7 ms·

Even if you are a person who will never in your life end up as any kind of person of interest for the government, handing over data in this way could still be q

Even if you are a person who will never in your life end up as any kind of person of interest for the government, handing over data in this way could still be quite dangerous. Phones will often contain data that can facilitate theft and fraud if ending up in the wrong hands. If they're able to copy everything, including private data from all apps that could be quite bad. For example many countries now use apps to login to online banking, with private keys for the login stored in the app. Will that be copied? Will it ever be found out if one of the 3000 government officials with access to this data sold it on darknet markets? Maybe some months after your travel you suddenly wake up one day to find all your money transferred from your bank account to some account in Nigeria.

dr-detroit 4y ago
they are also tracking if women are pregnant when they travel so if you miscarry you go to jail
nopenopenopeno 4y ago
It always blows my mind that the same people who insist they don’t trust the government are the first in line to hand over all their personal data to the government, whether by way of Google, Facebook, or otherwise.
YeBanKo 4y ago
Things like secured enclave should make it hard to extract private key from a device even if you have full access.
- bongobingo1 4y ago
  Which assumes the keys are stored in there and not `bundle/user-data/please-dont-read`...
- LightG 4y ago
  You're giving way too much credit to reality...
- nilespotter 4y ago
  For my part I don't trust PRISM partner Apple to secure anything from the government, enclave or not.
  - nerbert 4y ago
    It's certainly not a good option. It's also one of the best options available on the market, save completely opting out of tech.
  - jrockway 4y ago
    Were any of the companies listed on the PRISM slide consensual partners? My understanding is that the NSA tapped the internal network in an era where mTLS wasn't rolled out. Everyone then saw the slides and rolled out mTLS.
    - bashinator 4y ago
      I believe that some companies making layer two network encryption gear also got a big boost around the same time.
    - bornfreddy 4y ago
      I'm quite sure NSA had at least one backup plan, provably more. It is also impossible to know how much of Apple's stance is just for show.
      - jrockway 4y ago
        Sure. I would think that the NSA had plenty of insiders. So do other security agencies, probably. Background checks aren't that thorough against a state-level adversary. (This is one reason why big companies can't trust insiders. I guess small companies should be cautious as well, but sometimes you don't have the funding to protect against insiders and still do your actual work.)
    - jazzyjackson 4y ago
      read "when google met wikileaks", tech giants are more than happy to help with national security
- sweetbitter 4y ago
  And a hardware implant will give the evil maid control over device I/O at minimum, likely the ability to read RAM too. All that's left is to exfiltrate over a prepaid SIM or something.
jjtheblunt 4y ago
> to some account in Nigeria. It must be awkward to be an honest Nigerian on Hacker News, since the country is famous for obvious online scams.
- rjbwork 4y ago
  I worked with a great Nigerian dev some years ago. He contracted for us to do our frontend work. The stories this dude told were insane. He lived in Lagos, notorious for traffic jams. He would frequently get stuck in multi-hour long traffic jams just trying to get fuel for his electric generator. He had to do this to keep his power on during the routine black/brown outs that plagued the city, so that he could continue to work. He eventually, thanks to his work, was able to move to a nicer part of the city where the electricity was more reliable. Last I heard he and his GF/wife (I don't recall which) were able to immigrate to Dubai, where he's continuing to work as a contractor for western clients, with an eye to eventually immigrating to Europe or the US. I wish him well, but it is a damn shame that the best option for Nigerians who wish to engage in this type of work is to...leave.
  - Dma54rhs 4y ago
    UAE imposed visa sanctions on Nigeria recently, afaik right now it would be impossible to immigrate there from Nigeria.
- elliekelly 4y ago
  I once sat through a “Pending Regulation of Cryptocurrency” CLE and one of the panelists was a real crypto-fanatic. He put up a slide about how quickly bitcoin was being adopted around the world and he kept excitedly saying how Nigeria was the fastest-growing crypto market in Africa! Another of the panelists was an FBI agent who investigates crypto-related crimes and when it was his turn he was quick to point out that rapid adoption of crypto in a country famous for internet scams isn’t exactly a selling point...
- churchill 4y ago
  Nigerian here. At some point it gets old and you just get used to it.
formerly_proven 4y ago
> Even if you are a person who will never in your life end up as any kind of person of interest for the government Literally no way to ensure that.
- lambdasquirrel 4y ago
  It doesn't even have to be the government itself. Let's say the sheriff in your town takes interest in your partner. Or his kid gets in a spat with your mom because the kid was DUI.
  - deleted 4y ago
    [deleted]
- yosito 4y ago
  The chances of becoming a person of interest will always be non-zero, but I think I a lot of people can be reasonably confident that they are not likely to become a person of interest.
  - antipurist 4y ago
    Given that 0.5—1% of the US population is incarcerated[1], and that getting a prison sentence is far from the only way to become a person of interest, it is quite reasonable to say that chances of getting some unwanted attention from various government and government-adjacent institutions are too damn high to ignore it. [1] https://www.prisonpolicy.org/blog/2020/01/16/percent-incarcerated https://www.prisonpolicy.org/blog/2020/01/16/percent-incarce...
    - jameshart 4y ago
      While US justice certainly can be capricious and arbitrary, it is not entirely a random lottery whose eye it falls upon. And while those who believe in the centrality of personal responsibility and try to tell you that anyone who comes into contact with the police must have done something to deserve it are clearly deluded, there are things you can do in your life, or elements of your personal background and lifestyle that, though you never really opted into them, you may benefit from (one might call them 'privileges'), which will reduce the chances that you personally will run into trouble with the law quite considerably. Your own personal odds are rarely the same as the average odds across the whole population. For anything. That's why insurance companies can exist.
Grimburger 4y ago
To me the lack of checks/balances before handing over your device for an hour or so is the worst part. The chain of custody in these instances is basically one guy going into a back room by himself and hooking it up to a computer. At the very least you should be able to have the contents of your phone independently hashed before handing it over to a potentially corrupt individual. They can put anything they want on there in that time and what recourse do you really have?
saiya-jin 4y ago
Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Apple vs Android is irrelevant in this, there is no truly safe mainstream phone in 2022, period. Are people really that lazy? I do manage quite a few financial things but for none of those phone apps is crucial and I use exactly 0 of them. There is ebanking login app, but on its own its useless, another 3 factors are required for login. There is always desktop browser variant for everything, with firefox with ublock origin and few other plugins making internet a bit more as it was intended to be. So yes US government can hack my phone if they havent already, they will see what kind of photography and travelling I do, which family members I write to, and some online shopping history. Thats it. Phones are not secure and probably never will be for anything more. Anybody telling you otherwise is either dangerously clueless or worse
- jjcm 4y ago
  Because accounts are insured and so need to transfer money on the go. How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. How do you withdraw money from an ATM? Again, this is moving primarily app based. Your definition of sane may be security at all costs, but for most convenience and social norms trump this.
  - sweetbitter 4y ago
    > How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. With cash? > How do you withdraw money from an ATM? Again, this is moving primarily app based. With a card?
- kelnos 4y ago
  > Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Because it's convenient, and security is a trade off with convenience. I use banking apps on my phone, and I suspect many (most, even) people here on HN (and who are technically savvy in general) do as well. That doesn't make it smart or good or correct, but I suspect that is the status quo. I haven't traveled outside the US since before the pandemic, but these days I may only travel with a burner phone the next time I do so. > Phones are not secure Neither are laptops or desktops, or anything, really. Everyone needs to decide for themselves what level of security they're willing to accept, and what their threat model is.
heavyset_go 4y ago
> Will it ever be found out if one of the 3000 government officials with access to this data sold it on darknet markets? It's not just government officials with access, but government contractors and anyone that works for them, as well.
fuzzfactor 4y ago
>US border forces are seizing Americans' phone data and storing it for 15 years The only reason they could possibly be doing this would be because it is not quite feasible to store it for more than 15 years. Yet.

