4 ms·

The ultimate serverless dead drop was a USB thumb drive epoxied into a hole in the wall, with only the port sticking out. The only criteria the thumb drive in

The ultimate serverless dead drop was a USB thumb drive epoxied into a hole in the wall, with only the port sticking out. The only criteria the thumb drive in the wall fails is "Accessible via Tor to protect against traffic analysis.", however it doesn't need network access at all so I think it is kind of a moot point. There is some minor risk of surveillance on the site, but that can be defeated with a fake mustache or whatever. Also physical security risk, the drive might be designed to damage computers that connect to it via a voltage spike.

gsliepen 2y ago
How about a little microcontroller and SD card entirely encapsulated in a brick, with a coil for power and communication with the outside world?
- pitaj 2y ago
  May as well just use RFID tags, unless you have a lot of data.
- adolph 2y ago
  Pull in power inductively from power lines to recharge battery. [0] Use ESP chip with rechargable coin cell [1]. Only turn on chip with no ssid broadcast every hour at some odd minute for a short time. [2] Put/get only URI & decrypt key, main body is on Mega or similar. Might also make for a neat Geocache. 0. https://hackaday.com/2024/01/27/harvesting-electricity-from-high-voltage-transmission-lines-using-fences/ https://hackaday.com/2024/01/27/harvesting-electricity-from-... 1. https://www.instructables.com/Remote-Control-ESP8266-With-Coin-Cell/ https://www.instructables.com/Remote-Control-ESP8266-With-Co... 2. https://arduino-esp8266.readthedocs.io/en/latest/esp8266wifi/soft-access-point-class.html https://arduino-esp8266.readthedocs.io/en/latest/esp8266wifi...
  - password4321 2y ago
    Put that on a solar-powered drone that sleeps on commercial roofs where there is free WiFi, autonomously finding another if discovered. Drones on power lines: https://www.zmescience.com/science/news-science/drones-recharging-from-power/ https://www.zmescience.com/science/news-science/drones-recha...
fhub 2y ago
The increase in density of security cameras makes physical dead drops less ultimate than they once were. As a thought exercise I sometimes wonder how far I can go from a specific location without being captured on a camera.
- 01HNNWZ0MV43FF 2y ago
  I don't think I can even leave my neighborhood. I hate it.
  - redeux 2y ago
    One of my previous homes was in a neighborhood that put a security camera at the entry roundabout, ostensibly because “teenagers were doing drugs.” It was one of my deciding factors to leave that neighborhood.
  - normie3000 2y ago
    Don't worry, you'll get used to it. And then you'll be scared to live without it.
  - 0cf8612b2e1e 2y ago
    Even if you could, there are now satellites and airplanes capturing photos of major cities constantly. GMan is not yet using that to track dope dealers, but it is not impossible to imagine access to this data being “democratized” to other government agencies.
    - 01HNNWZ0MV43FF 2y ago
      Yeah Gorgon Stares make me wanna kill myself
- hughesjj 2y ago
  Parks, woods, thermal camera Worst case you could try underwater All significantly harder though
  - 2y ago
ayende 2y ago
Actually, if you want that, go with a rapberry pi with a hidden Ssid All you need is to e loitering nearby, connect and drop the data then move But phyaical tracking is very much a threat
vhcr 2y ago
Have fun getting hacked with BadUSB.
atoav 2y ago
I think the best way to do a public dead drop would be to use something that is already there and transfer in a way that looks normal. E.g. giving a certain shop in a mall a modified EC card reader and then have your courier "pay" via NFC. Ideally you'd like your data transfer to be completely invisible even to watching eyes, ears and attenas, so the best option is to use signals (or the absence of signals) one would expect to be there.
4star3star 2y ago
I'm trying to think of a reason not to just drop a microSD card in the mail addressed to the journo. Are we going to do better than physical media delivery? The only way to be found out would be some sort of surveillance of the mailbox or your fingerprints/DNA, which you could be careful with.
- ranger_danger 2y ago
  > surveillance That's how they got the Harvard bomb threat suspect. Even though he was using Tor, he was one of only a few people directly accessing it from the university's network at the time it was sent, and they had logs.

gsliepen 2y ago

How about a little microcontroller and SD card entirely encapsulated in a brick, with a coil for power and communication with the outside world?

pitaj 2y ago
May as well just use RFID tags, unless you have a lot of data.
adolph 2y ago
Pull in power inductively from power lines to recharge battery. [0] Use ESP chip with rechargable coin cell [1]. Only turn on chip with no ssid broadcast every hour at some odd minute for a short time. [2] Put/get only URI & decrypt key, main body is on Mega or similar. Might also make for a neat Geocache. 0. https://hackaday.com/2024/01/27/harvesting-electricity-from-high-voltage-transmission-lines-using-fences/ https://hackaday.com/2024/01/27/harvesting-electricity-from-... 1. https://www.instructables.com/Remote-Control-ESP8266-With-Coin-Cell/ https://www.instructables.com/Remote-Control-ESP8266-With-Co... 2. https://arduino-esp8266.readthedocs.io/en/latest/esp8266wifi/soft-access-point-class.html https://arduino-esp8266.readthedocs.io/en/latest/esp8266wifi...
- password4321 2y ago
  Put that on a solar-powered drone that sleeps on commercial roofs where there is free WiFi, autonomously finding another if discovered. Drones on power lines: https://www.zmescience.com/science/news-science/drones-recharging-from-power/ https://www.zmescience.com/science/news-science/drones-recha...

fhub 2y ago

The increase in density of security cameras makes physical dead drops less ultimate than they once were. As a thought exercise I sometimes wonder how far I can go from a specific location without being captured on a camera.

01HNNWZ0MV43FF 2y ago
I don't think I can even leave my neighborhood. I hate it.
- redeux 2y ago
  One of my previous homes was in a neighborhood that put a security camera at the entry roundabout, ostensibly because “teenagers were doing drugs.” It was one of my deciding factors to leave that neighborhood.
- normie3000 2y ago
  Don't worry, you'll get used to it. And then you'll be scared to live without it.
- 0cf8612b2e1e 2y ago
  Even if you could, there are now satellites and airplanes capturing photos of major cities constantly. GMan is not yet using that to track dope dealers, but it is not impossible to imagine access to this data being “democratized” to other government agencies.
  - 01HNNWZ0MV43FF 2y ago
    Yeah Gorgon Stares make me wanna kill myself
hughesjj 2y ago
Parks, woods, thermal camera Worst case you could try underwater All significantly harder though
- 2y ago

ayende 2y ago

Actually, if you want that, go with a rapberry pi with a hidden Ssid All you need is to e loitering nearby, connect and drop the data then move But phyaical tracking is very much a threat

vhcr 2y ago

Have fun getting hacked with BadUSB.

atoav 2y ago

I think the best way to do a public dead drop would be to use something that is already there and transfer in a way that looks normal. E.g. giving a certain shop in a mall a modified EC card reader and then have your courier "pay" via NFC. Ideally you'd like your data transfer to be completely invisible even to watching eyes, ears and attenas, so the best option is to use signals (or the absence of signals) one would expect to be there.

4star3star 2y ago

I'm trying to think of a reason not to just drop a microSD card in the mail addressed to the journo. Are we going to do better than physical media delivery? The only way to be found out would be some sort of surveillance of the mailbox or your fingerprints/DNA, which you could be careful with.

ranger_danger 2y ago
> surveillance That's how they got the Harvard bomb threat suspect. Even though he was using Tor, he was one of only a few people directly accessing it from the university's network at the time it was sent, and they had logs.