4 ms·

Invulnerability for your devices is a chimera. You can only do what's possible in your capacity to secure yourself. I am at peace with the fact that I'm doing

by r00fus 5y ago

Invulnerability for your devices is a chimera. You can only do what's possible in your capacity to secure yourself. I am at peace with the fact that I'm doing the best I can and keeping those I love protected.

buddylw 5y ago
Security has always been relative. I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. It keeps them closely guarded and selective about use. All of that makes me an unlikely target and reduces individual risk.
- heavyset_go 5y ago
  > I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. I don't. Look at how much companies like Apple pay out for responsible disclosure if they pay out at all, and then compare it to what exploits go for on the grey/black market. Typically the buyers have deep pockets and burning millions of dollars wouldn't make them blink.
  - dkokelley 5y ago
    Why does it matter if it’s the “good guys” or “bad guys” paying? If a vulnerability only cost ~$100 then a malicious person could compromise an ex lover’s phone, for example. The fact that they are expensive means that their use is limited to targeted, strategic attacks. You don’t have to agree that those attacks are good, but surely pricing the average person out of 0-days is better than the alternative.
    - heavyset_go 5y ago
      > The fact that they are expensive means that their use is limited to targeted, strategic attacks. There are organized crime networks that pull in billions of dollars of revenue a year. If they wanted to pull off dragnet fraud, for example, they have the funds to do so.
    - dylan604 5y ago
      >Why does it matter if it’s the “good guys” or “bad guys” paying? Who do you think are more likely to use the vuln/exploit on regular everyday users? The nation state people are going to use it on targeted persons/groups (typically) while the "bad guys" are going to use it so they get the greatest bang for their buck.
      - Aerroon 5y ago
        Or the nation state uses it against everyone in a dragnet operation? Also, specifically targeted people by nation states often are "regular everyday users". They just happened to draw the ire of the wrong person.
  - madeofpalk 5y ago
    But still, I feel relatively safe knowing/thinking that the Saudi government doesn’t want to hack my iPhone.
    - heavyset_go 5y ago
      Organized crime might, as they orchestrate fraud, blackmail etc networks all over the world.
- gitanovic 5y ago
  It makes me wonder how people like Bill Gates or Jeff Bezos use for their phone security. For sure they are much more interesting targets than I am, therefore burning a few 0-days might be worth the effort.
  - thinkharderdev 5y ago
    Wasn't Bezos phone hacked by the Saudis?
    - gitanovic 5y ago
      oh didn't know that
Aerroon 5y ago
The problem is that we're moving into a more and more digital world where it's not possible to even opt out. Estonia had their ID card photo database hacked.[0] >A hacker was able to obtain over 280,000 personal identity photos following an attack on the state information system last Friday. The suspect is reportedly a resident of Tallinn. >The culprit had already obtained personal names and ID codes and was able to obtain a third component, the photos, by making individual requests from thousands of IP addresses. How do you protect yourself against that when the government requires you to have an ID card and puts you into the database? What happens when financial transaction logs get hacked or medical histories? [0] https://news.err.ee/1608291072/hacker-downloads-close-to-300-000-personal-id-photos https://news.err.ee/1608291072/hacker-downloads-close-to-300...
- SilverRed 5y ago
  Yeah I find it worrying how society only cares about what is technically possible and not what is realistically safe and secure. We could build taller and cheaper buildings if we ignored standards and just accepted that sometimes they fall over. But we don't because that is insanely dangerous. But now with tech the risk is invisible unlike a collapsed bridge. In Australia it is basically impossible to live a normal life without bringing your phone everywhere because they mandate that you scan QR codes before entering stores and the manual written forms are usually hidden behind a counter and on request only.

by r00fus 5y ago

buddylw 5y ago

Security has always been relative. I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. It keeps them closely guarded and selective about use. All of that makes me an unlikely target and reduces individual risk.

heavyset_go 5y ago
> I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. I don't. Look at how much companies like Apple pay out for responsible disclosure if they pay out at all, and then compare it to what exploits go for on the grey/black market. Typically the buyers have deep pockets and burning millions of dollars wouldn't make them blink.
- dkokelley 5y ago
  Why does it matter if it’s the “good guys” or “bad guys” paying? If a vulnerability only cost ~$100 then a malicious person could compromise an ex lover’s phone, for example. The fact that they are expensive means that their use is limited to targeted, strategic attacks. You don’t have to agree that those attacks are good, but surely pricing the average person out of 0-days is better than the alternative.
  - heavyset_go 5y ago
    > The fact that they are expensive means that their use is limited to targeted, strategic attacks. There are organized crime networks that pull in billions of dollars of revenue a year. If they wanted to pull off dragnet fraud, for example, they have the funds to do so.
  - dylan604 5y ago
    >Why does it matter if it’s the “good guys” or “bad guys” paying? Who do you think are more likely to use the vuln/exploit on regular everyday users? The nation state people are going to use it on targeted persons/groups (typically) while the "bad guys" are going to use it so they get the greatest bang for their buck.
    - Aerroon 5y ago
      Or the nation state uses it against everyone in a dragnet operation? Also, specifically targeted people by nation states often are "regular everyday users". They just happened to draw the ire of the wrong person.
- madeofpalk 5y ago
  But still, I feel relatively safe knowing/thinking that the Saudi government doesn’t want to hack my iPhone.
  - heavyset_go 5y ago
    Organized crime might, as they orchestrate fraud, blackmail etc networks all over the world.
gitanovic 5y ago
It makes me wonder how people like Bill Gates or Jeff Bezos use for their phone security. For sure they are much more interesting targets than I am, therefore burning a few 0-days might be worth the effort.
- thinkharderdev 5y ago
  Wasn't Bezos phone hacked by the Saudis?
  - gitanovic 5y ago
    oh didn't know that

Aerroon 5y ago

The problem is that we're moving into a more and more digital world where it's not possible to even opt out. Estonia had their ID card photo database hacked.[0] >A hacker was able to obtain over 280,000 personal identity photos following an attack on the state information system last Friday. The suspect is reportedly a resident of Tallinn. >The culprit had already obtained personal names and ID codes and was able to obtain a third component, the photos, by making individual requests from thousands of IP addresses. How do you protect yourself against that when the government requires you to have an ID card and puts you into the database? What happens when financial transaction logs get hacked or medical histories? [0] https://news.err.ee/1608291072/hacker-downloads-close-to-300-000-personal-id-photos https://news.err.ee/1608291072/hacker-downloads-close-to-300...

SilverRed 5y ago
Yeah I find it worrying how society only cares about what is technically possible and not what is realistically safe and secure. We could build taller and cheaper buildings if we ignored standards and just accepted that sometimes they fall over. But we don't because that is insanely dangerous. But now with tech the risk is invisible unlike a collapsed bridge. In Australia it is basically impossible to live a normal life without bringing your phone everywhere because they mandate that you scan QR codes before entering stores and the manual written forms are usually hidden behind a counter and on request only.