6 ms·

If you're not under the threat cone of nation state surveillance (like trying to exfiltrate the radar-asborbing paint formula on the F35) then I wouldn't be too

If you're not under the threat cone of nation state surveillance (like trying to exfiltrate the radar-asborbing paint formula on the F35) then I wouldn't be too concerned. "That's not the point! It's about privacy!" Sure. I'll choose it ignore the fact that our civilization is somehow still functioning in a post-nuclear world.

tinco 3y ago
It's not about privacy, it's about security. If there's a backdoor in a HSM or network interface, that backdoor can be used by others as well. That might start with foreign nation states, but might eventually leak to regular private persons or entities as well. A backdoor is an extra attack vector with often very unfavorable properties that you as a user are unaware of.
slackfan 3y ago
Sure. See you in the gulag, comerade
- RationPhantoms 3y ago
  Oh please, the United States is so incredibly armed, my death will likely come at the hands of some misplaced right-wing militarized fascist group performing mass murders under the guise of "Freedom" and "A return to the constitutional purity of the US".
  - digging 3y ago
    I mean, that more or less describes most police departments in the country. And they are spying on you.
  - slackfan 3y ago
    I've been promised that that was going to happen any day now since the wrong person got elected back in 2000. Nearly a quarter century on I am beginning to suspect that somebody was overstating something, I can't quite put my finger on what though...
  - salawat 3y ago
    You... could defend yourself you know. Cuts both ways.
- MSFT_Edging 3y ago
  Gulag is just Russian for prison. The US currently has about 1.2M people in their gulags, comrade*
  - slackfan 3y ago
    Гулаг (gulag) is the acronym for "Гла́вное управле́ние исправи́тельно-трудовы́х лагере́й" which translates to "Head management office of correctional work camps". And if you're going to go for all incarcerated, the number is actually somewhere in the 2.1mil range in the US, because hey, jails are a thing. Sorry that you're wrong on all three points.
    - MSFT_Edging 3y ago
      Damn, you got me.
- cpursley 3y ago
  Comrade is of Latin origin. In Russian, tovarisch is the correct term. At least get it right if you're trying to be edgy.
  - slackfan 3y ago
    Sounds like I hit a nerve?
runeofdoom 3y ago
And if you are in a position where nation-states are a likely adversary, you'd best assume that all commerically available hardware is compromised.
sschueller 3y ago
A Mann is being executed in Saudia Arabia for tweeting a negative tweet about the government to his tiny following. Not exactly someone who thinks they are a target of a nation state. [1] https://www.hrw.org/news/2023/08/29/saudi-arabia-man-sentenced-death-tweets https://www.hrw.org/news/2023/08/29/saudi-arabia-man-sentenc...
- RationPhantoms 3y ago
  Not sure if this a joke but SA is the exact country I would expect to utilize spyware against its citizens.
  - MSFT_Edging 3y ago
    With how good of friends SA is with the US, its likely all they need to do is ask nicely for some dirt on an alleged dissident.
awesomeMilou 3y ago
> If you're not under the threat cone of nation state surveillance The average reader may be surprised by how far this cone can extend in some circumstances. It has been established that the NSA conducts industrial espionage [0], under the cover of national security [1]. To what degree the term "national security" narrows down the scope of any surveillance measures is likely unfamiliar to the laymen, but an NSA representative gave a short description on the agencies views to that regard in 2013: "The intelligence community's efforts to understand economic systems and policies, and monitor anomalous economic activities, are critical to providing policy makers with the information they need to make informed decisions that are in the best interest of our national security." [1] While it affirms that it does not steal trade secrets, the NSA reserves the right to pass on critical information about economic developments towards policy makers, who then can use this knowledge in their decision making. Notable examples of industrial espionage conducted by the NSA consisted of spying on EU antitrust regulators investigating Google for antitrust violations [1], alleged espionage of business conducted by brazilian oil giant Petrobas [2], international credit card transactions [3], SWIFT [4], and the infamous allegations of espionage against european defense company EADS [5]. It's noteworthy that this short list only comprises cases that got attention of the media, the actual list of targets in europe was much higher, about 2000 companies in europe, many of them defense contractors.[5] So, to summarize, it may be much easier to fall into this cone, than one would assume. The agency is also at odds with it's own claims as this this excerpt from a Guardian article [2] clearly shows: "The department does not engage in economic espionage in any domain, including cyber," the agency said in an emailed response to a Washington Post story on the subject last month. [...] "We collect this information for many important reasons: for one, it could provide the United States and our allies early warning of international financial crises which could negatively impact the global economy. It also could provide insight into other countries' economic policy or behavior which could affect global markets." But he again denied this amounted to industrial espionage. "What we do not do, as we have said many times, is use our foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of – or give intelligence we collect to – US companies to enhance their international competitiveness or increase their bottom line." [2] To me these statements are mutually exclusive: How is providing policy makers with insights from foreign politics and possible industrial espionage (i.e. not necessarily actual technologies, but research objectives of foreign companies) not giving an advantage to domestic companies, if those policy makers act appropriately? [0]https://theintercept.com/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://theintercept.com/2014/09/05/us-governments-plans-use... [1]https://www.cnet.com/tech/tech-industry/nsa-spied-on-eu-antitrust-official-who-sparred-with-us-tech-giants/ https://www.cnet.com/tech/tech-industry/nsa-spied-on-eu-anti... [2]https://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras https://www.theguardian.com/world/2013/sep/09/nsa-spying-bra... [3]https://www.spiegel.de/international/world/spiegel-exclusive-nsa-spies-on-international-bank-transactions-a-922276.html https://www.spiegel.de/international/world/spiegel-exclusive... [4] https://www.spiegel.de/international/europe/nsa-spying-european-parliamentarians-call-for-swift-suspension-a-922920.html https://www.spiegel.de/international/europe/nsa-spying-europ... [5] https://www.theregister.com/2015/04/30/airbus_us_german_intelligence/ https://www.theregister.com/2015/04/30/airbus_us_german_inte...
isykt 3y ago
100% agreed. If you’re concerned about privacy, being tracked online by corporations is a bigger concern than the the NSA. If you’re the target of an NSA investigation, you’re already fucked. Changing your network equipment is not going to help.
- Minor49er 3y ago
  On the contrary, changing equipment may actually help quite a bit when dealing with the NSA. The 2016 documentary "Zero Days" which was centered around the creation of Stuxnet showed that the NSA targeted specific hardware models to look for security holes. They had to buy matching hardware themselves and rigorously try to break it which took time and wasn't trivial to do
  - isykt 3y ago
    So you’re saying that no matter what hardware you have, the NSA will buy that specific hardware and take the time to break it.
    - Minor49er 3y ago
      That's right. And I'm also saying that switching hardware will make the break attempts take longer
      - isykt 3y ago
        And in the mean time, all my browsing, payment, and location data collected by corporate ad brokers got handed over to the NSA for just the cost of a letter. I don’t see the point in constantly changing hardware that I don’t even know is safe, just to prevent what will already happen.
        Minor49er 3y ago
        You don't see the point in constantly changing hardware, but you have no problem with changing subject, I see. I would encourage you to give Zero Days a watch sometime

