7 ms·
I hate to break it to you, but this is not going to keep you safe from a state-level adversary. I could drone on about this for pages and pages, but the sad fa
by Nrsolis 13y ago
I hate to break it to you, but this is not going to keep you safe from a state-level adversary.
I could drone on about this for pages and pages, but the sad fact is that if you are a target, it doesn't matter that you are using a "secure phone", "secure OS", or "encryption".
Time and time again, these systems have been broken or breached with simple tradecraft and subtle sabotage.
The Pentagon has a concerted (and expensive) effort to validate or verify the absence of "backdoors" or evidence of "additional circuitry" on ASICs or subsystems of it's major weapons systems and associated gadgetry. Do you?
I tell people that their simplest way to avoid having their communications intercepted is to NOT. USE. AN. ELECTRONIC. COMMUNICATIONS. DEVICE.
UBL used couriers, flash drives, and cutouts. If you need that level of protection, SO SHOULD YOU.
When I need to communicate secretly I BUY SOMEONE A BEER.
- scrrr 13y agoIf it made it harder for non-state adversaries to create profiles about you, it would still be a good thing. I don't want the Gov. to know about my private life. But neither do I want any search engine, online store or ISP to have that data. So even though you are right, it's still better to choose a safer technology.
- rjzzleep 13y ago> When I need to communicate secretly I BUY SOMEONE A BEER. Hi Richard, it has come to our attention that you have been secretively discussing leaking government information to our enemy in a pub in central London. What's that you say? You didn't discuss private information? Then why did you try to conceal your handwriting on the napkin from our CCTV security cameras? We'd like to take you in for questioning. If you resist this may end badly for you. On a sidenote, if they at least have 2 separate SoC's on board, and a self rolled hardware firewall to make sure the baseband can't access things it shouldn't access, that may still be a great improvement to what we have right now. It still won't protect you from unknown hardware level exploits, but it's better than nothing.
- electrichead 13y agoVery curious, how did you discover that his name was Richard? Edit: nm, I should have just googled it :)
- Nrsolis 13y agoUh HUH. Assuming Twitter has my real name that is. LOL.
- robin_reala 13y agoGoogle ‘nrsolis’, top result. Total time, 2 seconds.
- mayanksinghal 13y agoReuse of the same username across multiple social networks/forums, I would guess.
- Nrsolis 13y agoThe Soviets used to have a custom of taking long walks in the park when they wanted to have a private conversation. It had the notable benefit of avoiding the hidden listening devices in their places of work/rest/play.
- 13y ago
- okasaki 13y agoGenerally, there are some trivial precautions that will frustrate all but the most concentrated effort. Things like TRESOR, grsecurity, /boot on an USB stick, etc.
- Nrsolis 13y agoUh huh. What if I have a deal with Intel and your TRESOR code compiled into the kernel is easily profiled by the microcode and the key is itself silently transmitted/stored by the CPU? Same with your USB stick. Go read up on how the CIA sabotaged the Iranian nuclear enrichment centrifuges by compromising the supply chain of the power supplies (not the computer controls).
- okasaki 13y agoIn that case, airgap and strict media discipline (once media touches the secure network, it's never used on insecure networks again) should do, no? But my point is that most us aren't foreign states trying to make nuclear reactors against the wishes of a superpower. We're more worried about things like common theft and border seizures.
- hawkharris 13y agoI haven't yet done enough research to argue for or against the phone's security, but your point about buying someone a beer is poignant. By conversing over the phone or with a computer, we usually expose ourselves to a greater risk of eavesdropping. We should ask ourselves if the medium is worth the exposure to risk, considering, among other things, the privacy of the information we're sharing. That preliminary question seems to be missing from conversations about online privacy.
- higherpurpose 13y agoSo in fewer words, your solution to state spying is "don't even try fighting it".
- Nrsolis 13y agoNo. It's UNDERSTAND YOUR ADVERSARY. If I'm trying to protect myself from hackers, I choose one route. From my ISP, another. From FB/Google, another. And from my government or your government, yet another. What's missing here is honest dialogue about the limits of the technology. The best technology has yet to save people from their own foolishness.
- higherpurpose 13y agoBut that seems a little like saying "the Internet is a spying machine - don't use it if you want privacy". I just think that's way too defeatist for my taste. If the Internet is a spying machine, then we need to find a way to communicate securely on it. I feel the same way about the phones. Both the Internet and mobile phones are here to stay, and billions use them. You can't just say "don't use them". That's a big cop-out. You can choose not to use certain providers, like using DDG instead of Google, or using Blackphone instead of the iPhone 5S. But you can't just use blanket statements like "don't use anything that's a big part of everyone's lives today." Security is never a guaranteed thing - with or without NSA. That doesn't mean you shouldn't do your best to secure yourself. I feel the same about Blackphone. Granted, I'd prefer something that's fully open source, and I think those solutions are coming (perhaps an even more secure version of CyanogenMod with TextSecure v2 and RedPhone integrated into it), but I think every little bit helps, and I do think we're moving in the right direction - securing our conversations and networks. It's a process, not a goal.
