Edit: Changed “the government” to “governments”
I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There’s Intel ME, AMD PSP, so there’s probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?
Yeah, we don’t. It’s generally hard/impossible to prove the nonexistence of something. Similar as with God. It’s unlikely, but we can’t prove he doesn’t exist with certainty. These proofs only work for very simple and contained systems.
We don’t. The point is to reduce attack surface relative to target value. People use a VPN for piracy, for example, not because it’s totally secure, but because rights holders generally aren’t going to bother going after a single person when they’d have to go thru a VPN provider as well. OTOH someone doing it on clearnet is being logged by their ISP and the data is right there. OTOOH, the three letter agencies are absolutely going to bother if they have a tip that you’re doing something really dangerous to the status quo.
TL;DR: It’s like IRL security. If somebody really wants your shit, they’ll find a way to get it. The point is to make it generally not worth it.
Today I learned you have 3 hands
We will never have a way of knowing for sure. There are stories of government agencies famously requesting backdoor access to Apple devices, seemingly because they can’t get in otherwise, and Apple refusing, however they end up getting access on their own eventually. But who knows how much of that is even true? Government agencies are historically manipulative when it comes to public narrative, so anything made public by them should be taken with a hefty grain of salt
What about that thin shiney metallic woodwind instrument? And the musician who plays it?
The side of corporation is corrupt as well because they use it for marketing.
It’s not just back doors. All governments will have a group of people who’s job is to find security vulnerabilities in OS and use them to attack other nations.
If Wanacry rings a bell the you might be aware that the Eternal Blue exploit was the infection vector which was originally designed by the NSA and leaked by a hacking group. Only after the leak did the NSA tell Microsoft how it worked and it was patched.
Okay so here’s my take on it not that anybody asked.
There are likely back doors in all computerized Networked devices.
There is likely some identifying information being sent back to random servers from a myriad of places.
That being said, you are not worth the time to directly observe.
Most likely, all of this data goes into a large database where they analyze trends and look for people that are outside of various tolerance zones.
Other than that, all of your data is just noise, grist for the grist Mill.
It is only when you become a person of interest who is worth devoting the time to directly analyze that these risks escalate to the point where you should have concern about it.
99.9999% of us are just not important enough to pay attention to.
Also the government is not all one monolithic entity. Just because the NSA has a backdoor doesnt mean theyll hand that information out to anyone who asks. Maybe if the CIA fills out a ton of paperwork, but if its the FBI theyll laugh in their faces and tell them the data doesnt exist.
Here’s the most down to earth comment in the whole post
The Jersey drone story is a great example.
The FAA posted a a security update for the Picatinny area a few weeks ago. Now where did that come from? Some governmental org that wanted to do testing.
But the rest of government was unaware, so could honestly say they didn’t know anything about the drone activity.
Lol that FBI/CIA government bureuacracy was what (allegedly) led to the 9/11 hijackers getting through the cracks in the fishing net.
Cause the FBI are the keystone cops of the intelligence world. Theres a reason they spun off a whole new agency rather than just give the FBI unlimited resources for the war on terror.
That being said, you are not worth the time to directly observe.
At the moment; it’s important to remember facist governments can end up doing things that make no logical sense for idealogical reasons, so the best protection is to try to avoid ending up with a fascist government.
Person of interest? See: https://en.wikipedia.org/wiki/Person_of_Interest_(TV_series)
I’ll be cool with that if some badass vigilante would actually save my life.
Pretty much, yeah https://en.wikipedia.org/wiki/Tempora
Hardware backdoors are extremely expensive & taxes aren’t enough to cover it
I doubt that’s the case. We already had a good amount of government-sponsored hacking, worms like Stuxnet. The Israelis can make every pager (edit: they’d like to, and fit with explosives) explode. It has been debated if there’s surveillance in some networking equipment. I think it’d be quite affordable to put a few more lines of code into Intel ME and AMD’s equivalent. The hardware is already there.
If you honestly think that the exploding pagers where just standard pagers, and somehow made to explode by hacking them, your grasp of physics and technology could do with some improvement.
The pagers where packed with a small amount of explosive and remote detonation system and then fed into the Hamas group through a supply chain attack.
Sure, that basic physics knowledge was kind of implied in my comment. But yeah, my phrasing is misleading. They can’t make “every” pager explode. But they can make you end up with one with explosives inside. Most of these things are supply chain attacks. Could be targeted at someone and happen after manufacuring. Or you’d make the regular manufacturer include a backdoor. Or you’d do it like with the pagers and set up a whole fake manufacturer and sell them with a bomb inside. I suppose in that case it would be possible to detect it. But I’m not an expert on explosives.