dr-detroit 4y ago

they are also tracking if women are pregnant when they travel so if you miscarry you go to jail

nopenopenopeno 4y ago

It always blows my mind that the same people who insist they don’t trust the government are the first in line to hand over all their personal data to the government, whether by way of Google, Facebook, or otherwise.

YeBanKo 4y ago

Things like secured enclave should make it hard to extract private key from a device even if you have full access.

bongobingo1 4y ago
Which assumes the keys are stored in there and not `bundle/user-data/please-dont-read`...
LightG 4y ago
You're giving way too much credit to reality...
nilespotter 4y ago
For my part I don't trust PRISM partner Apple to secure anything from the government, enclave or not.
- nerbert 4y ago
  It's certainly not a good option. It's also one of the best options available on the market, save completely opting out of tech.
- jrockway 4y ago
  Were any of the companies listed on the PRISM slide consensual partners? My understanding is that the NSA tapped the internal network in an era where mTLS wasn't rolled out. Everyone then saw the slides and rolled out mTLS.
  - bashinator 4y ago
    I believe that some companies making layer two network encryption gear also got a big boost around the same time.
  - bornfreddy 4y ago
    I'm quite sure NSA had at least one backup plan, provably more. It is also impossible to know how much of Apple's stance is just for show.
    - jrockway 4y ago
      Sure. I would think that the NSA had plenty of insiders. So do other security agencies, probably. Background checks aren't that thorough against a state-level adversary. (This is one reason why big companies can't trust insiders. I guess small companies should be cautious as well, but sometimes you don't have the funding to protect against insiders and still do your actual work.)
  - jazzyjackson 4y ago
    read "when google met wikileaks", tech giants are more than happy to help with national security
sweetbitter 4y ago
And a hardware implant will give the evil maid control over device I/O at minimum, likely the ability to read RAM too. All that's left is to exfiltrate over a prepaid SIM or something.

jjtheblunt 4y ago

> to some account in Nigeria. It must be awkward to be an honest Nigerian on Hacker News, since the country is famous for obvious online scams.

