4 ms·

A better analogy to taking the trash to the curb, in this example, would be disposing of your device or hard drive. So if your hard drive is not encrypted and y

by deno 10y ago

A better analogy to taking the trash to the curb, in this example, would be disposing of your device or hard drive. So if your hard drive is not encrypted and you throw it away without securely erasing the data or adequately physically destroying it (the equivalent of shredding paper documents), then you have no reasonable expectation of privacy. By taking the trash to the curb, or throwing away your hard drive, you signal that you no longer care about said trash/data. You probably still care about the data on the device that you haven’t yet decided to throw away. The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. To continue with your analogy, hacking a device that someone still owns is exactly like breaking into someone’s house to go through their trash. The internet connection is just a medium by which the break-in occurs.

will_brown 10y ago
>The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. I see your point, but playing devil's advocate why is the opportunity to consider what data you put on the curb or that is on a device you connect to the internet any different? Surely you can elect to drill a hole in your hard drive before putting it on the curb and you can remove any and all data (including evidence of a crime) from your device before you connect it to the internet.
- deno 10y ago
  I do understand the argument you’re making here, but I’m not convinced. Let’s consider a few similar examples with mediums other than internet: 1) Should the government require warrant to monitor the way you use electricity to see what’s on your screen, or to steal your encryption keys?[1][2] 2) Should the government require warrant to listen to the vibrations your water pipes carry and eavesdrop on the conversations inside? (hypothetical afaik) Maybe the difference here is that Internet is not, by law, considered an utility in the U.S. Should that make a difference? I think, logically, no. If the government cannot, without a warrant, implement side-channel attacks like the one listed above, then it definitely shouldn’t be allowed to actually actively exploit a device that’s simply making use of some utility, even a digital one. More to the point, no one intends to make their data public, any of it, simply by connecting to the internet. That’s the determination you make when you actually copy that data anywhere, or when you use any web service, including this site. So no, there is no opportunity to review what you want to reveal, because there is no intent to do so in the first place. [1] https://it.slashdot.org/story/09/07/12/0259246/stealing-data-via-electrical-outlet https://it.slashdot.org/story/09/07/12/0259246/stealing-data... [2] http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-keys-through-pcs-noises-old-am-radio-1563396 http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-ke...
  - nickpsecurity 10y ago
    Funny you mention water pipes: they are an attack vector that's considered in TEMPEST shielding to block emanation attacks per what a professional told me. It's one of reasons you won't see bathrooms in many TEMPEST computer rooms that are otherwise self-contained. Anything that conducts plus power lines.

by deno 10y ago

will_brown 10y ago

>The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. I see your point, but playing devil's advocate why is the opportunity to consider what data you put on the curb or that is on a device you connect to the internet any different? Surely you can elect to drill a hole in your hard drive before putting it on the curb and you can remove any and all data (including evidence of a crime) from your device before you connect it to the internet.

deno 10y ago
I do understand the argument you’re making here, but I’m not convinced. Let’s consider a few similar examples with mediums other than internet: 1) Should the government require warrant to monitor the way you use electricity to see what’s on your screen, or to steal your encryption keys?[1][2] 2) Should the government require warrant to listen to the vibrations your water pipes carry and eavesdrop on the conversations inside? (hypothetical afaik) Maybe the difference here is that Internet is not, by law, considered an utility in the U.S. Should that make a difference? I think, logically, no. If the government cannot, without a warrant, implement side-channel attacks like the one listed above, then it definitely shouldn’t be allowed to actually actively exploit a device that’s simply making use of some utility, even a digital one. More to the point, no one intends to make their data public, any of it, simply by connecting to the internet. That’s the determination you make when you actually copy that data anywhere, or when you use any web service, including this site. So no, there is no opportunity to review what you want to reveal, because there is no intent to do so in the first place. [1] https://it.slashdot.org/story/09/07/12/0259246/stealing-data-via-electrical-outlet https://it.slashdot.org/story/09/07/12/0259246/stealing-data... [2] http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-keys-through-pcs-noises-old-am-radio-1563396 http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-ke...
- nickpsecurity 10y ago
  Funny you mention water pipes: they are an attack vector that's considered in TEMPEST shielding to block emanation attacks per what a professional told me. It's one of reasons you won't see bathrooms in many TEMPEST computer rooms that are otherwise self-contained. Anything that conducts plus power lines.