10 ms·

This makes you give second thoughts when you see privacy and security services(i.e email, vpn) making a big deal they are based in Switzerland. The truth is tha

This makes you give second thoughts when you see privacy and security services(i.e email, vpn) making a big deal they are based in Switzerland. The truth is that you cannot trust a 3rd party with your data. A zero trust mode is the only one that you should trust.

hkon 6y ago
Not only that, but any service advertising their security and privacy. You can't really know unless you roll your own. But what kind of rabbithole that could be is insane, iirc even consumer hardware is compromised to some extent.
milofeynman 6y ago
It's why a lot of people had pause with the new owners of PIA, iirc
lucb1e 6y ago
Zero trust, so... what about the chips in your system? What about the certificate authorities that Microsoft, Mozilla, Apple, or Google deliver to your system? It's a nice thing to say but it doesn't work, at least not as a oneliner without further explanation of how you think this could work.
- vaccinator 6y ago
  zero trust means no computer devices around you... (including TVs, toasters, etc...)
  - machinelabo 6y ago
    You trust your can of baked beans? The entire society runs on the concept of trust. At some point, you're gonna have to trust someone.
    - hutzlibu 6y ago
      True. But I like to reinforce my trust with open and verifiable information. Meaning, I would prefer the can of baked beans from a company that is open about where their beans come from and in what conditions. That would be possible today, and is already done to some extend but in early stages. But getting your food from the local farmer, where you can actually visit the farm, it is much more easy to trust that it is good. And regarding software, well - open source, preferably with a open community (or company) around it, where you can at least look through the actual dev logs and git submits to see if they sound solid and if you have the time and skills, jump into it to verify that they do as promised. Then I can have trust. Otherwise the trust would have to be blind. And society has spoiled that for me, for various reasons.
      - machinelabo 6y ago
        Huh? That's why we have regulations. Every country has one, in the US it is the FDA. Please don't try to shoehorn open source principles everywhere in life. It becomes a chore and a burden for a common citizen to verify the hazards of Baked Beans. Citizens offload this to a regulatory agency. You don't have the time to verify a fucking can of baked beans like a million other things in life. If you buy a measuring tape, do you ask for a NIST certificate? Where does the chain of trust end? Somewhere at the measurement standards in the pyramid of trust. Your personal role in this chain ends at the brand name "STANLEY", because you trust them to make a measuring tape that measures within specified tolerance. The whole movement around "I don't trust unless the information is freely available" is a pipe dream. It grinds the society to a halt. I urge you to look around 99% things in life that you just blindly trust. We need better mechanisms for building trust than "Don't trust unless verified". It is applicable in high risk situations, but the society pays a huge price for such an inefficient way to live.
        hutzlibu 6y ago
        How do you know what things I trust blindly? But I agree, it is not efficient to question everything. I do not want to question everything! But I do know enough, to question a lot of things. Secrecy just allows bad things to stay hidden. If the default would be openness, then people who do bad things would hesitate more, as it would be easier to detect those things, don't you think? Whether it be government, food production or software.
- fsflover 6y ago
  > what about the chips in your system? https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
  - mhh__ 6y ago
    RISC-V is just a specification, you could quite happily sneak stuff into the RTL if you beat the right hands with a pipe.
    - fsflover 6y ago
      Precursor’s mainboard was designed for easy inspection as well, and even its LCD and keyboard were chosen specifically because they facilitate verification of proper construction with minimal equipment
      - mhh__ 6y ago
        You still have to trust both the verification procedure and the specification i.e. Given how a modern CPU has to have features to manage itself, it's relatively trivial to design a system to do what VW did and recognize when the device is under test. For example, if you've seen Christopher Domas's talk/s on finding undocumented features of CPUs, any backdoors in a modern CPU will be buried deep in the vendor-specific features or require an extremely esoteric combination of register values and the like.
        bobthebuilders 6y ago
        The CPU architecture is open source for one, and the boards are designed in such a way as to make outside verification easier. Excited to get my hands on one!
        mhh__ 6y ago
        The architecture isn't the chip itself.
        6y ago
- unixhero 6y ago
  Well I often use G5 PowerPC
- matheusmoreira 6y ago
  > what about the chips in your system? We need a way to manufacture our own hardware. Just like we can already write our own software. Currently manufacturing processors costs billions of dollars. Consequently, the power to create computers is centralized in very few hands. They are easy targets for government regulation and compromise. What if we had technology that would let individual users fabricate their own hardware cheaply? That would give the power to create computers to everyone. We would then be able to create chips we could trust. Nobody would be able to interfere.
