Hacker News Reader

Comment by sharikous | Hacker News Reader

The Google threat you can still mitigate or even escape.

The US government one you can't. Sorry. As much as I wish I were wrong, the hardware is probably backdoored, so no custom OS will save you. Even if it weren't a phone by design has to communicate with radio towers (backdoored) and even if you get the most secure phone in the world you still have to communicate and pay for some exotic hardware. Guess who will get added to a list of suspicious people to put an extra eye on?

View on HN

My first “tech” job out of college was tech support for a VPN company. Brilliant little operation reselling bandwidth to folks visiting China and those who wanted to hide their traffic. One reason I really respected the CEO and CTO is that they told us specifically to never, ever promise that we made people “anonymous on the Internet.” Even when they went to no-logs — a big step for them — they still maintained that we always stick to this line: “You are never anonymous on the Internet. Our service is to help you create a more private connection, one that makes it more difficult for you to be tracked by corporations and hackers. It does not protect you against state-level actors.” When I discussed this with them, they had an even more candid take: “Look, if you have the US government after you, you’re already fucked. No level of encryption is going to help.”

This has always stuck with me.

>“Look, if you have the US government after you, you’re already fucked. No level of encryption is going to help.”

Relevant XKCD: https://xkcd.com/538/

Yet somehow the US government can't even prevent me from downloading copyrighted torrents.

There's a difference between stopping an action at a societal level, and targeting an individual through any means necessary.

> There's a difference between stopping an action at a societal level, and targeting an individual through any means necessary.

Yup. It always amazes me how often people conflate, "The U.S. government can't be bothered to stop people from doing X" with, "The U.S. government can't stop people from doing X". If you want to test this out, try not paying federal taxes for a while.

There are people getting away with tax fraud all the time.

Relevant Wiki: https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

The solution I have is a wired-in, locked down raspberry pi where I have a separate email account, PGP key, etc. Phones are definitely a writeoff though, with the possible exception of the PinePhone. If memory serves, the 4g modem lacks direct memory access which improves security substantially.

Can anyone be sure an enormous open source project like a Linux distribution isn't backdoored?

For something with a lot of eyes on it, like the Linux kernel, I would think it unlikely. It's the smaller projects with no active maintenance that would be easier targets.

At the end of the day, all operating systems have exploits. Nation states pay big money online to buy the exploits for their own use, before the good guys find them and out them. If your system is being compromised by a nation state, it is much more likely buy a purchased exploit than by an explicitly-added backdoor.

I can't say anything about intercepting your communications, though. The NSA might or might not have technical ways of decrypting some of your encrypted communications.

I'm not sure if the PinePhone advertised that. The Librem 5 advertised that though.

Those components in that PinePhone, they come from China. Are you sure that flash module does not contain a backdoor? What about the SoC, PinePhone uses Rockchip, the full name of that company is Fuzhou Rockchip Electronics Co., Ltd.. Are you sure the SoC is free from backdoors? Why even limit the search to complex components when a simple SMD capacitor is more than big enough to contain a low-power radio. Add some 'intelligence' and the thing will be able to deduce whether it is mounted in a position which gives it access to interesting data - the power path being a good candidate - to be transmitted on demand. The same would have been true had the components come from any other country but as it stands nearly all such components come from China.

Being a little flippant here, but it is the British and American govts I worry about more. At least I don't share a language with Chinese spies!

Plus, I'm fairly sure the pi is a known quantity. PinePhone less so. Probably the most secure thing you can do is encrypt messages to your friends, send them as a printed out QR code, and make your signature say "burn after reading". Bonus points for a printer that is old enough that it isn't laden with spyware.

The telcos can be mitigated by using burner SIM's that you rarely turn on. Use VOIP numbers with SIP phone clients. Only turn off airplane mode when needed.

I know somebody who refuses to use any encryption anywhere because he is worried that he will raise suspicion.

Reply on news.ycombinator.com