8 ms·

It is pretty impressive, they made a whole company marketing secure phones, except the devices were wiretapped. Aside from that, it sounds like a pretty decent

by bserge 5y ago

It is pretty impressive, they made a whole company marketing secure phones, except the devices were wiretapped. Aside from that, it sounds like a pretty decent secure phone, too. Did they hire one of those TV show genius detectives to plan all this? It sure seems more advanced than the usual FBI operations (or maybe we don't hear much about the good ones).

cronix 5y ago
Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.
- mr-wendel 5y ago
  After that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America. Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
- pxeboot 5y ago
  Didn't Facebook already do this?
- the_other 5y ago
  I already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.
- Enginerrrd 5y ago
  This is why I don't trust VPN companies that advertise.
  - kilroy123 5y ago
    Which ones are good then?
    - imwillofficial 5y ago
      PIA has been tested in court as not keeping your data. Other than that you're placing trust in others, depends on what you wanna keep secret.
      - Tenoke 5y ago
        That's from before it got sold to Kape who has had a horrible track record with VPNs.
        Nullabillity 5y ago
        They're also ran by Andrew Lee/Rasengan, who killed Freenode about a month ago. So, uh, that's great.
    - ipaddr 5y ago
      Depends on what you want it for. To pretend you are in the US for netflix or to evade the fbi. The ones that advertise are good for the first. Rolling your own fixes one issue and raises another.
    - bserge 5y ago
      Your own, purchased using untraceable means (fake ID is the easiest... and likely most illegal).
    - anoncake 5y ago
      If you pay using the right method, Mullvad doesn't know your identity.
      - mrzimmerman 5y ago
        Came here to promote Mullvad as well. Not that they can’t point back to your up address or some such but since you can login to the VPN using a unique identifier instead of an email address and password it’s a pretty decent way to decouple it from your PII.
- disambiguation 5y ago
  plot twist: letsencrypt.org
  - JackGreyhat 5y ago
    I seem to not get the twist. What am I missing?
    - senectus1 5y ago
      I think its an insinuation that letsencrypt is a honeypot.
    - kodah 5y ago
      It's been long rumored that privacy-as-a-product companies are actually three letter agency honey pots. ProtonMail actually has some connections to NSA investment firms and some former NSA staff on their board. There could be good explanations here, and there could be bad explanations, however, we don't know the role each of these components play in the larger sum; we can only guess and speculate. In that way, an ambitious project that gives away certificates that were formerly worth a lot of money would be a pretty slick honeypot because now you could stow away private keys and have a copy of most of the encrypted webs certificates to decrypt in-flight communications.
      - shkkmo 5y ago
        A CA can't steal your private keys, they can issues certs for your domain to themselves regardless of ownership. They could do this even without you as a customer, atleast untill they get caught and have their root certs revoked by tech companies.
      - ronsor 5y ago
        That's not at all how Let's Encrypt or any HTTPS CAs work (or have ever worked). You send them a certificate signing request, and they respond with a signed certificate. You never give them your private key.
- raxxorrax 5y ago
  This is why I mostly recommend a Russian VPN or one in a foreign country. Sure, your data might end up in the hands of Putins mobsters. Do you think they will share the data with your government? Unlikely... And even if a VPN company isn't compromised, there are so many legal loopholes that would allow government to access your data. Kitten on a tree can quickly become a matter of national security.
leetcrew 5y ago
> Did they hire one of those TV show genius detectives to plan all this? maybe lester freamon? this is essentially a more sophisticated version of what he did in season 3 of the wire. nothing new under the sun, I guess.
- jetru 5y ago
  Haha, came here to comment exactly that!
hoppyhoppy2 5y ago
>The F.B.I.’s operation, according to court documents that the Justice Department unsealed on Monday, had its origins in early 2018 after the bureau dismantled a Canadian-based encryption service called Phantom Secure. That company, officials said, supplied encrypted cellphones to drug gangs, like Mexico’s Sinaloa cartel, and other criminal groups. >Seeing a void in the underground market, the F.B.I. recruited a former Phantom Secure distributor who had been developing a new encrypted communications system called Anom. The informant agreed to work for the F.B.I. and let the bureau control the network for the possibility of a reduced prison sentence, according to the court documents. The F.B.I. paid the informant $120,000, the documents said. https://www.nytimes.com/2021/06/08/world/australia/operation-trojan-horse-anom.html https://www.nytimes.com/2021/06/08/world/australia/operation... (from when it was first revealed to the public last month)
- handmodel 5y ago
  to me the most impressive part isn't that they even did this - but that they did so that fast.
  - craftinator 5y ago
    Hope they provide a grant to the numerous open source projects they piggy-backed on.
    - Bilal_io 5y ago
      Someone else commented on here saying the image was based on his open source project. Check it
- BLKNSLVR 5y ago
  I'm interested to read more about Phantom Secure's "dismantling" in the context of both HSBC's slap on the wrist and the FBI starting and running a company that did the exact same thing. Edited to add: It's fairly obvious that Phantom Secure was setup specifically to cater to organised crime communications - it appears the CEO experssly admitted this. I wonder if the company would have been better off marketing to 'security and privacy' conscious individuals, rather than, specifically, drug cartels, leaving the door of plausible deniability open.
rootsudo 5y ago
It makes sense looking back, the phreaking forums were confused as heck about these phones.

