4 ms·

Considering endpoints are compromised like swiss cheese in 2021 and third party apps are all compromised, people should be of the belief that they cannot trust

Considering endpoints are compromised like swiss cheese in 2021 and third party apps are all compromised, people should be of the belief that they cannot trust anything they didn't write and build themself.

lazide 5y ago
Or even if they did build the software, anything running on hardware they don’t have a similar level of knowledge about. Which good luck with that. Which leaves anyone planning on doing something the US gov’t (or China, or Russia if within their reach) wouldn’t like left with some unpalatable and inefficient options. Either they blend in enough to not get any attention, or don’t seem “dangerous” enough in the sense they are likely to get anywhere, or don’t use any technology more complicated than a piece of paper and a #2 pencil. The last one was what osama bin laden was doing, and they still found him - it just took awhile. As long as the folks being targeted are legitimately out to do harm against innocents, these capabilities are ‘ok’ (scare quotes intentional here). They’re going to be turned against political opponents or people that just seem ‘bad’ though at some point, and almost certainly already have been for years.
- champagnois 5y ago
  There are ways to create secure communications if need be. I have thought of ways that would work to accomplish doing it. I won't detail the designs here, but we are talking very cheap to build and design. I am sure such devices exist and are in the wild, being used by spies. That said -- I am mostly disappointed with the degree to which our intelligence agencies are inwardly focused rather than breaking up foreign spy rings and operations. There are some scarey, harmful, and extremely complicated foreign spy rings on US soil. They have people working for all major tech companies and they are embedded in key positions. The FBI should be making "see something? say something" pushes in tech companies. They should have better followup and reward systems.
  - maqp 5y ago
    There are indeed. It's not just spies. My work wrt endpoint secure comms is FOSS and free for anyone to use https://github.com/maqp/tfc https://github.com/maqp/tfc (the HW costs a bit naturally but in other respects).
    - ycuser2 5y ago
      This is the coolest thing I have read in about a month. Never heard of data diode before. The hardware setup gives such a peace for the paranoic mind. Love it!
  - sangnoir 5y ago
    > The FBI should be making "see something? say something" pushes in tech companies. I'm sure this will not foster distrust, will do wonders for morale among immigrant tech workers, and will in no way leave them primed to be recruited by foreign intelligence services.
novok 5y ago
The point of E2EE messengers is to prevent casual mass surveillance and to increase the cost & risk of mass and targeted surveillance. It's about increasing the noise floor of the internet and making everyone more safe as a result. It forces adversaries to use more legal mechanisms to improve your rights. It's about making you expensive to attack, much like afghanistan won the wars against the USSR and the USA by being expensive as fuck to attack while cheap to attack on their side. They're not about secure endpoints, which is a separate issue that can be worked on in parallel. So yes, you should make sure if your threat model cost benefit says you should: * You have a secure keyboard mechanism. No third party keyboard apps, used a wired / built in keyboard. * You use a secure OS and keep up to date. You verify updates are public and not made 'just for you', you turn off auto updates. * You watch the network behavior of your devices with external proxy devices to see if anything weird is happening, you filter out network interactions you don't like, use a VPN with the proxy device and so on. The more you use 0days, the more they get noticed and the more likely you are to burn them, so you've just increased the stakes towards surveilling you. Now the minimum standard to make you a person of interest has increased significantly, reducing the probability of it.
- champagnois 5y ago
  Your last paragraph implies the person you speak of is a hacker, using 0day attacks? I hope such people get caught. I only worry about innocent westerners living in a society that is creeping toward authoritarianism in the name of some politically polarizing politician. I do not empathize with hackers breaking into systems and causing major problems.
  - Bilal_io 5y ago
    Innocent non-westerners also deserve and benefit from security and E2EE.
  - novok 5y ago
    usually they're used for political or ideological opponents, espionage and a small amount of criminals
maqp 5y ago
That's defeatist thinking. Just because some agencies of major governments can break into many devices doesn't necessarily mean they do. And there are other threats you'll want to defend from as well, including governments and agencies with smaller budget. Anyway, if endpoint security is part of your threat model, you'll be pleased to know I've spent the past decade looking into how to address the problem https://github.com/maqp/tfc https://github.com/maqp/tfc