- nfoz 13y agoWe really need to rewrite the entire stack, carefully and with the intent of security, from open-source-DIY hardware up, to have any trust in technology.
- deleted 13y ago
- Joeboy 13y ago> I hate to break it to you, but this is not going to keep you safe from a state-level adversary. I don't really like this kind of anti-crypto argument. At this point I think making normal communications between normal people less embarrassingly mass-snoopable is a very worthy goal. For the time being, people who really, really have something to hide need to be extra careful (as has always been the case). Which is not to say I'm feeling particularly enthusiastic about this device.
- Nrsolis 13y agoIt's not anti-crypto. It's PRO-tradecraft. Introducing technology into a system can WEAKEN your security. Knowing that is almost 90% of the battle.
- Joeboy 13y agoI think you're focusing on people who are under a specific, clear and present surveillance threat. Different arguments apply to those people to the majority of people who "value their privacy" in a more nebulous sense.
- maxerickson 13y agoIf you put * on both sides of some text, you get polite emphasis.
- lmg643 13y agoI think the problem with a device like this is that the kind of person who would be interested to use this just may be precisely the kind of person that the NSA would like to keep tabs on, just in case. Enough so, that an NSA worried about the Snowden leaks could theoretically come up with this idea as a way to corral folks trying to escape the "conventional" channels. Particularly with an ex-Navy Seal as CEO (no longer trusts the US government?), what's to say that there isn't some other vulnerability built into the core of this device. “Just because you're paranoid doesn't mean they aren't after you”. ― Joseph Heller
- Consultant32452 13y ago
- epsylon 13y ago> I hate to break it to you, but this is not going to keep you safe from a state-level adversary. The creators acknowledged that fact [1]: "There is no such device that is NSA-proof," said Mike Janke, co-founder and CEO of Silent Circle, in an interview with Mashable, ahead of the launch. "If you are on the terrorist wanted list or a criminal, intelligence services will get into your device... There's no such thing as 100% secure phone." [1] http://mashable.com/2014/02/24/what-is-blackphone/ http://mashable.com/2014/02/24/what-is-blackphone/ (For a humorous take on nation-state threat models, read the hilarious usenix article This World of Ours by James Mickens: http://research.microsoft.com/en-us/people/mickens/thisworldofours.pdf http://research.microsoft.com/en-us/people/mickens/thisworld...)
- pdubs 13y ago>(For a humorous take on nation-state threat models, read the hilarious usenix article This World of Ours by James Mickens: http://research.microsoft.com/en-us/people/mickens/thisworld... http://research.microsoft.com/en-us/people/mickens/thisworld...) "Security research is the continual process of discovering your spaceship is a deathtrap" has to be one of the most apt descriptions of security research I've ever heard. What a great read!
- drdaeman 13y agoSimplest way doesn't mean it's the best nor that it's always an option. First of all, if you're under targetted surveillance, you're possibly better using electronic communications than meeting in-person. Then, it's not always possible to meet in person.
- Tloewald 13y ago> I hate to break it to you, but this is not going to keep you safe from a state-level adversary. Assuming it's not being built as a honeypot by a state-level adversary, it's also going to attract attention to you. Want to avoid surveillance -- as much as practical act like someone who isn't worried about surveillance. BTW: "Buy someone a beer" -- True Detective episode 6 reference?
- EthanHeilman 13y agoOf course by "state-level adversary" you mean the United States. There are plenty of states with very poor computer attack capabilities, in fact most states aren't very good at it. Its not merely being a target that is the problem, it is being a high priority target for a long period of time. Eventually they'll find a way to get your communications, but how many days or months does a technology buy you, at what cost to you and to them. Why do you think they are willing to spend that cost on people that aren't Snowden, Greenwald? It isn't win or lose, its mitigation. We should judge security technologies not on absolutes but on relative merits given the reasonable security goals we wish to achieve (note that Snowden was able to achieve communications security against the NSA/GCHQ long enough to complete his goal).
- eli 13y agoIt is naive to think the US is the only country with means and motivation to launch major cyber-spying campaigns. http://www.kaspersky.com/about/news/virus/2014/Kaspersky-Lab-Uncovers-The-Mask-One-of-the-Most-Advanced-Global-Cyber-espionage-Operations-to-Date-Due-to-the-Complexity-of-the-Toolset-Used-by-the-Attackers http://www.kaspersky.com/about/news/virus/2014/Kaspersky-Lab...
- johnchristopher 13y agoThat's going to be an expensive beer when you have to communicate secretly with someone on the other shore of the ocean.
- markmassie 13y agoWhat is UBL?
- 0xdeadbeefbabe 13y agoYou love breaking this edge case to him as if it were the most important one. The adversary is more likely doing industrial espionage [1] and doesn't have those incomprehensibly limitless state-level resources. [1] http://en.wikipedia.org/wiki/Industrial_espionage http://en.wikipedia.org/wiki/Industrial_espionage
- malandrew 13y agoWhat are cutouts?
- lyagusha 13y agoThen again, the clock on the wall in the pub might have a hidden microphone, or camera. This site is rather ingenious in where they put microphones/cameras (wall charger?) - supercurcuits.com