5 ms·

> None of the proprietary browsers will track you. Can you elaborate a bit on this, how do you know they won't? My default assumption is that anything I can't

by snitko 13y ago

> None of the proprietary browsers will track you. Can you elaborate a bit on this, how do you know they won't? My default assumption is that anything I can't see the source code of and compile myself is compromised.

colanderman 13y ago
You can always run Wireshark to see if/when they phone home.
- TeMPOraL 13y ago
  Unless they frequency-modulate the packets they send home to transmit additional data and you'd probably never figure it out looking at Wireshark output that they are sending more than meets the eye. This is a simple trick; there are probably many other I can't even think of.
  - colanderman 13y ago
    I've never heard the term "frequency-modulate" applied to software, and Wikipedia only knows about the radio kind of modulation. Can you please explain what this is?
    - simmons 13y ago
      This is an interesting idea. I assume by "frequency modulation" of data, he means adjusting the timing of the transmissions to create an out-of-band channel that might be more difficult to notice when packet sniffing. As a crude example, if I uploaded War and Peace to you, not as a steady stream of traffic, but as bursts of dots and dashes, I could send "The Magic Words are Squeamish Ossifrage" in Morse code. (Although in the context of apps phoning phone, I'm not sure what the advantage is over simply encrypting the stream...)
      - TeMPOraL 13y ago
        That is exactly what I meant :).
throwit1979 13y ago
Sociologically: there is a surprisingly large contingent of people who believe that if a company makes a claim, it's the God's honest Truth. The OP may not necessarily fall into this camp. Technically: if the browsers were somehow phoning home, even if the data were highly fuzzed, I'm sure there would be guys like tpatcek who would manage to detail, if not the content of the tracking, at least the amount of data sent and the targets. I don't recall there being such a scandal in recent memory.
- comex 13y ago
  Indeed. To quote myself in another reply: > Although proprietary software may be easier for a government to compel to be modified to add tracking, it still runs the risk of being noticed in most reasonable cases, and there is in fact no evidence that any Western government is doing any such thing. It does increase the chance that you are being tracked due to incompetence, but I don't think this is particularly likely for such well-known software.
- snitko 13y ago
  It is possible to send data along with other data so that it's reaaally hard to find. Also, they don't need to send data all the time, but rather activate this mode on request, say when a person using this browser is a suspect for some reason and govt needs to track his every move on the internet. This would make detecting of such a functionality virtually impossible, because it'd be turned off most of the time for most people.
  - comex 13y ago
    It is possible. However, considering that it would only take one person being exceptionally curious with IDA, one employee to blow the whistle (the source is still "open" to a fairly large number of people, and a backdoor is far harder to hide than passive collection of existing data), or one slipup to cause a massive amount of PR damage, and this has never occurred, nor does the Snowden leak suggest this is happening, I personally consider this claim extremely improbable. YMMV.
  - TeMPOraL 13y ago
blhack 13y ago
>My default assumption is that anything I can't see the source code of and compile myself is compromised. Did you also write and compile the compiler that compiled your compiler?
- justinreeves 13y ago
  He very well may have, since you compile gcc using gcc.
  - blhack 13y ago
    And where did the bin version of GCC he or she used to compile that version of GCC come from? Eventually, somewhere down the chain, you have to have trusted a compiler that wasn't GCC and you probably don't have the source to.
    - marcell 13y ago
      Diff the binaries :)
      - KnightHawk3 13y ago
        If they really want to get you they could use a birthday attack? Since we are talking about checking the compiler that compiles your compiler here.
      - gohrt 13y ago
        Which a diff tool you compiled your self, or looking at the hard drive with a magnifying glass?
  - willvarfar 13y ago
    I think blhack was referring to Ken Thompson's ACM Turing Award acceptance speech "Reflections On Trusting Trust"? http://c2.com/cgi/wiki?TheKenThompsonHack http://c2.com/cgi/wiki?TheKenThompsonHack "a hack (in every sense), the most subversive ever perpetrated, nothing less than the root password of all evil." A very very good read :)
stinos 13y ago
Do you inspect every single line of code? Or at least grep the file list to see if you find a suspicious looking name? Don't think so. Your default assumption should thus be 'everything is compromised' since you did not verify it :]

by snitko 13y ago

colanderman 13y ago

You can always run Wireshark to see if/when they phone home.

