5 ms·

When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but government

When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but governments can't exercise power over something they cannot control, and truly private communications would take away some of that control. To me there are no conspiracy theories or other strange reasons for being able to decrypt any seemingly private information except the will to preserve the status quo at any cost, which implies knowing in advance what a potential adversary may think or do. I would expect every device to be bugged for that reason, including all cellphones and computers and associated hardware, from CPUs with closed subsystems down to network chipsets with closed firmware. There will be no way to ensure private communications until someone will find a way to make a device which is 100% open and auditable from the operating system to the CPU, from all chipsets down to the last screw.

iballing 3y ago
“100% open and auditable from the operating system to the cpu” is the main goal of the Betrusted project: https://betrusted.io/ https://betrusted.io/
- ramesh31 3y ago
  >“100% open and auditable from the operating system to the cpu” is the main goal of the Betrusted project: https://betrusted.io/ https://betrusted.io/ Hopefully there's a 4G version coming. This seems too good to be true.
  - RF_Savage 3y ago
    The 4G modem is exceedingly unlikely to be audittable. Something like srsUE is not welcome on many telcos networks and requires some decently beefy hardware to run.
  - 0xCMP 3y ago
    It's possible to modify it and add a 4G modem, but that would probably be third-party. The creators of the project suggest using your phone's hotspot if you need connectivity when not connected to Wi-fi (something I heard in interviews they gave).
- Fnoord 3y ago
  Which seems to be an iteration of the Precursor (Mobile, Open Hardware, RISC-V System-on-Chip (SoC) Development Kit) by Bunnie Huang and Sean Cobs > Part of the purpose of Precursor is to validate the system-on-chip (SoC) design we hope eventually to produce as a custom ASIC for use in future such products. This SoC, which we call "Betrusted-SoC," is meant to be the central pillar of security for devices like Precursor. The version of Betrusted-SoC used in Precursor is based on a Xilinx FPGA and has the following features [...] [1] As for the person who replied to you requesting LTE: won't happen, there's no completely FOSS stack for LTE. Always there is closed source firmware due to regulations. Oh, that wonderful world of transceivers. If you want FOSS, go wired. Tho it seems Precursor found a way to utilize Wi-Fi with a FOSS stack? [1] https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
wombat-man 3y ago
For sure, but since a state has basically unlimited resources to find vulnerabilities, I'd assume it's possible for state actors to reach a target if they are determined enough. Might as well make it difficult though.
AndrewKemendo 3y ago
This is the right approach IMO. Just assume you’re being persistently surveilled - if you use a computer or electronics then the likelihood approaches 100% over your lifetime.
- phito 3y ago
  I try to have this approach, but I find it so exhausting tbh. It makes me want to just not use technology.
- flangola7 3y ago
  If you have to take this approach they have already won
  - AndrewKemendo 3y ago
    You are correct, “they” have won so far unfortunately Doesn’t mean we don’t do anything about it, just means we have to acknowledge reality
mbakke 3y ago
I generally hold a similar opinion. However I have two data points that suggests back-doors are not available by default (for my government at least), but that they are aggressively bugging (or auditing, lol) devices: * When I ordered the first generation Raspberry Pi, they were stuck in the toll a long time, and when they arrived all the warranty seals were broken. Consequently I never really used them. * When I ordered the first generation Google Pixel, before it was generally available in my country, it was stuck in domestic mail for almost a week. The person who imported them sold and sent two phones the same day: the other one arrived after just two days and travelled a lot further. I used it regardless as I already considered phones a lost cause... (and could not with good conscience sell a possibly compromised device). At this point I don't trust anything sent by mail.
- TheRealDunkirk 3y ago
  You act like the NSA has been caught intercepting Cisco switches during shipping, and installing backdoored firmware, or something. Crazy conspiracy theorists...
- ilyt 3y ago
  I just assume I'm not interested enough to be spied upon by randoms > When I ordered the first generation Raspberry Pi, they were stuck in the toll a long time, and when they arrived all the warranty seals were broken. Consequently I never really used them. If state have means to bug raspberry pi it has means to re-seal the box...
  - mbakke 3y ago
    > If state have means to bug raspberry pi it has means to re-seal the box... That's a good point that I never made sense of. The most likely explanation is simply an oversealouz toll agent. It just left a bad taste in my mouth so I didn't want to play with them... I had largely forgotten about it until the Google Pixel got stuck.
  - backtoyoujim 3y ago
    unless they wanted you to know and feel threatened by it
tromp 3y ago
If I want to do some computation that should not be spied on, I can still program it in BASIC on my Sinclair ZX Spectrum. If it doesn't fit in its measly 48KB of RAM, I'm probably still safe programming it on my Commodore Amiga 500. Basically, you can only trust things manufactured before "going online" became a thing.
- fallat 3y ago
  or you know, just don't connect your computer online.
  - doublerabbit 3y ago
    And ensure it's not by any windows, the case HD LED doesn't blink nor does the FAN make any noise.
    - TacticalCoder 3y ago
      Hardware and software backdoors does scale. Data exfiltration through audio / fan speed / LEDs blinking / power draw / etc. simply doesn't. I think that a discussion about metric shitloads of networking gear being compromised is not the place to make fun of the few that didn't compromise on security. There's a place for offline/airgapped devices and private keys (PGP keys, seeds, whatever) being generated by throwing dice. If anything all these backdoors do show that math/cryptography do work. The NSA's budget may be 100% of the US GDP, they still wouldn't be changing Sun's gravity or the math behind cryptography. The joke today is on those who kept making fun of those who didn't trade security for convenience.
    - tromp 3y ago
      Both these computers were fan-less, like nearly all hobby computers at the time (clockspeeds were single digit Mhz). The Amiga only had a floppy disk drive.
13of40 3y ago
"If it's technically possible, they're doing it." It's their job.
- dizhn 3y ago
  If it exists, they're buying it. (States)
archontes 3y ago
It's clear that they feel that way also. The engineer Andreas Spiess recently appeared in a briefing on dangerous, anarchy-enabling technologies simply for making a youtube video on an encrypted messaging protocol over lora mesh networking. They're carefully watching and cataloging any communications technology they can't compromise.
- s3p 3y ago
  It's also hard to distinguish between legitimate security threats and scare tactics designed to make us think we're in danger. Remember the Bloomberg Supermicro "bombshell"[0]? I still don't know if that was ever confirmed true or false, but to my knowledge Bloomberg never retracted it. [0] https://www.theregister.com/2021/02/12/supermicro_bloomberg_spying/ https://www.theregister.com/2021/02/12/supermicro_bloomberg_...
  - Lammy 3y ago
    I still believe it. Wouldn't surprise me if ASPEED were a "SIGINT enabled" vendor as well. It would be foolish not to target the most widespread BMC platform.
- SamPatt 3y ago
  The guy with the Swiss accent? What's your source on this?
  - dariosalvi78 3y ago
    https://www.youtube.com/watch?v=EAQI2ZSmxPU https://www.youtube.com/watch?v=EAQI2ZSmxPU
- lawlessone 3y ago
  TBF that same tech would probably be great for them or militaries to have.
  - dkqmduems 3y ago
mk89 3y ago
If that is the case they are doing a pretty s** job spying on people, considering the amount of harm being done to children (and people in general).
- irreticent 3y ago
  I wouldn't say they are doing a bad job spying on people for that reason; I think it's more likely that the reason they are spying is not to help children/people but rather to strengthen their control over the people. Knowledge is power and they want to be more powerful than everyone else. I've always assumed that the spying wasn't altruistic but more for selfish reasons.
- eastbound 3y ago
  This. All of this spying, not even being used for security ever, ie their goal might as well be general insecurity. It feels like their goal is the stability of the social layers, no or rare promotion, and maximum impermeability for the masses.
deleted 3y ago
[deleted]