lazide 5y ago

Or even if they did build the software, anything running on hardware they don’t have a similar level of knowledge about. Which good luck with that. Which leaves anyone planning on doing something the US gov’t (or China, or Russia if within their reach) wouldn’t like left with some unpalatable and inefficient options. Either they blend in enough to not get any attention, or don’t seem “dangerous” enough in the sense they are likely to get anywhere, or don’t use any technology more complicated than a piece of paper and a #2 pencil. The last one was what osama bin laden was doing, and they still found him - it just took awhile. As long as the folks being targeted are legitimately out to do harm against innocents, these capabilities are ‘ok’ (scare quotes intentional here). They’re going to be turned against political opponents or people that just seem ‘bad’ though at some point, and almost certainly already have been for years.

champagnois 5y ago
There are ways to create secure communications if need be. I have thought of ways that would work to accomplish doing it. I won't detail the designs here, but we are talking very cheap to build and design. I am sure such devices exist and are in the wild, being used by spies. That said -- I am mostly disappointed with the degree to which our intelligence agencies are inwardly focused rather than breaking up foreign spy rings and operations. There are some scarey, harmful, and extremely complicated foreign spy rings on US soil. They have people working for all major tech companies and they are embedded in key positions. The FBI should be making "see something? say something" pushes in tech companies. They should have better followup and reward systems.
- maqp 5y ago
  There are indeed. It's not just spies. My work wrt endpoint secure comms is FOSS and free for anyone to use https://github.com/maqp/tfc https://github.com/maqp/tfc (the HW costs a bit naturally but in other respects).
  - ycuser2 5y ago
    This is the coolest thing I have read in about a month. Never heard of data diode before. The hardware setup gives such a peace for the paranoic mind. Love it!
- sangnoir 5y ago
  > The FBI should be making "see something? say something" pushes in tech companies. I'm sure this will not foster distrust, will do wonders for morale among immigrant tech workers, and will in no way leave them primed to be recruited by foreign intelligence services.

novok 5y ago

The point of E2EE messengers is to prevent casual mass surveillance and to increase the cost & risk of mass and targeted surveillance. It's about increasing the noise floor of the internet and making everyone more safe as a result. It forces adversaries to use more legal mechanisms to improve your rights. It's about making you expensive to attack, much like afghanistan won the wars against the USSR and the USA by being expensive as fuck to attack while cheap to attack on their side. They're not about secure endpoints, which is a separate issue that can be worked on in parallel. So yes, you should make sure if your threat model cost benefit says you should: * You have a secure keyboard mechanism. No third party keyboard apps, used a wired / built in keyboard. * You use a secure OS and keep up to date. You verify updates are public and not made 'just for you', you turn off auto updates. * You watch the network behavior of your devices with external proxy devices to see if anything weird is happening, you filter out network interactions you don't like, use a VPN with the proxy device and so on. The more you use 0days, the more they get noticed and the more likely you are to burn them, so you've just increased the stakes towards surveilling you. Now the minimum standard to make you a person of interest has increased significantly, reducing the probability of it.

champagnois 5y ago
Your last paragraph implies the person you speak of is a hacker, using 0day attacks? I hope such people get caught. I only worry about innocent westerners living in a society that is creeping toward authoritarianism in the name of some politically polarizing politician. I do not empathize with hackers breaking into systems and causing major problems.
- Bilal_io 5y ago
  Innocent non-westerners also deserve and benefit from security and E2EE.
- novok 5y ago
  usually they're used for political or ideological opponents, espionage and a small amount of criminals

maqp 5y ago

That's defeatist thinking. Just because some agencies of major governments can break into many devices doesn't necessarily mean they do. And there are other threats you'll want to defend from as well, including governments and agencies with smaller budget. Anyway, if endpoint security is part of your threat model, you'll be pleased to know I've spent the past decade looking into how to address the problem https://github.com/maqp/tfc https://github.com/maqp/tfc