Hacker News Reader

Comment by mjevans | Hacker News Reader

For those who think they've got nothing to hide:

Your bank communications are encrypted, why not also protect your conversations with friends family and others? You never know when you or they might need to share things you wouldn't want used as blackmail (information ransom).

View on HN

For those who think they've got nothing to hide:

just wait for cameras to be installed in your bedroom to keep you safe

Too late, we already have cloud-connected indoor security cameras from Amazon. The NSA is investigating a recent protest that happened in your area, wonder if they'd be interested in taking a peek at your footage? But really, it's not made things much worse. We already happily carry tracking devices everywhere with us without any idea what's running on them.

It took me a long time to grasp and take onboard that attack surface starts with your installed base of apps. I whittled my Ubuntu apps down to that which I use on a regular basis, and I aggressively uninstalled packages that were unused or seemed weird or just unnecessary to me.

The same goes for my Windows machine and my phone. Frankly my phone's 32GB is clogged already and I can't install all the apps I want. I may not really know "what" is running on it, but I have fairly good ideas about "who" is running on it, and that can count for a lot. If I don't install any janky games from unknown publishers, and I stick with truly utilitarian, name-brand stuff, I can at least avoid most supply-chain based attacks, and hopefully some of the jankier data Hoovers.

There are some activities I do when I have to seriously consider setting my phone aside, or at least removing sdcard+SIM for safety from whatever threat actors might turn the phone against me or wrest it from my possession. I do not yet rely on my phone for payments and transit fares, so I can easily get around town without it (even if it pains me not to have real-time tracking and maps and emergency phone at the ready.)

I think if you know who's running on your systems, that's half the battle. Don't invite strangers into your home, don't install weird apps on anything anywhere. Make sure your family knows too. Keep a tidy firewall and DNS-based adblocks. Due diligence goes a long way. Make your peace with threat actors who are too powerful for you to resist, and just live your life as if they're already watching.

While I'm definitely in the "encrypt and take all reasonable precautions" camp, I have to say that your example doesn't make sense to me - unless I'm misunderstanding your example, the recipient of those messages has already received a plaintext/unencrypted copy of the conversation. If the originally intended recipient is now the one holding that information "ransom", I don't know how encryption could help - at some point it was plaintext, and they could have made copies (screenshots, or even a Polaroid picture of their phone screen) at that time.

Again, could be misunderstanding your example...

The concern in the example is that if the data is unencrypted then there are many untrusted middlemen that also have access to the plaintext and could use it to blackmail either/both of the trusted sender/receiver.

I agree that concern is valid (and a good reason to encrypt everything), I just think the original example doesn't really say that clearly (or at least clearly enough).

Then again, maybe I'm just being pedantic.

Thanks for the clarification - have a good one.

It's implicit that the communicating parties desire the information to be shared among themselves, otherwise why would they talk about it at all?

While I agree, I still feel like the original example wasn't explicit about the threat being external to the conversation. But again, that's likely me being overly pedantic/overly concrete in my thinking.

That being said, there are situations where you would want to "revoke" information you shared willingly and intentionally with someone (think in the case of a messy breakup or divorce, where that information could be socially or legally troublesome if presented in a certain way) - encryption is still weak to a "plaintext recording" attack in that case.

Anyway, again, thank you all for the informative and civil discussions X) Have a good one.

Really you don't get to decide that you have nothing to hide, your inquisitor, the one deciding guilt does.

Reply on news.ycombinator.com