7 ms·

I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggeste

I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. I'm sure there's a few journalists out there that take cybersecurity seriously, but I'd wager the vast majority are pretty trivially monitored.

xenocratus 5y ago
But it also depends on what kind of journalism they're doing, right? Not all report on criminal activity, or on investigating the government. It's kinda like threat-models, no need to be super secure if your work brings no risks to you, your organisation, or those you come in contact with.
- jdavis703 5y ago
  Journalists from celebrity gossip reporters to foreign affairs correspondents needs to take security seriously. Even gossip journalists receive information from sources that ranges from information that would get the source fired or blacklisted to put in jail (e.g. LA sheriffs leaking celebrity photos).
  - certnlyuncertn 5y ago
    How likely is it that people are exploiting zero days against reporters in any of those examples though. That's why threat models are different for different types of journalism.
    - reader_mode 5y ago
      Does it take a zero day when you install random freeware crapware from the store ?
- c7DJTLrn 5y ago
  Agreed. The parent comment makes a ridiculous extrapolation.
- newman8r 5y ago
  That's a fair point, although bad actors will also wait around for years for your work to become more interesting/relevant, if they think there's a chance of it.
- wolverine876 5y ago
  Anything that will change a stock price is enormously valuable, for example.
- Hamuko 5y ago
  You can get to the criminal activity or government investigation journalists through the more "trivial" journalists if they work in the same company.
swiley 5y ago
Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.
- cunthorpe 5y ago
  To be fair it's probably the most secure environment for the average Joe, you're just saying that it's not perfectly secure, which would be impossible in this world.
  - swiley 5y ago
    You could do far better than iOS. Worse though is that it encourages very poor infosec because when it's profitable for Apple and often makes doing things correctly difficult or impossible.
    - LucidLynx 5y ago
      I suppose you have examples to propose?
      - swiley 5y ago
        It makes checking the hygiene of apps you use impossible, building them from source artificially difficult and expensive and pushes users towards services with serious flaws like icloud backup.
        jonfw 5y ago
        > average joe > building them from source An average joe doesn't even know what 'build from source' means
        ajari 5y ago
        We could have taught people such things, but there’s no profit in that. We want to maximize the number of people using our devices and our software, so that we get richer, even if it means putting some fraction of these users in grave danger. That’s simply negligence. That it’s distributed across an entire industry doesn’t change the ethics. Selling people tools that put them at risk is much different than sharing foss.
pratheekrebala 5y ago
I see your point, however, having worked in newsrooms - it really is about their beat and their threat-model. My organization covers a wide range of beats and folks covering national security or other sensitive topics have an entirely different workflow compared to those covering, e.g. housing. I think being responsive to their needs and building trust will go much further. Also, designing a one-size fits all model will just mean that your reporters will either ignore the guidance or find a way to work around it. For instance, the most recent credible threat we have had against one of our reporters wasn't a state-level actor, but rather folks on the internet (trivially) finding their address and doxing/harassing them and their family. No amount of technology hygiene will change the fact that voter registrations are public records.
- wolverine876 5y ago
  If someone gets access to the housing reporter's systems, that seems a great way to move horizontally or vertically to get access to the other reporter or to the entire organization. I don't envy your challenge. Security must make it more expensive to the attacker than it's worth. Even the housing reporter's data could be highly valuable; with inside knowledge, someone could make a killing on real estate. The value of the national security beat information is astronomical. I don't grasp why, with all the news about breaches, reporters still don't care.
- 3pt14159 5y ago
  Well, she wrote about scary stuff. Murderers, etc. Feature stories for one of the few fact checked Canadian magazines left. Some stuff in The Atlantic about politics. Was she getting leaks from NSA staffers? No. But it does feel kinda silly to me that journalists, generally speaking, have insecure setups by default. But I get it, it's a hard industry to squeeze a living out of these days.
- atatatat 5y ago
  Not giving the voting record your address of residence sounds like a low tech solution.
jdavis703 5y ago
I did help desk support at a news agency. We were constantly cleaning up malware from journalists computers... The journalists were constantly downloading all sorts of sketchy files as part of their job. Basically, if you're leaking state secrets / embarrassing repressive governments, don't leave a digital trail that can be traced back to you. Just assume everyone (especially journalists on national security or human rights beats) have been hacked.
- pratheekrebala 5y ago
  Yes! In our newsroom (which isn't perfect by any means) - I have been testing using Qubes for really sensitive/untrusted documents. We also open un-trusted documents (from e.g. FOIA responses) on a machine live-booting from a CD. However, it adds enough friction (especially with remote work) that it's hard to get it right 100% of the time. If you want to share really sensitive documents, one way to ensure proper handling of your documents is to use a service like SecureDrop [0] which for e.g. only accepts submissions over Tor and requires the use of a secure viewing station [1] (air-gapped machine live-booting Tails w coreboot rom + webcam/networking card physically removed) to decrypt/access leaks. That being said, I don't think there's a perfect tech-only solution because nothing is stopping folks handling it carelessly after they access the file. [0] https://securedrop.org/directory/center-public-integrity/ https://securedrop.org/directory/center-public-integrity/ [1] https://docs.securedrop.org/en/stable/set_up_svs.html https://docs.securedrop.org/en/stable/set_up_svs.html
  - ip_addr 5y ago
    You could also use Dangerzone [0]. It opens a document in two docker containers and converts it into a safe version. It was created by the director of infosec at The Intercept. [0] https://dangerzone.rocks/ https://dangerzone.rocks/
heavyset_go 5y ago
> I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. Sounds like she dodged a potential honeypot and surveillance attempt.