  - nine_k 6y ago
    There are hundreds if facilities which can produce computer chips, all over the world. The chips would be "old tech", though, e.g. 70 nm or even 120 nm.
  - drivebycomment 6y ago
    Just as it's impossible to build skyscrapers or bridges or ships or cars or pretty much any modern sophisticated structures or machines without specialized equipments and skilled people and organizations - mostly companies, you can't build chips without companies. Modern semiconductor fab are a marvel. It takes amazing concentration of equipments and specialized folks to get a fab working. This "trust no one" is complete BS. A modern human society can not function without some trust.
    - deeringc 6y ago
      And even if you fabricate your own hardware, you're still trusting the open source designs you download from the internet. Being able to audit them is much better than not being able to see them, but it's still very possible to have some incredibly subtle backdoor or vulnerability hiding in plain sight. This happens all the the time in complex systems. There is zero chance that you can design a functioning and useful chip and OS, from scratch without trusting something else along the way. That goes all the way to compilers, toolchains etc... And even if you could, chances are you've created hundreds of accidental security vulnerabilities that can be exploited. Zero trust is a fantasy.
    - deleted 6y ago
dragonelite 6y ago
I just pretty much assume US spy agencies can track everything from all the logs they can gather and have access too. Want to keep a secret keep it in your head. Those so called neutral parties like Switzerland are just US proxies with a good imago that only recently got tarnished.
- matheusmoreira 6y ago
  The US is able to do that now. Humanity as a whole should work to change that. Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. We achieve this by making encryption easy, powerful and ubiquitous. That will take care of their dragnet espionage.
  - sangnoir 6y ago
    > We achieve this by making encryption easy, powerful and ubiquitous Ubiquitous encryption will be pointless if the encryption itself is subverted, like it was for 50 years with the 2 leading Swiss encryption vendors. I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel, and the next-best targets would be "enclaves", then back-dooring the algorithms themselves (or implementations thereof). Remember - their aim isn't to break encryption (which would be simple to spot) - it's to make it easier for them to break, while remaining hard for everyone else.
    - matheusmoreira 6y ago
      > I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel The cryptography community seems to already be aware of this risk. I've read about random number algorithms that mix the results of many randomness sources so that one compromised source cannot compromise the result. > and the next-best targets would be "enclaves" Yeah, we should watch out for this. Secure cryptoprocessors are a great thing but we need to be able to trust them. We already have hardware that runs free software but the chip itself can of course be compromised... > then back-dooring the algorithms themselves I trust that the worldwide cryptography community will never let that happen. From what I've read they no longer trust the NSA implicitly.
kebman 6y ago
This is the trust level on some embassies around the world. Special typewriters and no computers, in a soundproof room.
- dredmorbius 6y ago
  Bugged Selectrics: https://www.cryptomuseum.com/covert/bugs/selectric/ https://www.cryptomuseum.com/covert/bugs/selectric/ https://spectrum.ieee.org/tech-history/silicon-revolution/the-crazy-story-of-how-soviet-russia-bugged-an-american-embassys-typewriters https://spectrum.ieee.org/tech-history/silicon-revolution/th...
vmception 6y ago
Email and VPN is the most obvious even without this “proof” Will otherwise intelligent people want to fight tooth and nail if I mentioned any specific VPN provider being incapable having privacy assurances you can rely on? Of course so lets do it anyway Protonmail NordVPN ExpressVPN every one It doesnt matter what you want to believe, the entire concept doesnt do what people think it does. You would simply have no way of knowing if a VPN suddenly did start keeping logs.
- gruez 6y ago
  >Will otherwise intelligent people want to fight tooth and nail if I mentioned any specific VPN provider being incapable having privacy assurances you can rely on? I agree if your threat model requires that nobody eavesdrop/log your traffic, then a commercial VPN service probably isn't the right tool, and you should probably use tor instead. That said, it doesn't mean commercial VPNs are placebo/snakeoil. They still provide: * anonymity from the websites you visit: your home internet connection's IP typically uniquely identifies you/your household (assuming no CGNAT). Meanwhile, a VPN server might be used by tens of hundreds of people, which greatly increases your anonymity set. It's further improved if you rotate VPN servers, because a VPN service might be used by millions of people. * extra degree of separation: your ISP knows a lot of info about you (name, address, payment info, maybe even credit score), whereas a VPN service might only know your email and the ip you connect from. If your VPN service decides to go rogue and sell your browsing habits, they'll have a much harder time associating it with your real life identity.
