00 CEST

#OPSEC365 034/365
Parents post an average of 1,500 photos of their child online before the kid turns five.
First day of school with the school name visible, sports uniforms with team and league info, birthday posts with exact ages. By the time kids are old enough to control their own digital presence, they already have one built by their parents.
Children documented online from birth have no say in the digital footprint they inherit.
Consider what your children would want documented publicly when they're adults. Some families use private channels like shared albums instead of public posts. Others simply don't post children's faces at all.

2026-04-21 20:00:00 CEST

Cops ticket you for flashing your brights to warn other drivers about a speed trap, then claim it's "obstructing an investigation."
Federal court (Elli v. Ellisville, 2014) shot that down as a First Amendment violation. Ohio 1976, NJ 1999, TN 2003, PA Supreme Court, all same ruling: protected speech.
If warning drivers to slow down was really about safety, the cop's job would be done.
https://postiz.chadmarks.com/uploads/2026/04/18/26d47266e8ea2eb3bb141ea25b9ed674.jpg

2026-04-20 07:00:00 CEST

#OPSEC365 030/365
Your phone's WiFi probe requests are a surveillance signature.
Every time your device searches for known networks it broadcasts every network name you've connected to, alongside your MAC address. A passive receiver logs these probes w/o any connection being made, building a movement profile.
Disable WiFi when not in use. Enable MAC address randomization in device settings - iOS and Android support this per-network. For high-sensitivity environments: airplane mode eliminates probe broadcasts entirely.

2026-04-18 20:06:46 CEST

There's a Linux distro that exists specifically to break California's age verification law.
"Full, knowing, and intentional noncompliance" with AB-1043.
They're mailing $12 RISC-V boards to schools.
Watch:
https://youtu.be/DcwPE0LIfdg
https://postiz.chadmarks.com/uploads/2026/04/18/e8fd109ccd42da6d204344ff327bd4c83.jpg

2026-04-18 07:00:00 CEST

#OPSEC365 028/365
Every loyalty card swipe builds a profile of your habits.
The grocery store knows what you eat, the pharmacy knows what prescriptions you fill, the gas station knows where you drive. That data gets sold to brokers who correlate it with everything else they have on you.
The points are worth pennies. The purchase history is worth considerably more — to them.
Pay cash without a loyalty card and you're invisible to the data collection. If you want discounts without surveillance, some people use fake names and burner phone numbers for loyalty accounts, or share cards with friends to muddy the data.

2026-04-15 18:00:00 CEST

Anyone with a computer can mine XMR, which is how decentralization was supposed to work.
https://postiz.chadmarks.com/uploads/2026/01/04/b88fee11b5811cb42f73cf796b49d194.jpg

2026-04-11 07:00:00 CEST

#OPSEC365 021/365
OPSEC Step 2 is threat analysis: research your adversary's actual collection capabilities. Public records, court databases, social media aggregators, data brokers, and reverse image search form a surveillance infrastructure anyone can access for under $50/month.
Your adversary doesn't need hacking skills. They need patience.
NTTP 3-13.3 lists adversary collection as HUMINT, SIGINT, OSINT, GEOINT, and MASINT. For most civilians, HUMINT and OSINT are the primary threats. Digital countermeasures alone fail if your adversary collects via human contact.

2026-04-10 07:00:00 CEST

#OPSEC365 020/365
Who knows you're traveling before you leave?
The coworker you told about your trip, the auto-reply announcing you're out of office, the social post about your upcoming vacation. Each one widens the circle of people who know your home will be empty.
Next trip, try keeping the details vague until you're back and see who actually needed to know.
Auto-replies don't need to say where you're going or when you'll be back. Having limited email access and responding when available reveals nothing. The same applies to telling acquaintances your travel plans versus just saying you're busy that week.

2026-04-09 17:26:11 CEST

The fact that the first list is longer than the second list by itself is actually kind of reassuring.
The fact that we even need these lists is pathetic.
https://postiz.chadmarks.com/uploads/2026/04/09/e4e3cf1036067f78cbf7e91ebde74457f.png

2026-04-08 19:00:00 CEST

"Tainted coins" is a concept that only exists when your blockchain snitches on transaction history.
https://postiz.chadmarks.com/uploads/2026/01/04/2901091a0189317f346667aebaf10cd2f8.jpg

2026-04-08 07:00:00 CEST

#OPSEC365 018/365
Before picking a single countermeasure, OPSEC doctrine requires you to profile your adversary. A stalker uses HUMINT. A data broker uses OSINT at scale. A state actor adds SIGINT and GEOINT. These are not the same threat.
Treating them identically is how people waste effort protecting against the wrong attack.
Shostack's threat modeling framework asks: realistic attackers vs you specifically? The Verizon RISK A4 model categorizes actors by Actors, Actions, Assets, and Attributes. For personal OPSEC: map adversaries to their most collection methods before choosing any countermeasure.

