3 ms·

When it comes down to it, practical encryption no longer exists. Every operating system now phones home and uploads copious event logs. Many users install cus

When it comes down to it, practical encryption no longer exists. Every operating system now phones home and uploads copious event logs. Many users install custom "swipe" keyboards, ad blockers, toolbars, and even bios chips are now programmable. There are just so many vectors and exfiltration paths, plus it's not enough for you to secure them all. The person you are talking to must also. Often encrypted messaging gives a false sense of security. Messages can still be intercepted on either end, and an automatic app update is sufficient to silently disable the encryption without the user knowing. edit: Since it seems that some are considering this baseless fear-mongering, here's just one recent example: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer... https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)

mdhb 2y ago
Sometimes it’s ok to not comment on topics you only know a little bit about.
- aeternum 2y ago
  Why not point out which parts of my comment you feel are incorrect?
rowanG077 2y ago
What is my Linux OS supposed to phone home to? Linus torvalds build machine?
- honestjohn 2y ago
  You mean you didn't install the Yahoo! translation extension to your kernel?
- aeternum 2y ago
  What percentage of Telegram users access it exclusively via Linux?
  - rowanG077 2y ago
    This is what you said, among others: > Every operating system now phones home and uploads copious event logs. There is nothing about telegram in there.
    - aeternum 2y ago
      Linux distros are much better but they can still phone home. Here's one example: https://help.ubuntu.com/community/UbuntuPopularityContest https://help.ubuntu.com/community/UbuntuPopularityContest For awhile Canonical had a deal with Amazon that was highly questionable. https://www.gnu.org/philosophy/ubuntu-spyware.en.html https://www.gnu.org/philosophy/ubuntu-spyware.en.html The most dangerous however is the auto-updates. Even if the software is safe today, how do you know what tomorrow's auto-update will bring?
- squarefoot 2y ago
  Whoever forced it to use binary only blobs, like those employed by every wireless network card, can instruct it to exfiltrate users data to be sent anywhere, be it the manufacturers' or whichever entity they're controlled by. Closed chipsets not using blobs aren't immune either as malicious firmware can be implemented in iron only. Sadly, we can't completely trust any system without total software and hardware openness, at least in all subsystems that deal with sensitive data.
  - dvdkon 2y ago
    Nowadays NICs only have access to encrypted packets, so such a backdoor would have to be in the CPU. I'm not saying such a thing doesn't exist, but I think it's pretty clear its use would have to be very targeted for nobody to have noticed so far (unless there's a grand conspiracy between all computers to hide clandestine Ethernet traffic).
  - lm28469 2y ago
    I mean if that's your threat vector you cannot trust anything nor anyone ever about anything at all. The dude you just shook hand with might have had a glove and stole your finger prints. The post employee you just gave your check to mail might be a impostor. The guy you're about to meet from craigslist might steal your iPhone and cut your thumb to access your entire digital life. Ah but no, you're an average Joe and nobody gives a flying fuck about any of these. Even if the software is totally open-source: unless you also made the hardware: it doesn't matter, unless you compiled all of it (and at that point probably wrote the compiler yourself as well as the os you're using) and installed yourself: it doesn't matter, unless you actually went though every single line of code and checked for yourself that every thing is safe (which you cannot): it doesn't matter
    - squarefoot 2y ago
      My point has nothing to do with absurd conspiracies, but that technically, I repeat :technically, given enough motivation and resources which probably only governments have, there are ways to defeat encryption by planting backdoors into closed firmware so that data is being read before it even reaches the encryption layer. It's very hard to do, but it's 100% possible. You think the USB driver managing your keyboard doesn't have access to all text you write, including passwords? Well, have it talk using a covert channel with the blob running into your network card and all your text is magically sent elsewhere. Again: hard, still possible.
- paxys 2y ago
  That is covered by the word "practical" in their comment. No regular (as in, not technically educated or minded) person can even begin to use Linux on their devices. Heck most are almost exclusively using iOS or Android.
  - rowanG077 2y ago
    Really? Linux usage has been climbing quickly the last few years. We have a mainstream gaming machine by one of the largest gaming companies using arch linux. I really don't buy this argument anymore at this point.
- xdavidliu 2y ago
  ahem, Richard Stallman slash Linus Torvalds' build machine but in seriousness, it doesn't need to be the OS itself of course, just any software that runs on the OS
beefnugs 2y ago
these are all reasons to be more cognizant about it. Try to use lineage or grapheneOS, minimize software installs on important computers. Have multiple more segregated and specialized computers running. Whitelist only networking, network overlays.