  - vmception 6y ago
    correct and those are valid use cases anything that requires a government not knowing is outside of the use case
- ampdepolymerase 6y ago
  Don't forget HN's favorite, Mullvad. Hey if Mozilla trusts them, it must totally mean they are not compromised by the government right?
CleanMirage 6y ago
Zero trust mode is also the only way to keep secrets in real life. Share it with someone - friend or relative - & sooner or later it always gets out most of the time as relationships/priorities change.
LeonB 6y ago
It’s much cheaper for society to be just generally quite trusting, and then shoot any spies it finds.
matheusmoreira 6y ago
No private company can be trusted with anything related to encryption. They are either already in bed with the government or can be coerced by force, and that's assuming they aren't themselves interested in people's data.
upofadown 6y ago
I think the big deal they are making is that Switzerland has reasonably good privacy laws, not that Swiss people are somehow more resistant to subversion by national intelligence agencies. It's a fundamentally different thing. People avoiding entities that consider themselves above national laws have the advantage that they don't have to care about privacy laws either.
- schoen 6y ago
  The other big thing is the Swiss neutrality policy https://en.wikipedia.org/wiki/Swiss_neutrality https://en.wikipedia.org/wiki/Swiss_neutrality which has also contributed to diplomatic meetings often being held there, treaties often being negotiated there, and headquarters or offices of international and intergovernmental organizations often being based there. Just in Geneva you have https://en.wikipedia.org/wiki/Geneva#International_organisations https://en.wikipedia.org/wiki/Geneva#International_organisat... and that doesn't include all the treaties, one-off diplomatic conferences and meetings, or confidential diplomatic interactions. The Swiss neutrality policy would seem to imply that you would be safer overall meeting there or that you could trust the government not to have an alliance which would mean it was helping some other country undermine your activities in Switzerland. So this reporting on Crypto AG as well as this company can be seen as a criticism that the Swiss government failed to uphold its principles of neutrality, or perhaps (depending on the degree to which the government was involved or aware or not) that the companies were getting a benefit from the international perception of the famous Swiss neutrality while themselves having political dealings with particular governments. I think Snowden also mentions in his autobiography that, because there is so much international activity and discussion in Switzerland, other countries' spy agencies also like to spy on Switzerland and goings-on there -- including him when he was working for the CIA. People who are trying to rely on Switzerland's neutrality might hope that Switzerland succeeds in deterring much of that spying activity, and at least doesn't participate in, condone, or encourage it.
  - _trampeltier 6y ago
    A couple of years ago, there was a discussion here in switzerland about the US embassy had antennas on the roof for spying. But of course, the swiss gouverment said, there is nothing. Just first best Link: https://www.20min.ch/story/spionage-verdacht-gegen-die-berner-us-botschaft-731169929693 https://www.20min.ch/story/spionage-verdacht-gegen-die-berne...
caymanjim 6y ago
If hardware is compromised, can you even trust yourself? It's not like you can build your own in any meaningful sense.
astrophysics 6y ago
Makes one wonder about too good to be true services like ProtonMail, ProtonVPN and ProtonDrive. I was so excited about those, but recently I've started wondering whether they are just the continuation of Switzerland taking money to act as a facade for the CIA...
powerapple 6y ago
The question is who do you want to have access to your data. I am fairly confident that the only reason Huawei is such a threat to US national security is that it will lose its power to go through your data. It is far difficult to have Huawei doing something dirty in Europe or US. Store your data with western companies if you are in China, and store your data with Chinese/Russian companies if you are in Europe seems to be the least worse idea to me XD
- est31 6y ago
  If you are a high value target, then "hackers" will get access to your data anyways, and will extort you. Those "hackers" will just speak different accents :).
  - nix23 6y ago
    >will get access to your data anyways No they don't, if you know in the first place that your a "high value target" https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
    - skipnup 6y ago
      Thanks for that information, never heard of data diodes before. Crazy, that such a seemingly simple idea was only realized as recently as 2015.
      - deleted 6y ago
        [deleted]
    - est31 6y ago
      That's my point. Don't just use one of the unprotected services that get unencrypted data. They will use your data for their gains. The goals they use them for will just be different, depending on which country it is.
      - 6y ago
dannyw 6y ago
Specifically calling out ProtonMail here especially after they started basically requesting all new signups through VPNs give their phone number; email; etc and they say it will be "deleted".
stunt 6y ago
Talking sarcastically, perhaps the next time we will hear about Swiss luxury smart watches, since they are often given as a gift to executives and politicians.

