3 ms·

You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer,

by kurthr 6y ago

You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out. On the other hand it's all sitting right there at the NSA et al. Your other attacks are similarly focused on individuals, although the credit and health agencies are prime surfaces for data mining, you're not going to get the metadata/connectivity needed. I'm interested to know what you're proposing, but I suspect you simply misunderstood what I meant, and perhaps what your (and everyone else's) file at the TLAs looks like. It's a mighty plump target, and not comparably secure.

ardy42 6y ago
>>> Why spy on your own citizens when that makes them blackmail-able by foreign nation states? >>> Seriously, the quickest, cheapest, easiest way to spy on someone in the US (or any 5 eyes) is through our own "security" agencies > You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out. You're moving the goalposts: before your ninja edit, you were only talking about the easiest way to spy on someone, not everyone. If you phish someone, you can get the content. Why settle for just metadata? And what good is metadata for your blackmail use-case? The difference between metadata and content is the difference between knowing you communicate with your coworker and knowing you're cheating on your wife with her. Only one of those things is useful to a blackmailer. Also, what exactly is a foreign power's use case for targeting everyone in the US, or being really interested mainly in metadata, when their goals mean they're mainly really interested in specific people and organizations and the content or systems they have access to?
- kurthr 6y ago
  As if ninjas wore neon... phishing and attacking a national database of compromises aren't opposite or even orthogonal they're a component. Not realizing that is scary. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html https://www.washingtonpost.com/national-security/russian-gov...
tru3_power 6y ago
Phishing provides a great avenue for escalation type attacks (both lateral and vertical). Might not give you what you’re looking for right then but it gives you a foot in the door.

by kurthr 6y ago

ardy42 6y ago

>>> Why spy on your own citizens when that makes them blackmail-able by foreign nation states? >>> Seriously, the quickest, cheapest, easiest way to spy on someone in the US (or any 5 eyes) is through our own "security" agencies > You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out. You're moving the goalposts: before your ninja edit, you were only talking about the easiest way to spy on someone, not everyone. If you phish someone, you can get the content. Why settle for just metadata? And what good is metadata for your blackmail use-case? The difference between metadata and content is the difference between knowing you communicate with your coworker and knowing you're cheating on your wife with her. Only one of those things is useful to a blackmailer. Also, what exactly is a foreign power's use case for targeting everyone in the US, or being really interested mainly in metadata, when their goals mean they're mainly really interested in specific people and organizations and the content or systems they have access to?

kurthr 6y ago
As if ninjas wore neon... phishing and attacking a national database of compromises aren't opposite or even orthogonal they're a component. Not realizing that is scary. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html https://www.washingtonpost.com/national-security/russian-gov...

tru3_power 6y ago

Phishing provides a great avenue for escalation type attacks (both lateral and vertical). Might not give you what you’re looking for right then but it gives you a foot in the door.