grugq

17 ms·

121.
by grugq 13y ago
Theres a good reason the PORTAL is a separate hardware device: security [1]. There is also a reason it isn't on Debian -- huge attack surface as there [were?] are no minimal Debian images. If you want something similar, the transparent
122.
by grugq 13y ago
That is certainly a clear headed and reasonable explanation of why it might be tabled as an option... but I can't fathom who thought deploying a nation state level intelligence agency (in a western democracy) against the communications
123.
by grugq 13y ago
it is a variant of "the fiddle game", or "the glim dropper". They are standard conman tricks from back in the day. All work on the principle: "you can't con an honest man". http://en.wikipedia.
124.
by grugq 13y ago
No, it is not worth "millions or billions". It is worth whatever anyone is willing to pay for it. Since Facebook has very aggressive monitoring and will shutdown hacks quite rapidly, the ROI for a bug like this would have to be re
125.
by grugq 13y ago
there is a lot of inside story that isn't public. Suffice to say, the bugs were DOA.
126.
by grugq 13y ago
the bugs were being patched in 7.1. they had to release.
127.
by grugq 13y ago
Payment was conditional on being first and being exclusive. You do not pay 1 million dollars to be second out the gate, particularly because you can simply copy the first guy's work. Unless the evad3rs released first, they would not ge
128.
by grugq 13y ago
Well, the reason that the Cydia store doesn't work, and that Saurik wasn't included in the discussions, is starting to become clear. A Chinese company paid the evad3rs a rumored 1 million dollars for the jailbreak, forcing their o
129.
by grugq 13y ago
The comic does actually suggest that, and the comment I replied to specifically suggested that. This sort of interrogation typically starts with "we know you did it, so why don't you make things easy for yourself...", not &qu
130.
by grugq 13y ago
Seriously, enough with the XKCD 538 fallacy. That is not how interrogations work. It just isn't. Violent torture is not how you get people to provide information. Actual interrogations are far more cunning and complex, involving psycho
131.
by grugq 13y ago
It is incredibly simple politics. He is in place to continue to soak up the bad publicity from the Snowden event. Once the bad publicity stops, he will step down. There is no point, politically, of taking him out right now. His replacement
132.
by grugq 13y ago
This is why professionals operate on "Naked In/Naked Out". Show up with nothing, acquire all your tooling in the country, execute your operational activities, dispose of the tooling, leave the country with nothing. Expensive,
133.
by grugq 13y ago
The German invasion a difficult case as the policy maker (Stalin) had decided what he wanted to see ("no German invasion") and he would discount, or worse, any information that contradicted his preconceptions. This is a problem wi
134.
by grugq 13y ago
Richard Sorge. He (arguably) won WWII. http://en.wikipedia.org/wiki/Richard_Sorge
135.
by grugq 13y ago
Arguably WWII was won due to the information provided by a spy, Sorge[1]. His timely info to Stalin informing him that the Japanese would not invade Russia allowed Stalin to pull most of his eastern armies back to Moscow. Combined with the
136.
by grugq 13y ago
That is a lot less common than many people like too think.
137.
by grugq 13y ago
The castleman affidavit is available from a number online sources. I have mirrored it on google docs to save people the hassle of tracking it down. Here is one link off google, if you prefer: http://www.rep-am.com/newsdocume
138.
by grugq 13y ago
If people are interested in learning more about OPSEC and how to actually protect secrets (i.e. guard your privacy), this is a good overview of the issues. As always, my focus is on hackers, but the issues are not solvable with technology (
139.
Interview: OPSEC with the grugq(blogsofwar.com)
17 points by grugq 13y ago|5 comments
140.
by grugq 13y ago
No, it is very unlikely that it would. You would have to do something else to attract attention first, and then your surfing habits might come up.
141.
by grugq 13y ago
The follow up posts on this particular piece are: http://grugq.tumblr.com/post/68391880015/defcon-21-de-anonym... And: http://grugq.tumblr.com/post/68392646777/castleman-affidavit
142.
by grugq 13y ago
That's actually the title that was originally used to link to baal.html. http://dee.su/liberte-peer-review
143.
by grugq 13y ago
Hmmm... "Musings on Underground Communication"? "Underground Communication, some thoughts"? Not really sure what's so inflammatory about the title. When analyzing the activities of groups facing an adversarial envir
144.
by grugq 13y ago
ta.
145.
by grugq 13y ago
The use of 2FA is clearly irrelevant to the issue of NSA internet surveillance. If the traffic is encrypted (and they can't decrypt it), then the authentication mechanism is irrelevant. If the data is stored in the US, they have access
146.
by grugq 13y ago
You're missing the "nation state level adversary" component. I personally, do not know your mobile phone number or the last cell tower that it associated with. But I am not your adversary. A nation state level adversary ipso
147.
by grugq 13y ago
As it states in the opening paragraph, the post prompted as a response to this blog post: http://blog.cryptographyengineering.com/2013/03/here-come-en... > It seems like these days I can't eat breakfast wi
148.
by grugq 13y ago
If you wrote and posted it from inside Lebanon, then Hezbollah would know. Nationstate adversaries are very powerful beasts.
149.
by grugq 13y ago
I think this is what you are looking for. http://grugq.github.io/blog/2013/06/13/ignorance-is-strength... As for how to use the phone to avoid attracting attention, the typical technique is to use paypho
150.
by grugq 13y ago
Actually the problem goes beyond this. The adversary (Hezbollah in this case) correlated anomalous data (the weird mobile phone behavior) with information about people inside their organisation who had access to sensitive information. They

More ›