hkon 6y ago

Not only that, but any service advertising their security and privacy. You can't really know unless you roll your own. But what kind of rabbithole that could be is insane, iirc even consumer hardware is compromised to some extent.

milofeynman 6y ago

It's why a lot of people had pause with the new owners of PIA, iirc

lucb1e 6y ago

Zero trust, so... what about the chips in your system? What about the certificate authorities that Microsoft, Mozilla, Apple, or Google deliver to your system? It's a nice thing to say but it doesn't work, at least not as a oneliner without further explanation of how you think this could work.

vaccinator 6y ago
zero trust means no computer devices around you... (including TVs, toasters, etc...)
- machinelabo 6y ago
  You trust your can of baked beans? The entire society runs on the concept of trust. At some point, you're gonna have to trust someone.
  - hutzlibu 6y ago
    True. But I like to reinforce my trust with open and verifiable information. Meaning, I would prefer the can of baked beans from a company that is open about where their beans come from and in what conditions. That would be possible today, and is already done to some extend but in early stages. But getting your food from the local farmer, where you can actually visit the farm, it is much more easy to trust that it is good. And regarding software, well - open source, preferably with a open community (or company) around it, where you can at least look through the actual dev logs and git submits to see if they sound solid and if you have the time and skills, jump into it to verify that they do as promised. Then I can have trust. Otherwise the trust would have to be blind. And society has spoiled that for me, for various reasons.
    - machinelabo 6y ago
      Huh? That's why we have regulations. Every country has one, in the US it is the FDA. Please don't try to shoehorn open source principles everywhere in life. It becomes a chore and a burden for a common citizen to verify the hazards of Baked Beans. Citizens offload this to a regulatory agency. You don't have the time to verify a fucking can of baked beans like a million other things in life. If you buy a measuring tape, do you ask for a NIST certificate? Where does the chain of trust end? Somewhere at the measurement standards in the pyramid of trust. Your personal role in this chain ends at the brand name "STANLEY", because you trust them to make a measuring tape that measures within specified tolerance. The whole movement around "I don't trust unless the information is freely available" is a pipe dream. It grinds the society to a halt. I urge you to look around 99% things in life that you just blindly trust. We need better mechanisms for building trust than "Don't trust unless verified". It is applicable in high risk situations, but the society pays a huge price for such an inefficient way to live.
      - hutzlibu 6y ago
        How do you know what things I trust blindly? But I agree, it is not efficient to question everything. I do not want to question everything! But I do know enough, to question a lot of things. Secrecy just allows bad things to stay hidden. If the default would be openness, then people who do bad things would hesitate more, as it would be easier to detect those things, don't you think? Whether it be government, food production or software.
fsflover 6y ago
> what about the chips in your system? https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
- mhh__ 6y ago
  RISC-V is just a specification, you could quite happily sneak stuff into the RTL if you beat the right hands with a pipe.
  - fsflover 6y ago
    Precursor’s mainboard was designed for easy inspection as well, and even its LCD and keyboard were chosen specifically because they facilitate verification of proper construction with minimal equipment
    - mhh__ 6y ago
      You still have to trust both the verification procedure and the specification i.e. Given how a modern CPU has to have features to manage itself, it's relatively trivial to design a system to do what VW did and recognize when the device is under test. For example, if you've seen Christopher Domas's talk/s on finding undocumented features of CPUs, any backdoors in a modern CPU will be buried deep in the vendor-specific features or require an extremely esoteric combination of register values and the like.
      - bobthebuilders 6y ago
        The CPU architecture is open source for one, and the boards are designed in such a way as to make outside verification easier. Excited to get my hands on one!
        mhh__ 6y ago
        The architecture isn't the chip itself.
        6y ago
unixhero 6y ago
Well I often use G5 PowerPC
matheusmoreira 6y ago
> what about the chips in your system? We need a way to manufacture our own hardware. Just like we can already write our own software. Currently manufacturing processors costs billions of dollars. Consequently, the power to create computers is centralized in very few hands. They are easy targets for government regulation and compromise. What if we had technology that would let individual users fabricate their own hardware cheaply? That would give the power to create computers to everyone. We would then be able to create chips we could trust. Nobody would be able to interfere.
- nine_k 6y ago
  There are hundreds if facilities which can produce computer chips, all over the world. The chips would be "old tech", though, e.g. 70 nm or even 120 nm.
- drivebycomment 6y ago
  Just as it's impossible to build skyscrapers or bridges or ships or cars or pretty much any modern sophisticated structures or machines without specialized equipments and skilled people and organizations - mostly companies, you can't build chips without companies. Modern semiconductor fab are a marvel. It takes amazing concentration of equipments and specialized folks to get a fab working. This "trust no one" is complete BS. A modern human society can not function without some trust.
  - deeringc 6y ago
    And even if you fabricate your own hardware, you're still trusting the open source designs you download from the internet. Being able to audit them is much better than not being able to see them, but it's still very possible to have some incredibly subtle backdoor or vulnerability hiding in plain sight. This happens all the the time in complex systems. There is zero chance that you can design a functioning and useful chip and OS, from scratch without trusting something else along the way. That goes all the way to compilers, toolchains etc... And even if you could, chances are you've created hundreds of accidental security vulnerabilities that can be exploited. Zero trust is a fantasy.
  - deleted 6y ago