I wouldn’t say stop intelligence agencies, but more like, slow them the fuck down. Because we know that they’re going through tons and tons of paperwork to do it all legally as possible. So, it’ll take them potentially years to construct a bit of a case to pursue whatever it is that they feel is worth their time to pursue someone over.
It’s cute that you think much paperwork is needed at all.
The only time they do paperwork is when they need to present evidence publicly, like in a court. Lead generation is essentially free, and then they just construct a parallel charge.
I read that as they were saying what they wished would be how the system worked. Not how it currently does
legally as possible
Welcome to Project 2025!
Legal system? What legal system?
There’s no way to check the whole thing, but you can totally pick a component and reverse engineer it, which is something people do quite a bit. When spying is found, it’s usually a private company doing it.
The NSA doesn’t care about your search history, but advertisers do. (and the government ever did, they’ll just call up google)
A few years ago they had rerouted shipments from Cisco to the NSA and then forward to the intended recipients. Not just a few parcels, but truckloads.
I mean we pretty much can be certain that we’re all being surveilled to some extent all the time.
You have to operate as if they have back doors.
With that being said, shit positing is not a national security issue yet.
Although DHS chief glowie did provide comments recently on how online discourse is a serious threat to CEOs
So they are clearly monitoring all socials for these vibes.
The fact that they got full might of daddy Sam LARPing dead parasite is telling.
Shit Posting Might have more power than previously thought.
Even without copy cats, parasites will uncomfortable with this public sentiment.
But they never discuss why the pedons would feel sucn a way
Remember, the only way to resolve a denied claim is to [Redacted By lemmy.world Admins]
I want neo lib acolytes to censor Lemmy for the benefit of the greater lemmy community 🤡
Well, there is this time a few months ago where the Chinese government hacked AT&T and Verizon using the mandatory backdoors the US government left for wiretaps…
https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b
That’s the reason leaving backdoors is generally a really, really bad idea, because you don’t know who else can use them
Lol they still have persistence in the network too, afaik
The same way we know there’s nothing wrong with drugs that are pushed en mass. We don’t.
We know they do, actually.
All US companies provide the NSA with backdoors. All modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.
Put the two things together and now you know.
I’m not aware of us knowing that they provide
backdoorsvulnerabilities to the NSA. If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act). The NSA may also separately develop backdoors (e.g. EternalBlue). But that the NSA coerces US companies to actively attack their customers, is news to me.It’s been a minute but I feel like Snowden revealed a program like that. A quick search gave me PRISM which kinda fits the bill https://en.m.wikipedia.org/wiki/PRISM
Seeing these Powerpoint slides again makes me realize that grapic design is really their passion.
Hmm, I just realized that “backdoors” in my previous comment had somewhat of a double-meaning. They do provide the NSA access to data that they have on their servers. In that sense, a backdoor exists, which is also what this PRISM article confirms.
But knowingly integrating vulnerabilities and making these available to the NSA for attacking customer devices, that is another shtick entirely. And I’m not finding anything in that article that says so (although I only read the parts that seemed relevant).
Yes this is something I’m more interested in learning as well. Data access to servers by adversaries can be largely mitigated with E2E encryption and VPN use so that even if, for example, the NSA wanted data on certain servers, unless they had an encryption key, would be largely meaningless (unless metadata wasn’t encrypted). We largely know that if LE wants data, they can get a court order to hand it over.
What I’d like to know is if there has been any evidence of “hardware” backdoors like what you now describe. I haven’t been able to find evidence of any successful attempts by major agencies/corporations, but I guess part of a successful attempt involves the public not knowing that it exists.
My threat model has me using an iPhone with Lockdown Mode & Advanced Data Protection enabled. I am wondering if I need to reassess my model to potentially go for the Pixel with GrapheneOS.
According to my research, the iPhone with these specific settings for reducing attack surface and encrypting everything that gets put onto servers is more than enough for myself (admittedly a pretty stringent threat model). But would also like to hear what others think.
Fair point. Building secret backdoors for the gov is a different beast all together.
modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.
If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act).
The key used to sign the remote code could be considered data that they’re legally obliged to make available to the NSA? 🤷😅
That said, the lengths they had to go to for stuxnet kinda implies it’s still not super easy to do, but I guess maybe they were using older cpus that don’t have the signed code vulnerability? 🤷
