7 ms·

Most the of the conversation around Pegasus has rightly focused around how shocking and casual the widespread sale and use of this malware is. But, I wonder if

Most the of the conversation around Pegasus has rightly focused around how shocking and casual the widespread sale and use of this malware is. But, I wonder if there's another story here: nearly all world leaders have a target-able device with cameras, microphones, GPS, and personal and professional conversations (and therefore contact lists) which they carry with them 24/7. At what point does the risk outweigh the convenience? I'm not sure what the solution is, but I wish that smartphones were not seen as a default necessity for everybody. Risks such as Pegasus are introduced, and it seems hard to go back to how things were.

haddr 5y ago
I look back with nostalgia when Obama was using Blackberry (with some extra security). I just wonder what should world leaders use today…
- FrenchDevRemote 5y ago
  probably a pinephone or another phone with physical switches and it should be only used for non-sensitive stuff, and with a removed battery when it's not needed any sensitive stuff just can't be safe on the current phone OSes imo
  - asplake 5y ago
    Here in the UK the standard appears to be government by WhatsApp
tacker2000 5y ago
Yea, in my opinion thats also the actual problem here. World leaders using run of the mill iphones poses a real security risk. They should be using some hardened ultra secure device or other communication methods.
- Melatonic 5y ago
  Kind of too bad we lost Blackberry - they seemed to be focusing on this sort of thing. Maybe this is someone a large country could develop internally themselves? Create their own fork of Android, private app store, etc etc?
- stavros 5y ago
  That kind of goes to the wrong end of the solution for me: Run-of-the-mill phones should be hardened, ultra-secure devices. We all have a right to privacy and security.
  - tacker2000 5y ago
    Yes sure, but the requirements for normal consumers are much lower than for any high profile individual. It all comes down to cost vs. need. Think of the security of the average home users wifi network vs. the networks of a small company. The latter will have to be more hardened and also spend the money for that.
    - stavros 5y ago
      I think (/would hope) the hardening there would be more in procedures and app installation. The base/OS layer should be secure from intrusion for heads of state or for everyday people, help people make good privacy decisions (with granular permissions), etc.
  - prakhar897 5y ago
    Functionality and Security are inversely proportional to each other. If you introduce a "Play Store" in a phone, the security risk automatically increases billion times. In an ideal world, There would be some special devices which have very limited set of functionalities inbuilt like calls, message etc which is used by world leaders to communicate.
    - makeitdouble 5y ago
      Wouldn’t that leader still end up with a personal phone that isn’t that secured ? Or at the other end of spectrum have a work device that is so special that it’s extremely identifiable and targetable ? What we have now for work devices with manageable profiles seems to me to be a good balance that should possible to harden enough for extreme cases as well.
cycomanic 5y ago
I wonder if the issue is not even worse. If I was an intelligence agency that wanted to listen in on some world leaders, I would not (only) target the devices of the PM/President etc., but on the PAs and bureaucrats in the vicinity. I suspect they would likely be easier targets and one would get as much interesting information from them as from the world leader themself.
nonrandomstring 5y ago
> I'm not sure what the solution is, but I wish that smartphones were not seen as a default necessity for everybody. They are not. But that mythology, that they are, is central to the problem. I just posted on almost exactly this point in another thread [1] that I'll paste here; > (From OP[1]) Ultimately, if the technology is not serving you, you have the choice to not use it. This is worthy of a book or PhD research project in itself. The person who states this in terms that resonate with me with is Vint Cerf. I will quote a little but also paraphrase him in my own way by saying; "At one time if you didn’t have a horse it was hard to make a living. But the important right in that case was the right to make a living, not the right to a horse. Today, if I were granted a right to have a horse, I’m not sure where I would put it. Technology is an enabler of rights, not a right itself" [2] As I see it, if we are to respect the more fundamental human rights of "life, liberty and security of person" then the greater human right may be NOT to be connected to the internet. It is freedom from technologies at least insofar as we are free to manage our own affairs and engagement. Other than the European "Right to be forgotten" and legislation protecting us from surveillance and tracking, I'm not aware of any popular formulations of this general principle other than Vint Cerf's. Right now I think people are being forced to stable horses in their backyards, at the behest of landowners, and under the false premise that you need one for work. [1] https://news.ycombinator.com/item?id=31216377 https://news.ycombinator.com/item?id=31216377
- bluGill 5y ago
  At one very short time, in only a few places was a horse needed. Most of the world used oxen or buffalo (not bison) for farm tasks not horses. In the American west a horse was needed to pull a plow because a horse moves just enough faster that a steel plow work. If you didn't need that speed a horse was not useful. Horses were also useful for knights, but not most people in Europe. Herders in Mongolia and other planes areas made good use of horses as well. None of this translated to more than a small part of the world though. We have a romantic view of the cowboy, and just before the mass migration from farms to the city happened horses started taking over so we think of them as the backbone of the farm, but they generally were not.
  - 5y ago
wslh 5y ago
100% agree. If it is not Pegasus it would be Medusa, Zeus, Robotech, or Mazinger Z ;-). States are part of the security attack vector and Pegasus is just a signal of what is really happening in the field. Pesonally I was involved in selling exploits since late 90s.
blenderdt 5y ago
In the Netherlands it came to light a lot of leaders are using private email because it is more easy to use than secure email. This shows not a lot of leaders are aware of the security risks of using conventional communication.
- mschuster91 5y ago
  > In the Netherlands it came to light a lot of leaders are using private email because it is more easy to use than secure email. Or rather, because it is more easy to circumvent requirements of public record and archival laws. What I keep asking myself in any case... why is the European Union unable or unwilling to fund an open source software suite that covers all needs of a modern IT environment? For literally everything that's needed, there are open source solutions - Firefox and Thunderbird for communication, LibreOffice for office needs, AOSP for phones, Linux as an OS, Samba for managing PCs and laptops... that would be a real, tangible benefit for hundreds of millions of people, not to mention a huge saving in costs for software licenses.
  - robotnikman 5y ago
    The big hole I think that's missing is something to manage policies for all those device and enforce them, as well as roaming profile and account management. Microsoft basically has a monopoly on this right now with Active Directory. I can't think of any open source projects off the top of my head which offer something similar. For a modern IT environment used by a business, such a system is absolutely necessary
    - mschuster91 5y ago
      You can absolutely run GPOs using Samba as a DC if your clients are Windows, same for profile and account management. For a client-side GPO replacement on Linux and macOS one can use Ansible.
  - zx85wes 5y ago
    Turns out there aren't any requirements in the Netherlands, just 'advice'. Regarding the EU and costs : no-one there cares about cost. They just pass them on to taxpayers.
hkt 5y ago
Here is a crazy idea: maybe the security services like the NSA, GCHQ, etc, should be out there fixing vulnerabilities in common, critical software, rather than hoarding exploits. They're better termed insecurity agencies today, imo. So much waste of talent and resources making the situation worse. Not to mention the fact we really ought to make selling and buying of that hardware a crime in as many places as possible.
- hansel_der 5y ago
  yea "fighting for peace is like fucking for virginity" then again ...
- rank0 5y ago
  It is crazy. You’re asking intelligence agencies to not conduct surveillance. You’re asking military not to develop weapons. Never gonna happen :(