dragonelite 6y ago

I just pretty much assume US spy agencies can track everything from all the logs they can gather and have access too. Want to keep a secret keep it in your head. Those so called neutral parties like Switzerland are just US proxies with a good imago that only recently got tarnished.

matheusmoreira 6y ago
The US is able to do that now. Humanity as a whole should work to change that. Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. We achieve this by making encryption easy, powerful and ubiquitous. That will take care of their dragnet espionage.
- sangnoir 6y ago
  > We achieve this by making encryption easy, powerful and ubiquitous Ubiquitous encryption will be pointless if the encryption itself is subverted, like it was for 50 years with the 2 leading Swiss encryption vendors. I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel, and the next-best targets would be "enclaves", then back-dooring the algorithms themselves (or implementations thereof). Remember - their aim isn't to break encryption (which would be simple to spot) - it's to make it easier for them to break, while remaining hard for everyone else.
  - matheusmoreira 6y ago
    > I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel The cryptography community seems to already be aware of this risk. I've read about random number algorithms that mix the results of many randomness sources so that one compromised source cannot compromise the result. > and the next-best targets would be "enclaves" Yeah, we should watch out for this. Secure cryptoprocessors are a great thing but we need to be able to trust them. We already have hardware that runs free software but the chip itself can of course be compromised... > then back-dooring the algorithms themselves I trust that the worldwide cryptography community will never let that happen. From what I've read they no longer trust the NSA implicitly.

kebman 6y ago

This is the trust level on some embassies around the world. Special typewriters and no computers, in a soundproof room.

dredmorbius 6y ago
Bugged Selectrics: https://www.cryptomuseum.com/covert/bugs/selectric/ https://www.cryptomuseum.com/covert/bugs/selectric/ https://spectrum.ieee.org/tech-history/silicon-revolution/the-crazy-story-of-how-soviet-russia-bugged-an-american-embassys-typewriters https://spectrum.ieee.org/tech-history/silicon-revolution/th...

vmception 6y ago

Email and VPN is the most obvious even without this “proof” Will otherwise intelligent people want to fight tooth and nail if I mentioned any specific VPN provider being incapable having privacy assurances you can rely on? Of course so lets do it anyway Protonmail NordVPN ExpressVPN every one It doesnt matter what you want to believe, the entire concept doesnt do what people think it does. You would simply have no way of knowing if a VPN suddenly did start keeping logs.

gruez 6y ago
>Will otherwise intelligent people want to fight tooth and nail if I mentioned any specific VPN provider being incapable having privacy assurances you can rely on? I agree if your threat model requires that nobody eavesdrop/log your traffic, then a commercial VPN service probably isn't the right tool, and you should probably use tor instead. That said, it doesn't mean commercial VPNs are placebo/snakeoil. They still provide: * anonymity from the websites you visit: your home internet connection's IP typically uniquely identifies you/your household (assuming no CGNAT). Meanwhile, a VPN server might be used by tens of hundreds of people, which greatly increases your anonymity set. It's further improved if you rotate VPN servers, because a VPN service might be used by millions of people. * extra degree of separation: your ISP knows a lot of info about you (name, address, payment info, maybe even credit score), whereas a VPN service might only know your email and the ip you connect from. If your VPN service decides to go rogue and sell your browsing habits, they'll have a much harder time associating it with your real life identity.
- vmception 6y ago
  correct and those are valid use cases anything that requires a government not knowing is outside of the use case
ampdepolymerase 6y ago
Don't forget HN's favorite, Mullvad. Hey if Mozilla trusts them, it must totally mean they are not compromised by the government right?

