5 ms·
ill echo what the gp said. again, none of that means it is at all realistic to believe you can defeat determined funded state actors. it is the height of ridi
by toofy 5y ago
ill echo what the gp said. again, none of that means it is at all realistic to believe you can defeat determined funded state actors.
it is the height of ridiculousness to ever think you can use anything with the surface of something like a modern phone and be safe against a state. ridiculous. i’ll say it again. ridiculous.
threat models exist for a reason. if anyone ever implied that an apple phone or an android, or pc were safe against this model, this person is a lightweight and you should run fast and far from their advice.
if you’ve ever told people they were safe against a state actor with a smart phone, you need to immediately reevaluate what you do and what you do not know. immediately.
no serious person—including apple themselves—ever made the claim these devices were safe against state determined actors with an off-the-shelf device you can grab from best buy on your way home from work.
- bigbizisverywyz 5y agoI dunno, if you look at the incredible hoops the iMessage exploit had to go through in order to work, then there must be a point where the effort involved in finding new exploits would far outweigh the benefits ... assuming Apple is actively finding and closing current exploits and not introducing new software that just increases the attack surface area.
- pyuser583 5y agoRoughly speaking it worked by hijacking preinstalled apps (calendar, mail, etc) and privilege escalation, to create a new account. The Apples preinstalled apps, and default behavior meant the attackers could rely on certain behavior once they were in. Apples standardization is what got them.
- pyuser583 5y agoTrue … keep in mind … the whole idea behind a mobile device is frought with security issues. It’s constantly connected to uncontrolled networks, constantly downloading media, possesses microphones, cameras, gps, etc Basically gathers tons of info, and is connected to the internet always and everywhere.
- astrange 5y agoWhat’s so good about states? Just an employer who can’t pay enough or hire people who smoke weed, but you seem to be worshipping them like they’re automatically gods.
- amanaplanacanal 5y ago> What’s so good about states? I’d say strong incentives plus unlimited funding.
- astrange 5y agoTheir incentives aren't that strong (best you get is a medal you can't show or tell anyone about) and unlimited funding can mean they start an unlimited number of underfunded projects, rather than funding one endlessly. What they do have is patience and secrecy.
- fsflover 5y agoIncentives to do what?
- viktorcode 5y agoSoftware security can be thought of as operating on a cost/benefit model. To produce secure software means making attackers spend more resources on penetrating defences than the value they get from successful attack. And it works well for mass market, because the vast majority of attacks are non-targeted attempts to fish for financial credentials, taking over the devices for use in a botnet etc. For state attacker the model breaks. The value of a target can be very high. And the available resources - financial, technical, other - are there to fill the budget.
- datavirtue 5y agoI can exchange pgp keys with someone and send encrypted messages back and forth. No amount of funding or resources will ever be able to expose those messages. This is math. You sound like you are defending Apple for exposing journalists and activists when Apple, in fact, explicitly allowed remote code execution by untrusted actors. They way you put it, these people fired up a quantum computer and broke the users password hash. What they actually did is the equivalent of an activex control owning a machine in a drive-by attack.
- Terry_Roll 5y agoYeah the international tech standards are woeful. Look at Caller ID in the telecoms world, it uses a dialup modem protocol, so what can you do with a bit of hardware that can handle that, I'm thinking hardware that moves landlines onto computer based phone systems? Reprogram some firmware perhaps? Then maybe you have a dialup modem instead of some PSTN to ethernet device? Its fun looking at the hardware, wondering what else a component can be made to do besides its obvious legit function.