tinco 3y ago

It's not about privacy, it's about security. If there's a backdoor in a HSM or network interface, that backdoor can be used by others as well. That might start with foreign nation states, but might eventually leak to regular private persons or entities as well. A backdoor is an extra attack vector with often very unfavorable properties that you as a user are unaware of.

slackfan 3y ago

Sure. See you in the gulag, comerade

RationPhantoms 3y ago
Oh please, the United States is so incredibly armed, my death will likely come at the hands of some misplaced right-wing militarized fascist group performing mass murders under the guise of "Freedom" and "A return to the constitutional purity of the US".
- digging 3y ago
  I mean, that more or less describes most police departments in the country. And they are spying on you.
- slackfan 3y ago
  I've been promised that that was going to happen any day now since the wrong person got elected back in 2000. Nearly a quarter century on I am beginning to suspect that somebody was overstating something, I can't quite put my finger on what though...
- salawat 3y ago
  You... could defend yourself you know. Cuts both ways.
MSFT_Edging 3y ago
Gulag is just Russian for prison. The US currently has about 1.2M people in their gulags, comrade*
- slackfan 3y ago
  Гулаг (gulag) is the acronym for "Гла́вное управле́ние исправи́тельно-трудовы́х лагере́й" which translates to "Head management office of correctional work camps". And if you're going to go for all incarcerated, the number is actually somewhere in the 2.1mil range in the US, because hey, jails are a thing. Sorry that you're wrong on all three points.
  - MSFT_Edging 3y ago
    Damn, you got me.
cpursley 3y ago
Comrade is of Latin origin. In Russian, tovarisch is the correct term. At least get it right if you're trying to be edgy.
- slackfan 3y ago
  Sounds like I hit a nerve?

runeofdoom 3y ago

And if you are in a position where nation-states are a likely adversary, you'd best assume that all commerically available hardware is compromised.

sschueller 3y ago

A Mann is being executed in Saudia Arabia for tweeting a negative tweet about the government to his tiny following. Not exactly someone who thinks they are a target of a nation state. [1] https://www.hrw.org/news/2023/08/29/saudi-arabia-man-sentenced-death-tweets https://www.hrw.org/news/2023/08/29/saudi-arabia-man-sentenc...