xenocratus 5y ago

But it also depends on what kind of journalism they're doing, right? Not all report on criminal activity, or on investigating the government. It's kinda like threat-models, no need to be super secure if your work brings no risks to you, your organisation, or those you come in contact with.

jdavis703 5y ago
Journalists from celebrity gossip reporters to foreign affairs correspondents needs to take security seriously. Even gossip journalists receive information from sources that ranges from information that would get the source fired or blacklisted to put in jail (e.g. LA sheriffs leaking celebrity photos).
- certnlyuncertn 5y ago
  How likely is it that people are exploiting zero days against reporters in any of those examples though. That's why threat models are different for different types of journalism.
  - reader_mode 5y ago
    Does it take a zero day when you install random freeware crapware from the store ?
c7DJTLrn 5y ago
Agreed. The parent comment makes a ridiculous extrapolation.
newman8r 5y ago
That's a fair point, although bad actors will also wait around for years for your work to become more interesting/relevant, if they think there's a chance of it.
wolverine876 5y ago
Anything that will change a stock price is enormously valuable, for example.
Hamuko 5y ago
You can get to the criminal activity or government investigation journalists through the more "trivial" journalists if they work in the same company.

swiley 5y ago

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

cunthorpe 5y ago
To be fair it's probably the most secure environment for the average Joe, you're just saying that it's not perfectly secure, which would be impossible in this world.
- swiley 5y ago
  You could do far better than iOS. Worse though is that it encourages very poor infosec because when it's profitable for Apple and often makes doing things correctly difficult or impossible.
  - LucidLynx 5y ago
    I suppose you have examples to propose?
    - swiley 5y ago
      It makes checking the hygiene of apps you use impossible, building them from source artificially difficult and expensive and pushes users towards services with serious flaws like icloud backup.
      - jonfw 5y ago
        > average joe > building them from source An average joe doesn't even know what 'build from source' means
        ajari 5y ago
        We could have taught people such things, but there’s no profit in that. We want to maximize the number of people using our devices and our software, so that we get richer, even if it means putting some fraction of these users in grave danger. That’s simply negligence. That it’s distributed across an entire industry doesn’t change the ethics. Selling people tools that put them at risk is much different than sharing foss.

pratheekrebala 5y ago

I see your point, however, having worked in newsrooms - it really is about their beat and their threat-model. My organization covers a wide range of beats and folks covering national security or other sensitive topics have an entirely different workflow compared to those covering, e.g. housing. I think being responsive to their needs and building trust will go much further. Also, designing a one-size fits all model will just mean that your reporters will either ignore the guidance or find a way to work around it. For instance, the most recent credible threat we have had against one of our reporters wasn't a state-level actor, but rather folks on the internet (trivially) finding their address and doxing/harassing them and their family. No amount of technology hygiene will change the fact that voter registrations are public records.

wolverine876 5y ago
If someone gets access to the housing reporter's systems, that seems a great way to move horizontally or vertically to get access to the other reporter or to the entire organization. I don't envy your challenge. Security must make it more expensive to the attacker than it's worth. Even the housing reporter's data could be highly valuable; with inside knowledge, someone could make a killing on real estate. The value of the national security beat information is astronomical. I don't grasp why, with all the news about breaches, reporters still don't care.
3pt14159 5y ago
Well, she wrote about scary stuff. Murderers, etc. Feature stories for one of the few fact checked Canadian magazines left. Some stuff in The Atlantic about politics. Was she getting leaks from NSA staffers? No. But it does feel kinda silly to me that journalists, generally speaking, have insecure setups by default. But I get it, it's a hard industry to squeeze a living out of these days.
atatatat 5y ago
Not giving the voting record your address of residence sounds like a low tech solution.

jdavis703 5y ago

I did help desk support at a news agency. We were constantly cleaning up malware from journalists computers... The journalists were constantly downloading all sorts of sketchy files as part of their job. Basically, if you're leaking state secrets / embarrassing repressive governments, don't leave a digital trail that can be traced back to you. Just assume everyone (especially journalists on national security or human rights beats) have been hacked.

pratheekrebala 5y ago
Yes! In our newsroom (which isn't perfect by any means) - I have been testing using Qubes for really sensitive/untrusted documents. We also open un-trusted documents (from e.g. FOIA responses) on a machine live-booting from a CD. However, it adds enough friction (especially with remote work) that it's hard to get it right 100% of the time. If you want to share really sensitive documents, one way to ensure proper handling of your documents is to use a service like SecureDrop [0] which for e.g. only accepts submissions over Tor and requires the use of a secure viewing station [1] (air-gapped machine live-booting Tails w coreboot rom + webcam/networking card physically removed) to decrypt/access leaks. That being said, I don't think there's a perfect tech-only solution because nothing is stopping folks handling it carelessly after they access the file. [0] https://securedrop.org/directory/center-public-integrity/ https://securedrop.org/directory/center-public-integrity/ [1] https://docs.securedrop.org/en/stable/set_up_svs.html https://docs.securedrop.org/en/stable/set_up_svs.html
- ip_addr 5y ago
  You could also use Dangerzone [0]. It opens a document in two docker containers and converts it into a safe version. It was created by the director of infosec at The Intercept. [0] https://dangerzone.rocks/ https://dangerzone.rocks/

heavyset_go 5y ago

> I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. Sounds like she dodged a potential honeypot and surveillance attempt.