haddr 5y ago

I look back with nostalgia when Obama was using Blackberry (with some extra security). I just wonder what should world leaders use today…

FrenchDevRemote 5y ago
probably a pinephone or another phone with physical switches and it should be only used for non-sensitive stuff, and with a removed battery when it's not needed any sensitive stuff just can't be safe on the current phone OSes imo
- asplake 5y ago
  Here in the UK the standard appears to be government by WhatsApp

tacker2000 5y ago

Yea, in my opinion thats also the actual problem here. World leaders using run of the mill iphones poses a real security risk. They should be using some hardened ultra secure device or other communication methods.

Melatonic 5y ago
Kind of too bad we lost Blackberry - they seemed to be focusing on this sort of thing. Maybe this is someone a large country could develop internally themselves? Create their own fork of Android, private app store, etc etc?
stavros 5y ago
That kind of goes to the wrong end of the solution for me: Run-of-the-mill phones should be hardened, ultra-secure devices. We all have a right to privacy and security.
- tacker2000 5y ago
  Yes sure, but the requirements for normal consumers are much lower than for any high profile individual. It all comes down to cost vs. need. Think of the security of the average home users wifi network vs. the networks of a small company. The latter will have to be more hardened and also spend the money for that.
  - stavros 5y ago
    I think (/would hope) the hardening there would be more in procedures and app installation. The base/OS layer should be secure from intrusion for heads of state or for everyday people, help people make good privacy decisions (with granular permissions), etc.
- prakhar897 5y ago
  Functionality and Security are inversely proportional to each other. If you introduce a "Play Store" in a phone, the security risk automatically increases billion times. In an ideal world, There would be some special devices which have very limited set of functionalities inbuilt like calls, message etc which is used by world leaders to communicate.
  - makeitdouble 5y ago
    Wouldn’t that leader still end up with a personal phone that isn’t that secured ? Or at the other end of spectrum have a work device that is so special that it’s extremely identifiable and targetable ? What we have now for work devices with manageable profiles seems to me to be a good balance that should possible to harden enough for extreme cases as well.