CleanMirage 6y ago

Zero trust mode is also the only way to keep secrets in real life. Share it with someone - friend or relative - & sooner or later it always gets out most of the time as relationships/priorities change.

LeonB 6y ago

It’s much cheaper for society to be just generally quite trusting, and then shoot any spies it finds.

matheusmoreira 6y ago

No private company can be trusted with anything related to encryption. They are either already in bed with the government or can be coerced by force, and that's assuming they aren't themselves interested in people's data.

upofadown 6y ago

I think the big deal they are making is that Switzerland has reasonably good privacy laws, not that Swiss people are somehow more resistant to subversion by national intelligence agencies. It's a fundamentally different thing. People avoiding entities that consider themselves above national laws have the advantage that they don't have to care about privacy laws either.

schoen 6y ago
The other big thing is the Swiss neutrality policy https://en.wikipedia.org/wiki/Swiss_neutrality https://en.wikipedia.org/wiki/Swiss_neutrality which has also contributed to diplomatic meetings often being held there, treaties often being negotiated there, and headquarters or offices of international and intergovernmental organizations often being based there. Just in Geneva you have https://en.wikipedia.org/wiki/Geneva#International_organisations https://en.wikipedia.org/wiki/Geneva#International_organisat... and that doesn't include all the treaties, one-off diplomatic conferences and meetings, or confidential diplomatic interactions. The Swiss neutrality policy would seem to imply that you would be safer overall meeting there or that you could trust the government not to have an alliance which would mean it was helping some other country undermine your activities in Switzerland. So this reporting on Crypto AG as well as this company can be seen as a criticism that the Swiss government failed to uphold its principles of neutrality, or perhaps (depending on the degree to which the government was involved or aware or not) that the companies were getting a benefit from the international perception of the famous Swiss neutrality while themselves having political dealings with particular governments. I think Snowden also mentions in his autobiography that, because there is so much international activity and discussion in Switzerland, other countries' spy agencies also like to spy on Switzerland and goings-on there -- including him when he was working for the CIA. People who are trying to rely on Switzerland's neutrality might hope that Switzerland succeeds in deterring much of that spying activity, and at least doesn't participate in, condone, or encourage it.
- _trampeltier 6y ago
  A couple of years ago, there was a discussion here in switzerland about the US embassy had antennas on the roof for spying. But of course, the swiss gouverment said, there is nothing. Just first best Link: https://www.20min.ch/story/spionage-verdacht-gegen-die-berner-us-botschaft-731169929693 https://www.20min.ch/story/spionage-verdacht-gegen-die-berne...

caymanjim 6y ago

If hardware is compromised, can you even trust yourself? It's not like you can build your own in any meaningful sense.

astrophysics 6y ago

Makes one wonder about too good to be true services like ProtonMail, ProtonVPN and ProtonDrive. I was so excited about those, but recently I've started wondering whether they are just the continuation of Switzerland taking money to act as a facade for the CIA...

powerapple 6y ago

The question is who do you want to have access to your data. I am fairly confident that the only reason Huawei is such a threat to US national security is that it will lose its power to go through your data. It is far difficult to have Huawei doing something dirty in Europe or US. Store your data with western companies if you are in China, and store your data with Chinese/Russian companies if you are in Europe seems to be the least worse idea to me XD

est31 6y ago
If you are a high value target, then "hackers" will get access to your data anyways, and will extort you. Those "hackers" will just speak different accents :).
- nix23 6y ago
  >will get access to your data anyways No they don't, if you know in the first place that your a "high value target" https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
  - skipnup 6y ago
    Thanks for that information, never heard of data diodes before. Crazy, that such a seemingly simple idea was only realized as recently as 2015.
    - deleted 6y ago
      [deleted]
  - est31 6y ago
    That's my point. Don't just use one of the unprotected services that get unencrypted data. They will use your data for their gains. The goals they use them for will just be different, depending on which country it is.
    - 6y ago

dannyw 6y ago

Specifically calling out ProtonMail here especially after they started basically requesting all new signups through VPNs give their phone number; email; etc and they say it will be "deleted".

stunt 6y ago

Talking sarcastically, perhaps the next time we will hear about Swiss luxury smart watches, since they are often given as a gift to executives and politicians.