iballing 3y ago

“100% open and auditable from the operating system to the cpu” is the main goal of the Betrusted project: https://betrusted.io/ https://betrusted.io/

ramesh31 3y ago
>“100% open and auditable from the operating system to the cpu” is the main goal of the Betrusted project: https://betrusted.io/ https://betrusted.io/ Hopefully there's a 4G version coming. This seems too good to be true.
- RF_Savage 3y ago
  The 4G modem is exceedingly unlikely to be audittable. Something like srsUE is not welcome on many telcos networks and requires some decently beefy hardware to run.
- 0xCMP 3y ago
  It's possible to modify it and add a 4G modem, but that would probably be third-party. The creators of the project suggest using your phone's hotspot if you need connectivity when not connected to Wi-fi (something I heard in interviews they gave).
Fnoord 3y ago
Which seems to be an iteration of the Precursor (Mobile, Open Hardware, RISC-V System-on-Chip (SoC) Development Kit) by Bunnie Huang and Sean Cobs > Part of the purpose of Precursor is to validate the system-on-chip (SoC) design we hope eventually to produce as a custom ASIC for use in future such products. This SoC, which we call "Betrusted-SoC," is meant to be the central pillar of security for devices like Precursor. The version of Betrusted-SoC used in Precursor is based on a Xilinx FPGA and has the following features [...] [1] As for the person who replied to you requesting LTE: won't happen, there's no completely FOSS stack for LTE. Always there is closed source firmware due to regulations. Oh, that wonderful world of transceivers. If you want FOSS, go wired. Tho it seems Precursor found a way to utilize Wi-Fi with a FOSS stack? [1] https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor

wombat-man 3y ago

For sure, but since a state has basically unlimited resources to find vulnerabilities, I'd assume it's possible for state actors to reach a target if they are determined enough. Might as well make it difficult though.