rjbwork 4y ago
I worked with a great Nigerian dev some years ago. He contracted for us to do our frontend work. The stories this dude told were insane. He lived in Lagos, notorious for traffic jams. He would frequently get stuck in multi-hour long traffic jams just trying to get fuel for his electric generator. He had to do this to keep his power on during the routine black/brown outs that plagued the city, so that he could continue to work. He eventually, thanks to his work, was able to move to a nicer part of the city where the electricity was more reliable. Last I heard he and his GF/wife (I don't recall which) were able to immigrate to Dubai, where he's continuing to work as a contractor for western clients, with an eye to eventually immigrating to Europe or the US. I wish him well, but it is a damn shame that the best option for Nigerians who wish to engage in this type of work is to...leave.
- Dma54rhs 4y ago
  UAE imposed visa sanctions on Nigeria recently, afaik right now it would be impossible to immigrate there from Nigeria.
elliekelly 4y ago
I once sat through a “Pending Regulation of Cryptocurrency” CLE and one of the panelists was a real crypto-fanatic. He put up a slide about how quickly bitcoin was being adopted around the world and he kept excitedly saying how Nigeria was the fastest-growing crypto market in Africa! Another of the panelists was an FBI agent who investigates crypto-related crimes and when it was his turn he was quick to point out that rapid adoption of crypto in a country famous for internet scams isn’t exactly a selling point...
churchill 4y ago
Nigerian here. At some point it gets old and you just get used to it.

formerly_proven 4y ago

> Even if you are a person who will never in your life end up as any kind of person of interest for the government Literally no way to ensure that.

lambdasquirrel 4y ago
It doesn't even have to be the government itself. Let's say the sheriff in your town takes interest in your partner. Or his kid gets in a spat with your mom because the kid was DUI.
- deleted 4y ago
  [deleted]
yosito 4y ago
The chances of becoming a person of interest will always be non-zero, but I think I a lot of people can be reasonably confident that they are not likely to become a person of interest.
- antipurist 4y ago
  Given that 0.5—1% of the US population is incarcerated[1], and that getting a prison sentence is far from the only way to become a person of interest, it is quite reasonable to say that chances of getting some unwanted attention from various government and government-adjacent institutions are too damn high to ignore it. [1] https://www.prisonpolicy.org/blog/2020/01/16/percent-incarcerated https://www.prisonpolicy.org/blog/2020/01/16/percent-incarce...
  - jameshart 4y ago
    While US justice certainly can be capricious and arbitrary, it is not entirely a random lottery whose eye it falls upon. And while those who believe in the centrality of personal responsibility and try to tell you that anyone who comes into contact with the police must have done something to deserve it are clearly deluded, there are things you can do in your life, or elements of your personal background and lifestyle that, though you never really opted into them, you may benefit from (one might call them 'privileges'), which will reduce the chances that you personally will run into trouble with the law quite considerably. Your own personal odds are rarely the same as the average odds across the whole population. For anything. That's why insurance companies can exist.

Grimburger 4y ago

To me the lack of checks/balances before handing over your device for an hour or so is the worst part. The chain of custody in these instances is basically one guy going into a back room by himself and hooking it up to a computer. At the very least you should be able to have the contents of your phone independently hashed before handing it over to a potentially corrupt individual. They can put anything they want on there in that time and what recourse do you really have?

saiya-jin 4y ago

Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Apple vs Android is irrelevant in this, there is no truly safe mainstream phone in 2022, period. Are people really that lazy? I do manage quite a few financial things but for none of those phone apps is crucial and I use exactly 0 of them. There is ebanking login app, but on its own its useless, another 3 factors are required for login. There is always desktop browser variant for everything, with firefox with ublock origin and few other plugins making internet a bit more as it was intended to be. So yes US government can hack my phone if they havent already, they will see what kind of photography and travelling I do, which family members I write to, and some online shopping history. Thats it. Phones are not secure and probably never will be for anything more. Anybody telling you otherwise is either dangerously clueless or worse

jjcm 4y ago
Because accounts are insured and so need to transfer money on the go. How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. How do you withdraw money from an ATM? Again, this is moving primarily app based. Your definition of sane may be security at all costs, but for most convenience and social norms trump this.
- sweetbitter 4y ago
  > How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. With cash? > How do you withdraw money from an ATM? Again, this is moving primarily app based. With a card?
kelnos 4y ago
> Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Because it's convenient, and security is a trade off with convenience. I use banking apps on my phone, and I suspect many (most, even) people here on HN (and who are technically savvy in general) do as well. That doesn't make it smart or good or correct, but I suspect that is the status quo. I haven't traveled outside the US since before the pandemic, but these days I may only travel with a burner phone the next time I do so. > Phones are not secure Neither are laptops or desktops, or anything, really. Everyone needs to decide for themselves what level of security they're willing to accept, and what their threat model is.

heavyset_go 4y ago

> Will it ever be found out if one of the 3000 government officials with access to this data sold it on darknet markets? It's not just government officials with access, but government contractors and anyone that works for them, as well.

fuzzfactor 4y ago

>US border forces are seizing Americans' phone data and storing it for 15 years The only reason they could possibly be doing this would be because it is not quite feasible to store it for more than 15 years. Yet.