Two cautionary examples show how making dumb security mistakes can send you to prison if you have something to hide. Ross Ulbricht of Silk Road asked a question on a programming forum using his real name, quickly changed it, but FBI used that to make the link between his handle and real identity. Bradley Manning used his Macbook login password as the encryption key for the files he took. The FBI took his Macbook to Apple and said help us crack the login password. They did.
The FBI did seriously good detective work tracking down Ulbricht’s online personas.
He searched for Tor URLs around the time of the site’s first appearance and found a mention in a Shroomery.org forum on January 27, 2011, days after the Silk Road launch. A user named Altoid talked up this exciting new “service that claims to allow you to buy and sell anything online anonymously.”
Googling elsewhere for the username Altoid revealed a question about database programming posted on Stack Overflow, dated March 16, 2013, asking, “How do I connect to a Tor hidden service using curl in php?” The email listed was rossulbricht@gmail.com. A minute later, that user changed the alias to Frosty.
.Manning learned the hard way to never ever reuse an important password.
Mark Johnson, a digital forensics contractor for ManTech International who works for the Army’s Computer Crime Investigative Unit, examined an image of Manning’s personal MacBook Pro and said he found 14 to 15 pages of chats in unallocated space on the hard drive … While the chat logs were encrypted, Johnson said that he was able to retrieve the MacBook’s login password from the hard drive and found that the same password “TWink1492!!” was also used as the encryption key.
If Manning had used a different encryption key he might well not be in prison.
Manning