RationPhantoms 3y ago
Not sure if this a joke but SA is the exact country I would expect to utilize spyware against its citizens.
- MSFT_Edging 3y ago
  With how good of friends SA is with the US, its likely all they need to do is ask nicely for some dirt on an alleged dissident.

awesomeMilou 3y ago

> If you're not under the threat cone of nation state surveillance The average reader may be surprised by how far this cone can extend in some circumstances. It has been established that the NSA conducts industrial espionage [0], under the cover of national security [1]. To what degree the term "national security" narrows down the scope of any surveillance measures is likely unfamiliar to the laymen, but an NSA representative gave a short description on the agencies views to that regard in 2013: "The intelligence community's efforts to understand economic systems and policies, and monitor anomalous economic activities, are critical to providing policy makers with the information they need to make informed decisions that are in the best interest of our national security." [1] While it affirms that it does not steal trade secrets, the NSA reserves the right to pass on critical information about economic developments towards policy makers, who then can use this knowledge in their decision making. Notable examples of industrial espionage conducted by the NSA consisted of spying on EU antitrust regulators investigating Google for antitrust violations [1], alleged espionage of business conducted by brazilian oil giant Petrobas [2], international credit card transactions [3], SWIFT [4], and the infamous allegations of espionage against european defense company EADS [5]. It's noteworthy that this short list only comprises cases that got attention of the media, the actual list of targets in europe was much higher, about 2000 companies in europe, many of them defense contractors.[5] So, to summarize, it may be much easier to fall into this cone, than one would assume. The agency is also at odds with it's own claims as this this excerpt from a Guardian article [2] clearly shows: "The department does not engage in economic espionage in any domain, including cyber," the agency said in an emailed response to a Washington Post story on the subject last month. [...] "We collect this information for many important reasons: for one, it could provide the United States and our allies early warning of international financial crises which could negatively impact the global economy. It also could provide insight into other countries' economic policy or behavior which could affect global markets." But he again denied this amounted to industrial espionage. "What we do not do, as we have said many times, is use our foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of – or give intelligence we collect to – US companies to enhance their international competitiveness or increase their bottom line." [2] To me these statements are mutually exclusive: How is providing policy makers with insights from foreign politics and possible industrial espionage (i.e. not necessarily actual technologies, but research objectives of foreign companies) not giving an advantage to domestic companies, if those policy makers act appropriately? [0]https://theintercept.com/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://theintercept.com/2014/09/05/us-governments-plans-use... [1]https://www.cnet.com/tech/tech-industry/nsa-spied-on-eu-antitrust-official-who-sparred-with-us-tech-giants/ https://www.cnet.com/tech/tech-industry/nsa-spied-on-eu-anti... [2]https://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras https://www.theguardian.com/world/2013/sep/09/nsa-spying-bra... [3]https://www.spiegel.de/international/world/spiegel-exclusive-nsa-spies-on-international-bank-transactions-a-922276.html https://www.spiegel.de/international/world/spiegel-exclusive... [4] https://www.spiegel.de/international/europe/nsa-spying-european-parliamentarians-call-for-swift-suspension-a-922920.html https://www.spiegel.de/international/europe/nsa-spying-europ... [5] https://www.theregister.com/2015/04/30/airbus_us_german_intelligence/ https://www.theregister.com/2015/04/30/airbus_us_german_inte...

isykt 3y ago

100% agreed. If you’re concerned about privacy, being tracked online by corporations is a bigger concern than the the NSA. If you’re the target of an NSA investigation, you’re already fucked. Changing your network equipment is not going to help.

Minor49er 3y ago
On the contrary, changing equipment may actually help quite a bit when dealing with the NSA. The 2016 documentary "Zero Days" which was centered around the creation of Stuxnet showed that the NSA targeted specific hardware models to look for security holes. They had to buy matching hardware themselves and rigorously try to break it which took time and wasn't trivial to do
- isykt 3y ago
  So you’re saying that no matter what hardware you have, the NSA will buy that specific hardware and take the time to break it.
  - Minor49er 3y ago
    That's right. And I'm also saying that switching hardware will make the break attempts take longer
    - isykt 3y ago
      And in the mean time, all my browsing, payment, and location data collected by corporate ad brokers got handed over to the NSA for just the cost of a letter. I don’t see the point in constantly changing hardware that I don’t even know is safe, just to prevent what will already happen.
      - Minor49er 3y ago
        You don't see the point in constantly changing hardware, but you have no problem with changing subject, I see. I would encourage you to give Zero Days a watch sometime