10 ms·
So how do we protect our privacy from the advance of technology? It doesn't seem possible. Just going after NSO is useless.
by FridayoLeary 5y ago
So how do we protect our privacy from the advance of technology? It doesn't seem possible. Just going after NSO is useless.
- hyperstar 5y agoRejecting the smartphone might be a start.
- joe_the_user 5y agoI don't think you can escape the use of the smart phone. But treating them as "throw-away", as not your device, etc. I think the original landlines, which were/are a few switches connected to a write on one side and some microphones on the other, were close to inherently insecure. Phones haven't ever been "your device" whereas a laptop might, maybe be rendered trustworthy.
- throwawayay02 5y agoHow can you possibly not escape the use of a smartphone?
- bart_spoon 5y agoPlenty of jobs these days essentially require one, be it for communication, authentication, or what have you.
- hyperstar 5y agoPreferably, don't take those jobs. Or, if you must, tape the cameras and remove the microphone. Use a wired headset for talking and unplug it when not in use. When not on the job, turn it off and wrap it in aluminium foil.
- heavyset_go 5y agoI recently had to file an insurance claim with my car insurer. The entire process happened through their app. They require you to send them pictures that you took using their app. One of my banks has been closing branches left and right, and if I want to use my accounts for anything other than debit purchases, I need to use the app. Some banks even charge you when you go to a branch location in person and use a teller to access your accounts. Some jobs require you to install and use apps on your phone. Last time I was a big box retailer, the floor staff had the company's app installed on their phones so they could do instant price look ups and confirm discounts on their store's inventory. Even just applying for a job requires an internet browser, and many people's only access to the internet is through their phone.
- rangerdan 5y ago> They require you to send them pictures that you took using their app. Nonsense, just tell them you can't do that and will email them. Have a back bone. > I want to use my accounts for anything other than debit purchases, I need to use the app. No, you don't. Use a bank that has a normal web site. > Some jobs require you to install and use apps on your phone. Yikes ... never install work apps on a personal phone. Just don't. > Even just applying for a job requires an internet browser, and many people's only access to the internet is through their phone. So people need phones because people use phones? What nonsense.
- asdff 5y agoPretty much all those things you can do over old channels still. The app is optional. I can do everything my mobile banking website can do over the phone. The last time I filed a claim with my insurer, everything happened via back and forth emailing.
- hyperstar 5y agoI think there should always be physical off-switches for microphones: it should be possible to know that the thing is not listening. But smartphones also have other private information on them than what can be captured by its microphone. I don't think the smartphone is inescapable at all, and I don't think any of the conveniences it offers is worth surrendering one's privacy. But there is a tendency in businesses to ignore the fact that some potential customers do not have smartphones. I wonder if legislation against this might be possible.
- fsflover 5y ago> I think there should always be physical off-switches for microphones There is one smartphone with those: https://puri.sm/products/librem-5 https://puri.sm/products/librem-5. The alternative one, Pinephone, has quite inconvenient kill switches.
- wolverine876 5y agoMany restaurants only provide menus via smartphones. Sporting events only accept electronic tickets. How can you reject it, practically?
- b112 5y agoI have never eaten in such a restaurant and I eat out a lot. Is this really true where you are? No menus?
- lostmsu 5y agoThis is a COVID trend. They still provide physical copy on request.
- can16358p 5y agoThis is the only thing that makes sense. What if your battery is dead? Not having access to the menu would be ridiculous.
- wutbrodo 5y agoNot quite the same thing, but I had to head home early one night recently because my phone had died (which almost never happens to me) so I couldn't show vaccination-proof. I would guess that a person's phone dying while bar-hopping is much more common than dying while dining alone (since when dining with others, you can just look at their menus). You're not wrong that this fundamentally excludes those who don't have (powered-up) smartphones. But it's not like restaurants and bars had the luxury of thinking through and choosing to have these effective new smartphone requirements: they adapted to Covid for their survival, and the odd case who got unlucky with a dead phone is just collateral damage.
- b112 5y agobecause my phone had died (which almost never happens to me) so I couldn't show vaccination-proof. I'm in Canada, and we use QR codes, signed by the government, to show and validate status. Mine is printed out, and in my pocket. No phone is required. Thus, no one needs to avoid anything, phone or not.