AndrewKemendo 3y ago

This is the right approach IMO. Just assume you’re being persistently surveilled - if you use a computer or electronics then the likelihood approaches 100% over your lifetime.

phito 3y ago
I try to have this approach, but I find it so exhausting tbh. It makes me want to just not use technology.
flangola7 3y ago
If you have to take this approach they have already won
- AndrewKemendo 3y ago
  You are correct, “they” have won so far unfortunately Doesn’t mean we don’t do anything about it, just means we have to acknowledge reality

mbakke 3y ago

I generally hold a similar opinion. However I have two data points that suggests back-doors are not available by default (for my government at least), but that they are aggressively bugging (or auditing, lol) devices: * When I ordered the first generation Raspberry Pi, they were stuck in the toll a long time, and when they arrived all the warranty seals were broken. Consequently I never really used them. * When I ordered the first generation Google Pixel, before it was generally available in my country, it was stuck in domestic mail for almost a week. The person who imported them sold and sent two phones the same day: the other one arrived after just two days and travelled a lot further. I used it regardless as I already considered phones a lost cause... (and could not with good conscience sell a possibly compromised device). At this point I don't trust anything sent by mail.

TheRealDunkirk 3y ago
You act like the NSA has been caught intercepting Cisco switches during shipping, and installing backdoored firmware, or something. Crazy conspiracy theorists...
ilyt 3y ago
I just assume I'm not interested enough to be spied upon by randoms > When I ordered the first generation Raspberry Pi, they were stuck in the toll a long time, and when they arrived all the warranty seals were broken. Consequently I never really used them. If state have means to bug raspberry pi it has means to re-seal the box...
- mbakke 3y ago
  > If state have means to bug raspberry pi it has means to re-seal the box... That's a good point that I never made sense of. The most likely explanation is simply an oversealouz toll agent. It just left a bad taste in my mouth so I didn't want to play with them... I had largely forgotten about it until the Google Pixel got stuck.
- backtoyoujim 3y ago
  unless they wanted you to know and feel threatened by it

tromp 3y ago

If I want to do some computation that should not be spied on, I can still program it in BASIC on my Sinclair ZX Spectrum. If it doesn't fit in its measly 48KB of RAM, I'm probably still safe programming it on my Commodore Amiga 500. Basically, you can only trust things manufactured before "going online" became a thing.

fallat 3y ago
or you know, just don't connect your computer online.
- doublerabbit 3y ago
  And ensure it's not by any windows, the case HD LED doesn't blink nor does the FAN make any noise.
  - TacticalCoder 3y ago
    Hardware and software backdoors does scale. Data exfiltration through audio / fan speed / LEDs blinking / power draw / etc. simply doesn't. I think that a discussion about metric shitloads of networking gear being compromised is not the place to make fun of the few that didn't compromise on security. There's a place for offline/airgapped devices and private keys (PGP keys, seeds, whatever) being generated by throwing dice. If anything all these backdoors do show that math/cryptography do work. The NSA's budget may be 100% of the US GDP, they still wouldn't be changing Sun's gravity or the math behind cryptography. The joke today is on those who kept making fun of those who didn't trade security for convenience.
  - tromp 3y ago
    Both these computers were fan-less, like nearly all hobby computers at the time (clockspeeds were single digit Mhz). The Amiga only had a floppy disk drive.

13of40 3y ago

"If it's technically possible, they're doing it." It's their job.

dizhn 3y ago
If it exists, they're buying it. (States)

archontes 3y ago

It's clear that they feel that way also. The engineer Andreas Spiess recently appeared in a briefing on dangerous, anarchy-enabling technologies simply for making a youtube video on an encrypted messaging protocol over lora mesh networking. They're carefully watching and cataloging any communications technology they can't compromise.

s3p 3y ago
It's also hard to distinguish between legitimate security threats and scare tactics designed to make us think we're in danger. Remember the Bloomberg Supermicro "bombshell"[0]? I still don't know if that was ever confirmed true or false, but to my knowledge Bloomberg never retracted it. [0] https://www.theregister.com/2021/02/12/supermicro_bloomberg_spying/ https://www.theregister.com/2021/02/12/supermicro_bloomberg_...
- Lammy 3y ago
  I still believe it. Wouldn't surprise me if ASPEED were a "SIGINT enabled" vendor as well. It would be foolish not to target the most widespread BMC platform.
SamPatt 3y ago
The guy with the Swiss accent? What's your source on this?
- dariosalvi78 3y ago
  https://www.youtube.com/watch?v=EAQI2ZSmxPU https://www.youtube.com/watch?v=EAQI2ZSmxPU
lawlessone 3y ago
TBF that same tech would probably be great for them or militaries to have.
- dkqmduems 3y ago

mk89 3y ago

If that is the case they are doing a pretty s** job spying on people, considering the amount of harm being done to children (and people in general).

irreticent 3y ago
I wouldn't say they are doing a bad job spying on people for that reason; I think it's more likely that the reason they are spying is not to help children/people but rather to strengthen their control over the people. Knowledge is power and they want to be more powerful than everyone else. I've always assumed that the spying wasn't altruistic but more for selfish reasons.
eastbound 3y ago
This. All of this spying, not even being used for security ever, ie their goal might as well be general insecurity. It feels like their goal is the stability of the social layers, no or rare promotion, and maximum impermeability for the masses.

deleted 3y ago

[deleted]