3 ms·

> Even that damned Coast Guard can get your 2FA code now. Posting unsourced and absolutely false claims does not help anyone, honestly. I would even consider i

> Even that damned Coast Guard can get your 2FA code now. Posting unsourced and absolutely false claims does not help anyone, honestly. I would even consider it harmful.

danjoc 10y ago
Before Snowden, they liked to call it tin foil hats. https://theintercept.com/2017/01/13/obama-opens-nsas-vast-trove-of-warrantless-data-to-entire-intelligence-community-just-in-time-for-trump/ https://theintercept.com/2017/01/13/obama-opens-nsas-vast-tr... One of those agencies is the Coast Guard. If the message crosses national boundaries, it's fair game. http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data-abroad-is-seen-by-nsa.html http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data... And before you pass through customs, you are considered outside the country. All legal. Checkmate. Fortunately, I've just discovered that the SMS option isn't required on a Google account. Now you just have to remember to remove your travel yubikey from the account before you fly home.
- willstrafach 10y ago
  Please review the post linked from the beginning of the linked The Intercept article, here: https://icontherecord.tumblr.com/post/155766682978/fact-sheet-on-eo-12333-raw-sigint-availability https://icontherecord.tumblr.com/post/155766682978/fact-shee... You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. It seems dishonest to tell people the Coast Guard can use it to compromise SMS 2FA (I'd be far more worried about other countries compromising SMS 2FA in a close-access scenario, using an "IMSI catcher" or similar device to intercept the incoming message).
  - danjoc 10y ago
    >You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. Before Snowden, we were told investigatory powers were "restricted" as well. Then we learned linux journal readers were put on watch lists as extremists, and system administrators are routinely targeted for compromise. The point being, there's no technical reason to stop them from intercepting the 2FA over SMS, so they will. That's been clearly demonstrated by earlier leaks. Those people weren't fired/jailed/etc. They'll just do it again.
    - willstrafach 10y ago
      > Before Snowden, we were told investigatory powers were "restricted" as well. Then we learned linux journal readers were put on watch lists as extremists, and system administrators are routinely targeted for compromise. Again, I'm sorry but none of this is true at all. I could absolutely believe that a journalist misunderstood something they read in a leak and then made such a claim (Happened with most of the Snowden leaks), but that does not make it true. > The point being, there's no technical reason to stop them from intercepting the 2FA over SMS, so they will. That's been clearly demonstrated by earlier leaks. Those people weren't fired/jailed/etc. They'll just do it again. To the contrary. When you say "clearly demonstrated by earlier leaks" I believe you may be mixing up an inquiry made to NSA with regards to improper access to DNI (Or perhaps that was not supposed to be a public response and was indeed leaked? Not certain). Action was taken against these individuals who "tested the system" by trying to look up themselves and/or someone they knew, even if the system blocked the query from actually running due to the fact that they were prevented from targeting US persons. I believe you are being genuine about your concerns, but again, it can be harmful to spread falsehoods when people reading these comments may not know better and could believe what you're saying to be true (Especially in a thread like this).
      - danjoc 10y ago
        >Again, I'm sorry but none of this is true at all. http://www.linuxjournal.com/content/are-you-extremist http://www.linuxjournal.com/content/are-you-extremist It's you against the world here. Trying to rewrite history? >I could absolutely believe that a journalist misunderstood something they read in a leak Literally, the document title is "I hunt sys admins" https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://theintercept.com/2014/03/20/inside-nsa-secret-effort... There's nothing to misunderstand. They used automated attacks on readers of Slashdot and LinkedIn. http://www.ibtimes.com/edward-snowden-reveals-quantum-insert-nsa-gchq-used-fake-linkedin-slashdot-pages-install-spyware http://www.ibtimes.com/edward-snowden-reveals-quantum-insert... Compromising system admins is a routine part of their job. It's one way they collect private keys to decrypt internet traffic. That is an established fact from the Snowden leaks.

> Even that damned Coast Guard can get your 2FA code now. Posting unsourced and absolutely false claims does not help anyone, honestly. I would even consider it harmful.

danjoc 10y ago

Before Snowden, they liked to call it tin foil hats. https://theintercept.com/2017/01/13/obama-opens-nsas-vast-trove-of-warrantless-data-to-entire-intelligence-community-just-in-time-for-trump/ https://theintercept.com/2017/01/13/obama-opens-nsas-vast-tr... One of those agencies is the Coast Guard. If the message crosses national boundaries, it's fair game. http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data-abroad-is-seen-by-nsa.html http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data... And before you pass through customs, you are considered outside the country. All legal. Checkmate. Fortunately, I've just discovered that the SMS option isn't required on a Google account. Now you just have to remember to remove your travel yubikey from the account before you fly home.

willstrafach 10y ago
Please review the post linked from the beginning of the linked The Intercept article, here: https://icontherecord.tumblr.com/post/155766682978/fact-sheet-on-eo-12333-raw-sigint-availability https://icontherecord.tumblr.com/post/155766682978/fact-shee... You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. It seems dishonest to tell people the Coast Guard can use it to compromise SMS 2FA (I'd be far more worried about other countries compromising SMS 2FA in a close-access scenario, using an "IMSI catcher" or similar device to intercept the incoming message).
- danjoc 10y ago
  >You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. Before Snowden, we were told investigatory powers were "restricted" as well. Then we learned linux journal readers were put on watch lists as extremists, and system administrators are routinely targeted for compromise. The point being, there's no technical reason to stop them from intercepting the 2FA over SMS, so they will. That's been clearly demonstrated by earlier leaks. Those people weren't fired/jailed/etc. They'll just do it again.
  - willstrafach 10y ago
    > Before Snowden, we were told investigatory powers were "restricted" as well. Then we learned linux journal readers were put on watch lists as extremists, and system administrators are routinely targeted for compromise. Again, I'm sorry but none of this is true at all. I could absolutely believe that a journalist misunderstood something they read in a leak and then made such a claim (Happened with most of the Snowden leaks), but that does not make it true. > The point being, there's no technical reason to stop them from intercepting the 2FA over SMS, so they will. That's been clearly demonstrated by earlier leaks. Those people weren't fired/jailed/etc. They'll just do it again. To the contrary. When you say "clearly demonstrated by earlier leaks" I believe you may be mixing up an inquiry made to NSA with regards to improper access to DNI (Or perhaps that was not supposed to be a public response and was indeed leaked? Not certain). Action was taken against these individuals who "tested the system" by trying to look up themselves and/or someone they knew, even if the system blocked the query from actually running due to the fact that they were prevented from targeting US persons. I believe you are being genuine about your concerns, but again, it can be harmful to spread falsehoods when people reading these comments may not know better and could believe what you're saying to be true (Especially in a thread like this).
    - danjoc 10y ago
      >Again, I'm sorry but none of this is true at all. http://www.linuxjournal.com/content/are-you-extremist http://www.linuxjournal.com/content/are-you-extremist It's you against the world here. Trying to rewrite history? >I could absolutely believe that a journalist misunderstood something they read in a leak Literally, the document title is "I hunt sys admins" https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://theintercept.com/2014/03/20/inside-nsa-secret-effort... There's nothing to misunderstand. They used automated attacks on readers of Slashdot and LinkedIn. http://www.ibtimes.com/edward-snowden-reveals-quantum-insert-nsa-gchq-used-fake-linkedin-slashdot-pages-install-spyware http://www.ibtimes.com/edward-snowden-reveals-quantum-insert... Compromising system admins is a routine part of their job. It's one way they collect private keys to decrypt internet traffic. That is an established fact from the Snowden leaks.