- newbamboo 5y agoThis is the only solution, and one with very minimal downside. In fact, within a year society would be so greatly improved, we’d look back in horror at the current state of affairs and wonder how we’d all gone so mad in the first place.
- SavantIdiot 5y agoHope that White Hats publish? The zero-click exploits have to be patched by Apple after they've been exposed. It all depends who finds it and when. Really not much you can do with zero-clicks. Don't be rich or famous I guess? Or don't use smartphones.
- PeterisP 5y agoA proper bug bounty program facilitates that, however, it seems that Apple has mismanaged theirs to the effect that it drives frustrated researchers to not report their findings to Apple. E.g. https://news.ycombinator.com/item?id=28469193 https://news.ycombinator.com/item?id=28469193 and https://news.ycombinator.com/item?id=27564236 https://news.ycombinator.com/item?id=27564236
- OminousWeapons 5y agoIt depends on what your threat model is. If its individuals, local law enforcement, or even national law enforcement (context dependent) you are trying to hide from, you can obtain phones with cash and make it very difficult to link them to you (use a sim card bought with cash and never give out that number, use a VOIP service for your primary number, use an OS that doesn't send back much telemetry, turn off location, never use the phone near your home, etc). If your threat model includes targeted attack by a major intelligence agency, just accept that you are likely screwed.
- FridayoLeary 5y agoWhat will happen when hiding even small illegal activities becomes impossible?
- lifeisstillgood 5y agoThis depends on your threat model (what is illegal, who chooses to prosecute, etc) I was driving home today and the satnav warned us about driving over speed limit (74 mph on UK motorway). Ok. But the solution to that is technology - and organisation. There are speed cameras on this road. But most of the time they don't take images or don't trigger an action. If every road camera triggered a warning / fine on every violation then speeding would stop in a few months. Is that something socially beneficial ? Probably. Would it be disruptive and cause great anger and political resentment? Yes. That is one tiny example but I think that pretty much every criminal act can be detected with technology - it's going to become which one we care enough about to prosecute and which we give up and decriminialise?
- zizee 5y ago> which we give up and decriminialise Or governments will continue to have those laws on the books and prosecute them with discretion (which is what happens today). It is very convenient for those in power when every person is already guilty of something.
- 5y ago
- smoldesu 5y agoYou can't. It's all marketing fluff at this point, because significant enough state actors will see the ~$10,000,000 R&D cost for a few iOS/Android zero-days as a drop in the bucket. We live in a post-security world, where it's economically feasible to develop malware at a pace that outruns Blue Teams. We live in a post-privacy world because Apple and Google happily pass your data back to world governments in the name of stopping terrorism, or whatever the social cause du-jour is. There's no escape really, your only option is to embrace the paranoia and learn to love the cat-and-mouse game, or (what most people choose) give up. Remember, this is the future you voted for when you signed up for Google Drive and bought your iPhone. This is the future you willingly supported with each ad that YouTube showed you on movie night, and the one you opted-into when you noticed you were low on popcorn and got 2-day delivery on kernels from Amazon.
- heavyset_go 5y ago> We live in a post-privacy world because Apple and Google happily pass your data back to world governments in the name of stopping terrorism, or whatever the social cause du-jour is. To illustrate this point, Apple gives up users' data for about 150,000 users/accounts in the US[1] a year in response to government data requests. [1] https://www.apple.com/legal/transparency/us.html https://www.apple.com/legal/transparency/us.html
- girvo 5y agoWhat can a company do when presented with a legal, legitimate warrant? We talk like Apple in this example has a choice to say “no”: they don’t, though.
- heavyset_go 5y agoApple gives up customers' data when presented with simple data requests. Not all of the data they gave up was in response to subpeonas or warrants. Most tech companies have portals for law enforcement to simply ask, without a warrant, for users' data, and the companies often voluntarily share the requested data without any coercion from courts. Yes, Apple is no different than any other tech company in that regard. The difference is that Apple's PR tells you otherwise. The whole San Bernardino shooting case had many people on HN saying that it meant that Apple would refuse to work with law enforcement when law enforcement would ask for users' data, even to the point of challenging subpeonas and warrants in court. That is clearly not the case.