2026-04-06 16:00:00 CEST

Ken Thompson's acceptance speech for the Turing Award on security thinking.
"The moral is obvious. You can't trust code that you did not totally create yourself."
- 𝗖𝗼𝗺𝗽𝘂𝘁𝗲𝗿 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗶𝗻 𝘁𝗵𝗲 𝗥𝗲𝗮𝗹 𝗪𝗼𝗿𝗹𝗱 by Butler Lampson (2004)
https://www.microsoft.com/en-us/research/wp-content/uploads/2004/06/Computer-Security-in-the-Real-World.pdf
https://postiz.chadmarks.com/uploads/2025/10/02/dbf145d771c8fe97353d9348fdf8cb35.png

2026-04-05 07:00:00 CEST

#OPSEC365 015/365
Every package you order creates a record linking your name to your address.
That Amazon order, that supplement you'd rather keep private, that gift that reveals your relationship status. Somewhere there's a database connecting your identity to your home and your purchasing habits.
Most of them don't need it. They asked because you gave it.
A PO Box or private mailbox service breaks the link between your name and home address for most deliveries. It costs around twenty dollars a month and keeps your physical location out of dozens of corporate databases that will eventually get breached.

2026-04-05 01:32:05 CEST

Most Tor Docker images are running outdated Tor, no guard protection, and leave telemetry on by default.
HiddenForge v2.0.0 (my creation):
Tor 0.4.9.6 + Vanguards,
every dependency SHA256-pinned,
zero telemetry,
read-only filesystem,
rootless Podman support.
Built for a state-level adversary threat model.
https://github.com/DoingFedTime/HiddenForge
https://hub.docker.com/r/doingfedtime/hiddenforge
https://postiz.chadmarks.com/uploads/2026/04/04/8d5ae99a3b84f41bc41358b3c710e9492.png

2026-04-04 18:00:00 CEST

Monero has survived ten years on donations and volunteer labor while VC-backed "privacy" projects burned through millions building compliance tools,
turns out you don't need a marketing budget when the product actually works.
https://postiz.chadmarks.com/uploads/2026/01/03/11045d4bb05193a75cfa699068cd5e3b2.jpg

2026-04-04 07:00:00 CEST

#OPSEC365 014/365
Who has a key to your home right now?
Family members, the ex who never returned theirs, the neighbor watching your place while you travel, the cleaning service, the property manager. Each one is a potential entry point you don't control.
If you can't name every person with access, you've already lost track.
Re-keying is cheaper than replacing entire locks and takes about fifteen minutes per door. If you've lost track of who has copies, it's worth the cost to reset the access list. Smart locks with revocable codes solve this for new access but create their own attack surface.

2026-04-03 07:00:00 CEST

#OPSEC365 013/365
Alcohol removes the filter between what you know and what you say.
The classified project you're working on, the friend going through a divorce, the coworker you can't stand. After a few drinks, those things slip out to whoever happens to be sitting next to you at the bar.
Next time you're out drinking, notice what you almost said and what stopped you from saying it.
Professional intelligence officers target bars and social events specifically because people talk more freely there. If you work with sensitive information, consider who might be listening when your guard is down and adjust your drinking accordingly.

2026-04-02 22:44:56 CEST

Proton built Proton Meet to escape the CLOUD Act.
They built it on CLOUD Act infrastructure.
Their website promises "not even government agencies" can access your calls.
The company routing them hands your call records to the government when asked.
https://www.sambent.com/proton-meet-isnt-what-they-told-you/
https://postiz.chadmarks.com/uploads/2026/04/02/2978ccd28bfe88d461076c25fa3452e50.jpg

2026-04-02 07:00:00 CEST

#OPSEC365 012/365
Your car tells people more about you than you realize.
The parking permit reveals where you work. The bumper stickers broadcast your politics, your kids' schools, and the gym you go to. The pattern of where you park and when tells anyone watching exactly where you'll be tomorrow.
Look at your car like a stranger and count how many facts they could learn from it.
You don't need to strip your car bare, but consider what each sticker or accessory reveals. The honor student bumper sticker just told a stranger your child's school and approximate age. The parking permit narrows down your employer. Each one is a piece of a puzzle.