TeMPOraL 13y ago
Unless they frequency-modulate the packets they send home to transmit additional data and you'd probably never figure it out looking at Wireshark output that they are sending more than meets the eye. This is a simple trick; there are probably many other I can't even think of.
- colanderman 13y ago
  I've never heard the term "frequency-modulate" applied to software, and Wikipedia only knows about the radio kind of modulation. Can you please explain what this is?
  - simmons 13y ago
    This is an interesting idea. I assume by "frequency modulation" of data, he means adjusting the timing of the transmissions to create an out-of-band channel that might be more difficult to notice when packet sniffing. As a crude example, if I uploaded War and Peace to you, not as a steady stream of traffic, but as bursts of dots and dashes, I could send "The Magic Words are Squeamish Ossifrage" in Morse code. (Although in the context of apps phoning phone, I'm not sure what the advantage is over simply encrypting the stream...)
    - TeMPOraL 13y ago
      That is exactly what I meant :).

throwit1979 13y ago

Sociologically: there is a surprisingly large contingent of people who believe that if a company makes a claim, it's the God's honest Truth. The OP may not necessarily fall into this camp. Technically: if the browsers were somehow phoning home, even if the data were highly fuzzed, I'm sure there would be guys like tpatcek who would manage to detail, if not the content of the tracking, at least the amount of data sent and the targets. I don't recall there being such a scandal in recent memory.

comex 13y ago
Indeed. To quote myself in another reply: > Although proprietary software may be easier for a government to compel to be modified to add tracking, it still runs the risk of being noticed in most reasonable cases, and there is in fact no evidence that any Western government is doing any such thing. It does increase the chance that you are being tracked due to incompetence, but I don't think this is particularly likely for such well-known software.
snitko 13y ago
It is possible to send data along with other data so that it's reaaally hard to find. Also, they don't need to send data all the time, but rather activate this mode on request, say when a person using this browser is a suspect for some reason and govt needs to track his every move on the internet. This would make detecting of such a functionality virtually impossible, because it'd be turned off most of the time for most people.
- comex 13y ago
  It is possible. However, considering that it would only take one person being exceptionally curious with IDA, one employee to blow the whistle (the source is still "open" to a fairly large number of people, and a backdoor is far harder to hide than passive collection of existing data), or one slipup to cause a massive amount of PR damage, and this has never occurred, nor does the Snowden leak suggest this is happening, I personally consider this claim extremely improbable. YMMV.
- TeMPOraL 13y ago

blhack 13y ago

>My default assumption is that anything I can't see the source code of and compile myself is compromised. Did you also write and compile the compiler that compiled your compiler?

justinreeves 13y ago
He very well may have, since you compile gcc using gcc.
- blhack 13y ago
  And where did the bin version of GCC he or she used to compile that version of GCC come from? Eventually, somewhere down the chain, you have to have trusted a compiler that wasn't GCC and you probably don't have the source to.
  - marcell 13y ago
    Diff the binaries :)
    - KnightHawk3 13y ago
      If they really want to get you they could use a birthday attack? Since we are talking about checking the compiler that compiles your compiler here.
    - gohrt 13y ago
      Which a diff tool you compiled your self, or looking at the hard drive with a magnifying glass?
- willvarfar 13y ago
  I think blhack was referring to Ken Thompson's ACM Turing Award acceptance speech "Reflections On Trusting Trust"? http://c2.com/cgi/wiki?TheKenThompsonHack http://c2.com/cgi/wiki?TheKenThompsonHack "a hack (in every sense), the most subversive ever perpetrated, nothing less than the root password of all evil." A very very good read :)

stinos 13y ago

Do you inspect every single line of code? Or at least grep the file list to see if you find a suspicious looking name? Don't think so. Your default assumption should thus be 'everything is compromised' since you did not verify it :]