Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How would you secure your laptop against the NSA?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Ask HN: How would you secure your laptop against the NSA?

#21

Post by kazinator »

saghm wrote: post #19
maksimum wrote: post #2

How valuable is the information on your laptop to the NSA? If it's under $100k you're probably ok doing what Stallman does https://stallman.org/stallman-computing.html . If you have information worth over $5M to the NSA, then you better get physical security personnel as well as network and hardware security personnel; maybe ally yourself with a different powerful state or corporate actor. In other words you need to…

"The most powerful programming language is Lisp. If you don't know Lisp (or its variant, Scheme), you don't know what it means for a programming language to be powerful and elegant. Once you learn Lisp, you will see what is lacking in most other languages....I have not had time or occasion to learn newer languages such as Perl, Python, PHP or Ruby." Glad to know his opinion is here well-informed. Perl only came out 3…

Though the attitude may be bad, that author guessed right; he didn't miss anything by avoiding those.

I also didn't learn those in the sense of working with them, but I studied their reference material and numerous examples. That is more than enough for me to see what the underlying requirements are which these languages implement. I don't agree with most of the requirements (by which I mean the detailed specifics, not generalities like "we would like a useful language with good libraries for a wide range of applications" which is a universal).

I've borrowed from some of these languages into my own Lisp dialect. For instance, I like Python's array indexing, with how negative indices work backwards from the end, so I copied it.

Re: Ask HN: How would you secure your laptop against the NSA?

#22

Post by saghm »

kazinator wrote: post #21
saghm wrote: post #19

Earlier quoted context omitted.

"The most powerful programming language is Lisp. If you don't know Lisp (or its variant, Scheme), you don't know what it means for a programming language to be powerful and elegant. Once you learn Lisp, you will see what is lacking in most other languages....I have not had time or occasion to learn newer languages such as Perl, Python, PHP or Ruby." Glad to know his opinion is here well-informed. Perl only came out 3…

Though the attitude may be bad, that author guessed right; he didn't miss anything by avoiding those. I also didn't learn those in the sense of working with them, but I studied their reference material and numerous examples. That is more than enough for me to see what the underlying requirements are which these languages implement. I don't agree with most of the requirements (by which I mean the detailed specifics, n…

> Though the attitude may be bad, that author guessed right; he didn't miss anything by avoiding those.

I don't claim to say he's correct or not; rather, I'm saying that a bad attitude is inexcusable regardless of correctness. It's perfectly fine to not want to try a language (or even to dislike it), but in that case there aren't any grounds to criticize it.

Re: Ask HN: How would you secure your laptop against the NSA?

#23

Post by runT1ME »

openasocket wrote: post #16

a laptop you are actively using, connected to the internet? Assuming the NSA really wants to get you, there's nothing you can do. Here's how they would do it: First they need an RCE, probably for your browser, maybe your TLS library. For a state actor, this is not a problem. Let's assume it's your browser. They need you to visit a page with their malicious payload. They can use phishing, they can take over a site you…

> Now all you have to do is make an un-encrypted connection to any site, and they've got you.

Seems easy to ensure that doesn't happen. If I block all non SSL requests going out from my machine, what's the next step?

Re: Ask HN: How would you secure your laptop against the NSA?

#24

Post by kazinator »

saghm wrote: post #22
kazinator wrote: post #21

Earlier quoted context omitted.

Though the attitude may be bad, that author guessed right; he didn't miss anything by avoiding those. I also didn't learn those in the sense of working with them, but I studied their reference material and numerous examples. That is more than enough for me to see what the underlying requirements are which these languages implement. I don't agree with most of the requirements (by which I mean the detailed specifics, n…

> Though the attitude may be bad, that author guessed right; he didn't miss anything by avoiding those. I don't claim to say he's correct or not; rather, I'm saying that a bad attitude is inexcusable regardless of correctness. It's perfectly fine to not want to try a language (or even to dislike it), but in that case there aren't any grounds to criticize it.

We don't know that the author means that he literally knows nothing (as in, given four programs, and three bubbles labeled Perl, Python, PHP and Perl, wouldn't be able to draw arrows connecting the programs to the correct bubbles).

Re: Ask HN: How would you secure your laptop against the NSA?

#26

Post by sfifs »

_qbxp wrote: post #17

I followed the Snowden leaks only from MSM sites, so I know little of the details. Most of the comments thus far are "there's nothing you can do." Can somebody explain in more depth whether this is likely true, or an over reaction, and why? Is there literally no way to stop the NSA from snooping? What if I built a laptop from multiple separate components ordered from different websites or purchased from different B&M…

These two links have been posted already on this thread but they answer your question very precisely.

https://xkcd.com/538/

https://www.schneier.com/blog/archives/2015/08/mickens_on_se...

Re: Ask HN: How would you secure your laptop against the NSA?

#27

Post by saghm »

kazinator wrote: post #24
saghm wrote: post #22

Earlier quoted context omitted.

> Though the attitude may be bad, that author guessed right; he didn't miss anything by avoiding those. I don't claim to say he's correct or not; rather, I'm saying that a bad attitude is inexcusable regardless of correctness. It's perfectly fine to not want to try a language (or even to dislike it), but in that case there aren't any grounds to criticize it.

We don't know that the author means that he literally knows nothing (as in, given four programs, and three bubbles labeled Perl, Python, PHP and Perl, wouldn't be able to draw arrows connecting the programs to the correct bubbles).

Given that he's claiming that Lisp is more "powerful" and that other languages are "lacking", I'm not convinced that recognizing the syntax is sufficient to make his statement.

Obviously I was exaggerating a bit in my original comment, but as I said in my second one, the issue I have with his statement is the attitude, not the content.

Re: Ask HN: How would you secure your laptop against the NSA?

#29

Post by openasocket »

runT1ME wrote: post #23
openasocket wrote: post #16

a laptop you are actively using, connected to the internet? Assuming the NSA really wants to get you, there's nothing you can do. Here's how they would do it: First they need an RCE, probably for your browser, maybe your TLS library. For a state actor, this is not a problem. Let's assume it's your browser. They need you to visit a page with their malicious payload. They can use phishing, they can take over a site you…

> Now all you have to do is make an un-encrypted connection to any site, and they've got you. Seems easy to ensure that doesn't happen. If I block all non SSL requests going out from my machine, what's the next step?

The NSA still has plenty of options. First is an undisclosed RCE in your SSL implementation. If they don't have an 0day handy, they can compromise any server you would visit. They can hijack a web server to inject the payload, they can steal the certificate and then MitM anywhere on the path. They can create a malicious ad with the payload, targeted towards you. They can get their hands on a valid certificate for a site you commonly visit, by using a CA that doesn't properly check these things, either through a vulnerability, social engineering, forgery, or coercion. And of course there's always spear phishing. They don't need to get credentials, just get you to click the link.

Re: Ask HN: How would you secure your laptop against the NSA?

#30

Post by BorisMelnik »

you forgot the biggest piece of information: is the laptop connected to the internet or a local area network? (or bluetooth etc)

edit: assuming it is not "connected" to the physical world, I'd partner with an embassy to house the laptop there. preferably a communist state where we don't have good relations.

Post reply on HN