2026-04-01 18:00:00 CEST

Finally, an honest warning label about what financial privacy actually threatens.
https://postiz.chadmarks.com/uploads/2026/01/04/9f5b6c07aad0a29526733e8f4b1275010.jpeg

2026-04-01 07:00:00 CEST

#OPSEC365 011/365
Google your full name in quotes and see what comes up.
Data broker listings, old forum posts, voter records, that 10K you ran in 2014. Most people have no idea how much of their history is indexed and publicly searchable by anyone who wants to find it.
Whatever shows up on page one is what your adversary finds first.
Services like DeleteMe and Privacy Duck can remove you from data broker sites, but they're not perfect. The free version is doing it yourself by finding the opt-out page for each broker and submitting removal requests manually. It takes time, but it works.

2026-04-01 00:50:59 CEST

Congress forced telecoms to build surveillance backdoors in 1994.
Chinese hackers found them.
The government's response is to ban your router.
https://youtu.be/Tu9ceIWrcUc
https://postiz.chadmarks.com/uploads/2026/03/31/943fb13dff813dc9cb8e0e91044364e19.jpg

2026-03-31 16:00:00 CEST

This week Apple pulled VPN apps in Russia at Roskomnadzor's request
and forced UK users to hand over government ID to keep using their phones normally.
https://www.sambent.com/apple-obeyed-russia-and-britain-in-the-same-week/
https://postiz.chadmarks.com/uploads/2026/03/31/53a9567d3739765778a10e455d6bf2156.jpg

2026-03-31 13:23:28 CEST

axios Got Hijacked and Your Machine May Be Compromised
https://www.sambent.com/axios-got-hijacked-and-your-machine-may-be-compromised/
https://postiz.chadmarks.com/uploads/2026/03/31/a559585ee0a513b1339daca79b663ca5.jpg

2026-03-31 07:00:00 CEST

#OPSEC365 010/365
Your phone logs every call you make, every text you send, and the duration of each conversation. Even with encrypted messaging, your carrier knows who you contacted, when, and for how long.
Pull up your call history and imagine someone trying to map your relationships based purely on who you talk to and how often.
The connections are already logged.
Content can be encrypted, but metadata often can't. Who you call, when, and how often creates a pattern that reveals relationships, habits, and associations without anyone reading a single message. The structure of your communications tells its own story.

2026-03-30 21:46:49 CEST

Anon, Feds hate you, it's not just a meme.
𝗔𝗹𝗶𝗰𝗲 𝗠𝗮𝗿𝗶𝗲 𝗝𝗼𝗵𝗻𝘀𝗼𝗻 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲 + 𝟮𝟱 𝘆𝗲𝗮𝗿𝘀
Relaying phone messages in a cocaine conspiracy.
First arrest ever.
𝗪𝗲𝗹𝗱𝗼𝗻 𝗔𝗻𝗴𝗲𝗹𝗼𝘀 | 𝟱𝟱 𝘆𝗲𝗮𝗿𝘀
Three sales of $350 worth of marijuana with an alleged ankle holster.
No prior record.
𝗗𝗶𝗰𝗸𝘆 𝗝𝗼𝗲 𝗝𝗮𝗰𝗸𝘀𝗼𝗻 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲
Transported meth on his truck route to pay for his dying toddler's $250,000 bone marrow transplant after insurance dropped them.
𝗚𝗲𝗼𝗿𝗴𝗲 𝗠𝗮𝗿𝘁𝗼𝗿𝗮𝗻𝗼 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲
Pleaded guilty to drug charges expecting 40-54 months per the prosecution's own recommendation.
The judge gave him the maximum to pressure him into snitching on the Philly mob.
𝗧𝗶𝗺𝗼𝘁𝗵𝘆 𝗧𝘆𝗹𝗲𝗿 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲Mailed LSD to a Grateful Dead concert friend.
Two prior nonviolent drug offenses triggered the federal three-strikes provision.
𝗙𝗮𝘁𝗲 𝗪𝗶𝗻𝘀𝗹𝗼𝘄 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲
Acted as a $5 middleman in a $20 crack sale to an undercover cop in Shreveport, Louisiana.
𝗖𝗼𝗿𝘃𝗮𝗶𝗻 𝗖𝗼𝗼𝗽𝗲𝗿 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲
Federal marijuana conspiracy.
Never touched the product, no violence.
Sentenced under the federal three-strikes drug law.
𝗣𝗮𝘁𝗿𝗶𝗰𝗸 𝗠𝗮𝘁𝘁𝗵𝗲𝘄𝘀 | 𝗟𝗶𝗳𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗽𝗮𝗿𝗼𝗹𝗲
Stole tools from a shed in Slidell, Louisiana.
Enhanced by prior nonviolent convictions under habitual offender laws.