Conference Device Security
Conference device security is the practice of hardening phones and laptops for hostile RF environments like DEF CON, HOPE, and Black Hat — and, more importantly, of applying a realistic threat model instead of security theater. The widespread “bring a burner phone, assume every credit card is compromised” advice is largely ill-conceived: as Rob Graham argues, for anyone running up-to-date devices, the dominant risks at a hacker conference are the same as any travel — theft, loss, and (for some) abuse by authorities — not a magical “hacker miasma.” An attacker still has to get data to your device; limiting that attack surface is the whole game.
The goal is not to be unhackable; it’s to be a low-value, high-effort target so opportunistic attacks slide off.
The correct threat model
Ranked by actual likelihood for a typical attendee (Graham’s analysis, echoed by later guidance):
- Likely: fake/evil-twin Wi-Fi access points, tampered infrastructure (ATMs, chargers, QR codes), opportunistic scanning/sniffing, social engineering, seeded malicious USB accessories.
- Moderate: device theft/loss, petty crime, hotel-room searches.
- Very unlikely: nation-state coercion, mass surveillance, or someone burning a cellular zero-day on you at a con. If a nation state is in your threat model, conference hygiene is the least of your worries — this guidance is not for that case.
The goal is not to be unhackable; it’s to be a low-value, high-effort target so opportunistic attacks slide off.
Core controls (the ones that actually matter)
Before you leave:
- Back up everything, and update OS + apps the morning you head to the airport. This is the single highest-value step.
- Full-disk encryption on every device, with a strong passcode/PIN — not a 4-digit code, and (per Graham) treat biometrics as a per-app convenience layer rather than the device’s primary lock; on laptops without a TPM (e.g. pre-T2 Macs), the login password must be strong because it’s brute-forceable.
- Prune your saved Wi-Fi networks (including from cloud keychains) so your devices don’t beacon for, and auto-join, networks an attacker can impersonate. Pre-configure any trusted network with its certificate (e.g. the official DEF CON secure Wi-Fi from
wifireg.defcon.org) so evil-twins are rejected. - Reduce what you carry: a minimal app set, and consider signing out of high-value sessions. A stolen device with no live sessions is a much smaller problem.
At the con:
- Wi-Fi and Bluetooth off unless actively needed. The RF environment is genuinely hostile — expect fake APs and tracking. Prefer cellular over conference/hotel Wi-Fi (carrier data is link-layer encrypted); if you must use Wi-Fi, only the certificate-authenticated official network. Bluetooth peripherals (headphones, fitness trackers, wireless mice/keyboards — “mousejacking”) are soft targets; leave the dongles home.
- Bring your own cables and charger; never plug in untrusted USB devices or borrowed accessories (“juice-jacking” and malicious network adapters are real). A data-blocker or battery pack removes the question.
- Run a trusted VPN — not for “privacy,” but to add an encrypted layer for any app using plaintext or downgradeable connections.
- Don’t look like a target: no conference swag, no device stickers, badge stowed when not required, no flashing cash. Theft is the main risk; don’t advertise.
- Find My / remote-wipe enabled so a lost or stolen device can be locked and erased.
Credential management as a defensive layer
Good credential hygiene compounds the device controls and matters every day, not just at cons:
- Unique email/username per service via catch-all addresses (Proton Mail, Google Workspace) or Gmail’s
+aliasing — limits cross-service correlation and breach fallout. - Unique random passwords in a password manager (e.g. KeePassXC), not the browser/system keychain.
- MFA everywhere, preferably a hardware security key (YubiKey-class). Full-featured YubiKeys can additionally lock the password manager itself — either via built-in HMAC-SHA1 challenge-response support or by storing a long random secret in a key slot used alongside a memorized passphrase.
Sources
- Errata Security: Securing devices for DEFCON (2019) — Rob Graham
- Errata Security: Risk analysis for DEF CON 2021 — Rob Graham
- 2025 — DEF CON Security Guidance — The Institute for Secure Activism
- Hacker Summer Camp 2026: Black Hat & DEF CON 34 Guide — Safeguard.sh
Related: wi-fi, http, burp-suite