3 ms·

I would bet they have a semi-persistent "non-logged user session cookies" to track you. Just like every other Advertising/publisher does already. basically ins

I would bet they have a semi-persistent "non-logged user session cookies" to track you. Just like every other Advertising/publisher does already. basically instead of "Credit card purchase -> phone number -> person ID" they would use "credit card purchase -> semi-persistent hash -> person ID"

herbst 5y ago
But how would that basically clone my phone's content on their servers? (Which is claimed in the article) it must be some kind of weakness within the system, with some entry point other than some 'cookie'
- peytoncasper 5y ago
  I had the same question, and this article seems to at least attempt to answer this question referring to an ongoing legal case by several tech companies against NSO. Essentially, they're leveraging exploits in various apps (iMessage, WhatsApp, Gmail, etc) commonly found on phones to infect the end user. So in essence, they're selling limited time exploits to load malware and I guess having to constantly find new exploits to sell. Hell of a business model for sure. https://www.occrp.org/en/the-pegasus-project/how-does-pegasus-work https://www.occrp.org/en/the-pegasus-project/how-does-pegasu...
  - herbst 5y ago
    That sounds horrible, but thanks for the link! In that case it can't be as perfect as they claim, except they have a huge list of apps to target what very well could be the case. Edit:// Oh > including Gmail, Facebook, WhatsApp, FaceTime, Viber, WeChat, Telegram, Apple’s built-in messaging and email apps, and others.
- wolverine876 5y ago
  > it must be some kind of weakness within the system You can assume there are many such weaknesses. Nothing is perfectly secure. Nuclear weapons plans are stolen, RSA's crypto keys were stolen ... your phone isn't protected on that level. Security is about raising the cost for an attacker beyond the value to that attacker: if you have data perceived to be worth $1M, make it cost $10M to steal it. But the cost to the defender is relatively high. There is no way your phone, whatever you use, is perfectly secure; there is no way every app on your phone is perfectly secure; the cost would be astromical to the vendors. There are endless possible holes. The question is, what is the perceived value of the contents of your phone? Are you the Secretary of Defense or the CEO of a Fortune 100 company? An international terrorist? If they really want you, they've got you (unless you pay for some serious personnel). They could just replace your phone with an identical one containing a little extra hardware, for example. But your phone almost certainly isn't perceived to have that level of value.
  - herbst 5y ago
    They could think I am a terrorist and I am not even aware until I put a food in their country. I can't know, as I only have a marginal understanding what they think terrorism is.

herbst 5y ago

But how would that basically clone my phone's content on their servers? (Which is claimed in the article) it must be some kind of weakness within the system, with some entry point other than some 'cookie'

peytoncasper 5y ago
I had the same question, and this article seems to at least attempt to answer this question referring to an ongoing legal case by several tech companies against NSO. Essentially, they're leveraging exploits in various apps (iMessage, WhatsApp, Gmail, etc) commonly found on phones to infect the end user. So in essence, they're selling limited time exploits to load malware and I guess having to constantly find new exploits to sell. Hell of a business model for sure. https://www.occrp.org/en/the-pegasus-project/how-does-pegasus-work https://www.occrp.org/en/the-pegasus-project/how-does-pegasu...
- herbst 5y ago
  That sounds horrible, but thanks for the link! In that case it can't be as perfect as they claim, except they have a huge list of apps to target what very well could be the case. Edit:// Oh > including Gmail, Facebook, WhatsApp, FaceTime, Viber, WeChat, Telegram, Apple’s built-in messaging and email apps, and others.
wolverine876 5y ago
> it must be some kind of weakness within the system You can assume there are many such weaknesses. Nothing is perfectly secure. Nuclear weapons plans are stolen, RSA's crypto keys were stolen ... your phone isn't protected on that level. Security is about raising the cost for an attacker beyond the value to that attacker: if you have data perceived to be worth $1M, make it cost $10M to steal it. But the cost to the defender is relatively high. There is no way your phone, whatever you use, is perfectly secure; there is no way every app on your phone is perfectly secure; the cost would be astromical to the vendors. There are endless possible holes. The question is, what is the perceived value of the contents of your phone? Are you the Secretary of Defense or the CEO of a Fortune 100 company? An international terrorist? If they really want you, they've got you (unless you pay for some serious personnel). They could just replace your phone with an identical one containing a little extra hardware, for example. But your phone almost certainly isn't perceived to have that level of value.
- herbst 5y ago
  They could think I am a terrorist and I am not even aware until I put a food in their country. I can't know, as I only have a marginal understanding what they think terrorism is.