mdhb 2y ago

Sometimes it’s ok to not comment on topics you only know a little bit about.

aeternum 2y ago
Why not point out which parts of my comment you feel are incorrect?

rowanG077 2y ago

What is my Linux OS supposed to phone home to? Linus torvalds build machine?

honestjohn 2y ago
You mean you didn't install the Yahoo! translation extension to your kernel?
aeternum 2y ago
What percentage of Telegram users access it exclusively via Linux?
- rowanG077 2y ago
  This is what you said, among others: > Every operating system now phones home and uploads copious event logs. There is nothing about telegram in there.
  - aeternum 2y ago
    Linux distros are much better but they can still phone home. Here's one example: https://help.ubuntu.com/community/UbuntuPopularityContest https://help.ubuntu.com/community/UbuntuPopularityContest For awhile Canonical had a deal with Amazon that was highly questionable. https://www.gnu.org/philosophy/ubuntu-spyware.en.html https://www.gnu.org/philosophy/ubuntu-spyware.en.html The most dangerous however is the auto-updates. Even if the software is safe today, how do you know what tomorrow's auto-update will bring?
squarefoot 2y ago
Whoever forced it to use binary only blobs, like those employed by every wireless network card, can instruct it to exfiltrate users data to be sent anywhere, be it the manufacturers' or whichever entity they're controlled by. Closed chipsets not using blobs aren't immune either as malicious firmware can be implemented in iron only. Sadly, we can't completely trust any system without total software and hardware openness, at least in all subsystems that deal with sensitive data.
- dvdkon 2y ago
  Nowadays NICs only have access to encrypted packets, so such a backdoor would have to be in the CPU. I'm not saying such a thing doesn't exist, but I think it's pretty clear its use would have to be very targeted for nobody to have noticed so far (unless there's a grand conspiracy between all computers to hide clandestine Ethernet traffic).
- lm28469 2y ago
  I mean if that's your threat vector you cannot trust anything nor anyone ever about anything at all. The dude you just shook hand with might have had a glove and stole your finger prints. The post employee you just gave your check to mail might be a impostor. The guy you're about to meet from craigslist might steal your iPhone and cut your thumb to access your entire digital life. Ah but no, you're an average Joe and nobody gives a flying fuck about any of these. Even if the software is totally open-source: unless you also made the hardware: it doesn't matter, unless you compiled all of it (and at that point probably wrote the compiler yourself as well as the os you're using) and installed yourself: it doesn't matter, unless you actually went though every single line of code and checked for yourself that every thing is safe (which you cannot): it doesn't matter
  - squarefoot 2y ago
    My point has nothing to do with absurd conspiracies, but that technically, I repeat :technically, given enough motivation and resources which probably only governments have, there are ways to defeat encryption by planting backdoors into closed firmware so that data is being read before it even reaches the encryption layer. It's very hard to do, but it's 100% possible. You think the USB driver managing your keyboard doesn't have access to all text you write, including passwords? Well, have it talk using a covert channel with the blob running into your network card and all your text is magically sent elsewhere. Again: hard, still possible.
paxys 2y ago
That is covered by the word "practical" in their comment. No regular (as in, not technically educated or minded) person can even begin to use Linux on their devices. Heck most are almost exclusively using iOS or Android.
- rowanG077 2y ago
  Really? Linux usage has been climbing quickly the last few years. We have a mainstream gaming machine by one of the largest gaming companies using arch linux. I really don't buy this argument anymore at this point.
xdavidliu 2y ago
ahem, Richard Stallman slash Linus Torvalds' build machine but in seriousness, it doesn't need to be the OS itself of course, just any software that runs on the OS

beefnugs 2y ago

these are all reasons to be more cognizant about it. Try to use lineage or grapheneOS, minimize software installs on important computers. Have multiple more segregated and specialized computers running. Whitelist only networking, network overlays.