cycomanic 5y ago

I wonder if the issue is not even worse. If I was an intelligence agency that wanted to listen in on some world leaders, I would not (only) target the devices of the PM/President etc., but on the PAs and bureaucrats in the vicinity. I suspect they would likely be easier targets and one would get as much interesting information from them as from the world leader themself.

nonrandomstring 5y ago

> I'm not sure what the solution is, but I wish that smartphones were not seen as a default necessity for everybody. They are not. But that mythology, that they are, is central to the problem. I just posted on almost exactly this point in another thread [1] that I'll paste here; > (From OP[1]) Ultimately, if the technology is not serving you, you have the choice to not use it. This is worthy of a book or PhD research project in itself. The person who states this in terms that resonate with me with is Vint Cerf. I will quote a little but also paraphrase him in my own way by saying; "At one time if you didn’t have a horse it was hard to make a living. But the important right in that case was the right to make a living, not the right to a horse. Today, if I were granted a right to have a horse, I’m not sure where I would put it. Technology is an enabler of rights, not a right itself" [2] As I see it, if we are to respect the more fundamental human rights of "life, liberty and security of person" then the greater human right may be NOT to be connected to the internet. It is freedom from technologies at least insofar as we are free to manage our own affairs and engagement. Other than the European "Right to be forgotten" and legislation protecting us from surveillance and tracking, I'm not aware of any popular formulations of this general principle other than Vint Cerf's. Right now I think people are being forced to stable horses in their backyards, at the behest of landowners, and under the false premise that you need one for work. [1] https://news.ycombinator.com/item?id=31216377 https://news.ycombinator.com/item?id=31216377

bluGill 5y ago
At one very short time, in only a few places was a horse needed. Most of the world used oxen or buffalo (not bison) for farm tasks not horses. In the American west a horse was needed to pull a plow because a horse moves just enough faster that a steel plow work. If you didn't need that speed a horse was not useful. Horses were also useful for knights, but not most people in Europe. Herders in Mongolia and other planes areas made good use of horses as well. None of this translated to more than a small part of the world though. We have a romantic view of the cowboy, and just before the mass migration from farms to the city happened horses started taking over so we think of them as the backbone of the farm, but they generally were not.
- 5y ago

wslh 5y ago

100% agree. If it is not Pegasus it would be Medusa, Zeus, Robotech, or Mazinger Z ;-). States are part of the security attack vector and Pegasus is just a signal of what is really happening in the field. Pesonally I was involved in selling exploits since late 90s.

blenderdt 5y ago

In the Netherlands it came to light a lot of leaders are using private email because it is more easy to use than secure email. This shows not a lot of leaders are aware of the security risks of using conventional communication.

mschuster91 5y ago
> In the Netherlands it came to light a lot of leaders are using private email because it is more easy to use than secure email. Or rather, because it is more easy to circumvent requirements of public record and archival laws. What I keep asking myself in any case... why is the European Union unable or unwilling to fund an open source software suite that covers all needs of a modern IT environment? For literally everything that's needed, there are open source solutions - Firefox and Thunderbird for communication, LibreOffice for office needs, AOSP for phones, Linux as an OS, Samba for managing PCs and laptops... that would be a real, tangible benefit for hundreds of millions of people, not to mention a huge saving in costs for software licenses.
- robotnikman 5y ago
  The big hole I think that's missing is something to manage policies for all those device and enforce them, as well as roaming profile and account management. Microsoft basically has a monopoly on this right now with Active Directory. I can't think of any open source projects off the top of my head which offer something similar. For a modern IT environment used by a business, such a system is absolutely necessary
  - mschuster91 5y ago
    You can absolutely run GPOs using Samba as a DC if your clients are Windows, same for profile and account management. For a client-side GPO replacement on Linux and macOS one can use Ansible.
- zx85wes 5y ago
  Turns out there aren't any requirements in the Netherlands, just 'advice'. Regarding the EU and costs : no-one there cares about cost. They just pass them on to taxpayers.

hkt 5y ago

Here is a crazy idea: maybe the security services like the NSA, GCHQ, etc, should be out there fixing vulnerabilities in common, critical software, rather than hoarding exploits. They're better termed insecurity agencies today, imo. So much waste of talent and resources making the situation worse. Not to mention the fact we really ought to make selling and buying of that hardware a crime in as many places as possible.

hansel_der 5y ago
yea "fighting for peace is like fucking for virginity" then again ...
rank0 5y ago
It is crazy. You’re asking intelligence agencies to not conduct surveillance. You’re asking military not to develop weapons. Never gonna happen :(