- travoc 5y agoLobby your government to make selling or using cyber vulnerabilities by nations an act of war? Very unlikely give that the US does this as much as anyone. We are all potential victims in this new form of warfare.
- wolverine876 5y ago> So how do we protect our privacy from the advance of technology? It doesn't seem possible. Just going after NSO is useless. Like we do with anything else: These are crimes, but we are stuck in the mindset of the nascent Internet, when it was a growing experiment, a subculture in our society, harmless, and we wanted to nurture it and give it maximum freedom. Those days are long gone. The Internet is completely integral to our society, like a major city (an extraordinarily large one) - in fact, anything not integrated into the Internet is on the fringe, like a business without a website. The idea of a harmless Internet has been antiquated for a long time; it is a serious place of serious money, serious criminals, and serious political actors. Yet we still don't have serious law or law enforcement, not as an oppressive force but in the tradition of free, open societies. It would be like New York or Tokyo without law or law enforcement. We should create in the federal government (not state governments, given the Internet's borderless nature) a major domestic law enforcement agency, on the scale of the FBI, to protect people and enforce laws; I suspect we need a major addition to or revision of our legal code to go with it. That is how we deal with crime in other parts of society; the Internet is no different. We need divisions dealing with theft, fraud, destruction or property, invasions (hacking), etc. It's long past time to stop applying the antiquated notions to the current reality. Why do you accept this Wild West chaos; it no long fuels creativity and growth, it greatly hampers it.
- smoldesu 5y agoNothing bad has ever come from letting the government control more of the internet, right?
- buildbuildbuild 5y agoWhy a new agency? This is already very much within the FBI’s jurisdiction. Why is the international surveillance of U.S. journalists and their sources not visibly a priority? In my opinion it’s a matter of policy. This comes from the top down. Bringing justice to international actors opposing democratic ethics is regrettably less of a priority today than enforcing highly publicized and politicized criminal cases.
- tremon 5y ago
- monopoledance 5y agoLegislation holding companies liable for breaches and leaks, which were in their capabilities to prevent. Simple and fair, scales well. No downsides. Sure, not everything is always their fault, but usually it is and comes with yoloing from the first line of code, shipping alph… proof of concept software, or outsourcing their network’s security to MS Word. If a breach could ruin a company beyond reputation, people may stop storing cleartext credentials or testing merely their app’s UI at best; if a hacker could stop your show, companies may take bug bounty programs serious, and be grateful for disclosures instead of filing reports, when someone edit-and-resend’ed on a web API and accidentally got a copy of their database. Today, a breach has zero consequences. Why would you spend a shitton of money on security, when marketing’s budget isn’t downright ridiculous yet? And of course it would be super helpful, if governments would stop encouraging insecurity by buying e.g. NSO’s products for what they do. Always awkward persecuting someone you depend on… The NSO’s business should be straight illegal, including export/import. Since hacking someone without their consent usually comes with the ability to tamper with evidence, it’s really questionable for law enforcement and straight unethical for anyone else. Just kill the whole sector IMO.
- tyrfing 5y agoBy valuing it. Apple's annual revenue is more than the entire government budget of Saudi Arabia. That's a pretty meaningless comparison, but certainly gives an idea of the scale. There's asymmetry in security, but only one side is trying right now.
- throwawayboise 5y agoSame way the mafia used to do it when they realized all their phones and cars were bugged. No technology. Talk in person, outside. Seriously, if you are a journalist investigating anything that might upset the powers that be in a nation-state, don't use any online technology and for gods sake not a mobile phone.
- mola 5y agoGoing after NSO is far from useless. These guys make 100s of millions, this gives them power to subvert and influence politicians so criminalizing this sort of surveillance will be impossible. Once NSO employees and founders be held responsible for the damage they do and the life they ruin you'll see much less talent go and work there or establish new companies of the same sort.
- Tepix 5y agoSaying you can't be secure at all isn't a solution. https://blog.cryptographyengineering.com/2021/07/20/a-case-against-security-nihilism/ https://blog.cryptographyengineering.com/2021/07/20/a-case-a...