4 ms·
I would suspect any phone designed to resist a state-level actor, that is made available to me (a regular citizen) would 100% be a honeypot for a state level ac
by PuppyTailWags 4y ago
I would suspect any phone designed to resist a state-level actor, that is made available to me (a regular citizen) would 100% be a honeypot for a state level actor.
- godelski 4y agoIn fact, several phones which have been advertised as such have been honeypots from state level actors.
- Swenrekcah 4y agoWhich ones? Not challenging you, just curious.
- Entinel 4y agohttps://www.pcmag.com/news/fbi-sold-criminals-fake-encrypted-phones-that-actually-copied-their-messages https://www.pcmag.com/news/fbi-sold-criminals-fake-encrypted...
- bilekas 4y agoThat's crazy! Straight out of the Wire.
- hyperionplays 4y agoAustralian Federal Police did it as well: https://www.theguardian.com/australia-news/2021/sep/11/inside-story-most-daring-surveillance-sting-in-history https://www.theguardian.com/australia-news/2021/sep/11/insid...
- usrn 4y agoSecurity as a service is going to be a honeypot 100% of the time.
- godelski 4y agoThis comment feels disingenuous to me, but maybe I'm misinterpreting. Security features are always a service but there are real apps that provide real security. Signal and Matrix provide real encryption for communication. There's even mainstream products that do, like iMessage or Gmail, though these tend to be more selective about what is secure and what isn't (typically through walled gardens). Apple and Google both use federated learning, which is at least a step better than your typically data "anonymization." I agree that there's not enough push for serious security, especially as a default, but I also am not pessimistic on the subject either.
- contingencies 4y agoSignal wants your PSTN ID = real world ID, wants contacts from your phonebook which on Google phones generally means already cloudified, and is itself distributed through Google Play. Further, IIRC it's US-based so subject to acts of intervention from on high. I would be strongly suspicious of any metadata security claims, even if it nominally provides message or session-level encryption. Metadata is bad news.
- astrange 4y agoI assume you're an FBI agent trying to encourage people to install your real cooler encrypted app that's not on the store and only available via sideloading. https://nymag.com/intelligencer/2021/06/fbi-snooped-on-criminals-using-encrypted-messaging-app.html https://nymag.com/intelligencer/2021/06/fbi-snooped-on-crimi...
- contingencies 4y agoHeh, nice one. Not that it's my area, but in case the above was not decodable as sarcasm to other readers, following the evidence-based / defense-in-depth strategies I'd personally recommend not using phones at all (far too little control in general) and instead recommend seeking out auditable (open source) software on actual machines you have a hope to control for secure communications. It's a deep rabbit hole with diminishing returns, though.
- stjohnswarts 4y agoanyone big like samsung, lg, or apple? I'd love to see those articles and teardowns.
- wmf 4y agohttps://www.vice.com/en/article/y3d3dx/doj-charges-anom-influencers-fake-honeypot-company https://www.vice.com/en/article/y3d3dx/doj-charges-anom-infl...
- ajsnigrutin 4y agoMost of the people in charge, only care about what state the "bad"/"good" actors are from, so preferably, "our guys" should be able to do everything, and "theirs" nothing.
- newsclues 4y agoAnd yet we got TOR because it was required for National Security.
- px43 4y agoIMO Bunnie has the technical skills and the reputation to pull it off though. I think it has about zero chance of withstanding physical attacks, which is important to me in a phone, but it's a nice effort.
- stjohnswarts 4y agoGotta trust somebody at some point? Otherwise you have to live off the grid in the woods eating squirrels and mushrooms