by bserge 5y ago

cronix 5y ago

Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.

mr-wendel 5y ago
After that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America. Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
pxeboot 5y ago
Didn't Facebook already do this?
the_other 5y ago
I already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.
Enginerrrd 5y ago
This is why I don't trust VPN companies that advertise.
- kilroy123 5y ago
  Which ones are good then?
  - imwillofficial 5y ago
    PIA has been tested in court as not keeping your data. Other than that you're placing trust in others, depends on what you wanna keep secret.
    - Tenoke 5y ago
      That's from before it got sold to Kape who has had a horrible track record with VPNs.
      - Nullabillity 5y ago
        They're also ran by Andrew Lee/Rasengan, who killed Freenode about a month ago. So, uh, that's great.
  - ipaddr 5y ago
    Depends on what you want it for. To pretend you are in the US for netflix or to evade the fbi. The ones that advertise are good for the first. Rolling your own fixes one issue and raises another.
  - bserge 5y ago
    Your own, purchased using untraceable means (fake ID is the easiest... and likely most illegal).
  - anoncake 5y ago
    If you pay using the right method, Mullvad doesn't know your identity.
    - mrzimmerman 5y ago
      Came here to promote Mullvad as well. Not that they can’t point back to your up address or some such but since you can login to the VPN using a unique identifier instead of an email address and password it’s a pretty decent way to decouple it from your PII.
disambiguation 5y ago
plot twist: letsencrypt.org
- JackGreyhat 5y ago
  I seem to not get the twist. What am I missing?
  - senectus1 5y ago
    I think its an insinuation that letsencrypt is a honeypot.
  - kodah 5y ago
    It's been long rumored that privacy-as-a-product companies are actually three letter agency honey pots. ProtonMail actually has some connections to NSA investment firms and some former NSA staff on their board. There could be good explanations here, and there could be bad explanations, however, we don't know the role each of these components play in the larger sum; we can only guess and speculate. In that way, an ambitious project that gives away certificates that were formerly worth a lot of money would be a pretty slick honeypot because now you could stow away private keys and have a copy of most of the encrypted webs certificates to decrypt in-flight communications.
    - shkkmo 5y ago
      A CA can't steal your private keys, they can issues certs for your domain to themselves regardless of ownership. They could do this even without you as a customer, atleast untill they get caught and have their root certs revoked by tech companies.
    - ronsor 5y ago
      That's not at all how Let's Encrypt or any HTTPS CAs work (or have ever worked). You send them a certificate signing request, and they respond with a signed certificate. You never give them your private key.
raxxorrax 5y ago
This is why I mostly recommend a Russian VPN or one in a foreign country. Sure, your data might end up in the hands of Putins mobsters. Do you think they will share the data with your government? Unlikely... And even if a VPN company isn't compromised, there are so many legal loopholes that would allow government to access your data. Kitten on a tree can quickly become a matter of national security.

leetcrew 5y ago

> Did they hire one of those TV show genius detectives to plan all this? maybe lester freamon? this is essentially a more sophisticated version of what he did in season 3 of the wire. nothing new under the sun, I guess.

jetru 5y ago
Haha, came here to comment exactly that!

hoppyhoppy2 5y ago

>The F.B.I.’s operation, according to court documents that the Justice Department unsealed on Monday, had its origins in early 2018 after the bureau dismantled a Canadian-based encryption service called Phantom Secure. That company, officials said, supplied encrypted cellphones to drug gangs, like Mexico’s Sinaloa cartel, and other criminal groups. >Seeing a void in the underground market, the F.B.I. recruited a former Phantom Secure distributor who had been developing a new encrypted communications system called Anom. The informant agreed to work for the F.B.I. and let the bureau control the network for the possibility of a reduced prison sentence, according to the court documents. The F.B.I. paid the informant $120,000, the documents said. https://www.nytimes.com/2021/06/08/world/australia/operation-trojan-horse-anom.html https://www.nytimes.com/2021/06/08/world/australia/operation... (from when it was first revealed to the public last month)

handmodel 5y ago
to me the most impressive part isn't that they even did this - but that they did so that fast.
- craftinator 5y ago
  Hope they provide a grant to the numerous open source projects they piggy-backed on.
  - Bilal_io 5y ago
    Someone else commented on here saying the image was based on his open source project. Check it
BLKNSLVR 5y ago
I'm interested to read more about Phantom Secure's "dismantling" in the context of both HSBC's slap on the wrist and the FBI starting and running a company that did the exact same thing. Edited to add: It's fairly obvious that Phantom Secure was setup specifically to cater to organised crime communications - it appears the CEO experssly admitted this. I wonder if the company would have been better off marketing to 'security and privacy' conscious individuals, rather than, specifically, drug cartels, leaving the door of plausible deniability open.

rootsudo 5y ago

It makes sense looking back, the phreaking forums were confused as heck about these phones.