3 ms·
This is an excellent post, but I want to point out that what really matters here is your threat model. If you are trying to hide from the NSA or other nation s
by opportune 3y ago
This is an excellent post, but I want to point out that what really matters here is your threat model.
If you are trying to hide from the NSA or other nation states, you have a LOT of work cut out for you. There are basically two sub threat models: are you trying to hide from the dragnet (in which case, just using any obscure and relatively obfuscated communications mechanism will work) or the scenario in which you’re being actively targeted (in which case you need rock solid security from end to end). Keep in mind that the Security version of https://en.m.wikipedia.org/wiki/Analog_hole https://en.m.wikipedia.org/wiki/Analog_hole means the security of your networked device is just as important as your messaging protocol, and… good luck with that on mobile.
If you are just a small fish trying to avoid something with a court-admissible record (and don’t care about parallel construction) you’re probably fine with Signal, provided you understand that your counterparty can just give you up.
I hate to bring out the “nothing to hide” argument because I disagree with its premise from a moral standpoint, but from a practical standpoint, I recommend avoiding having “directly targeted by the NSA and needing to avoid it” as your threat model to begin with.
- News-Dog 3y agoI am reminded of basic concepts; Zero Trust Security Model - Trust no One (Internet Security) : https://en.wikipedia.org/wiki/Zero_trust_security_model https://en.wikipedia.org/wiki/Zero_trust_security_model
- p-e-w 3y agoUnless you are also building your entire hardware from scratch, including the CPU, and writing or auditing all firmware and device drivers, "zero trust" is a fantasy. Zero trust means verifying everything. Not only has no living person verified the entire technology stack they are using, it is literally impossible to do so for any modern consumer device, since they all contain closed hardware and software that affects the trust model yet cannot be verified in any meaningful sense.
- opportune 3y agoMaybe that commenter didn’t know what zero-trust means. Zero-trust in practice just means continuing to authenticate from within your “perimeter”, ie, assume an employee or machine is already compromised. If you need unbreakable encryption and security that even the NSA (or the various vendors it works with to find zero day exploits) can’t hack you need to get off the fucking internet
- News-Dog 3y ago>"zero trust" is a fantasy. - Zero trust means verifying everything. Not only has no living person verified the entire technology stack they are using, it is literally impossible to do so for any modern consumer device.. Correct! - So the options are practice good privacy principles or totally disconnect and become a Hermit. See; https://news.ycombinator.com/item?id=36387696 https://news.ycombinator.com/item?id=36387696