Can somebody recommend something analog for Windows?
Micro Snitch – Know when someone spies on you
21–30 of 118 posts
Re: Micro Snitch – Know when someone spies on you
#22I would really prefer all I/O devices, including touchscreens and antennas, have physical on/off switches. 1 for in and 1 for out where possible. Even if I have to open the device to flip them. I'd like to be able to turn a phone into receive-only device without worrying about what it's broadcasting. That's probably a lot more complicated than I'm imagining, but I'd like it if lines between what's a sender and what's…
>turn a phone into receive-only device without worrying about what it's broadcasting Then all the spy software has to do is receive a signal to begin recording, saves to a buffer, and waits for you to check twitter before uploading.
You should be able to block which apps have access to the network.
I know you can do it with Windows. On iOS, you can only block cellular network access with the exception of third party keyboards where by default network access is blocked. I wish I could block apps from having any network access. Can you block network access in a per process basis with Linux or the Mac?
Re: Micro Snitch – Know when someone spies on you
#23How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.
> How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere. Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally b…
Your healthy paranoia reminds me of a classic talk on the matter, Ken Thompson's 1984 Turing Award speech "Reflections on Trusting Trust."
https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
Re: Micro Snitch – Know when someone spies on you
#24Earlier quoted context omitted.
I got MicroSnitch as part of a bundle with LittleSnitch, without really knowing what it was at the time. When I figured it out, I had the same thought as you. It's definitely not something I'd ever trust completely, not only could it be spying on you, but I also don't really trust my hardware. However, I must say, it's still very nice to have. It at least narrows the possible spying vectors, and it's nice to know imm…
Wouldn’t LittleSnitch be ideal in this situation to assist in checking if MicroSnitch is phoning home?
LittleSnitch does tell you when LittleSnitch and MicroSwitch phone home (auto-update checks only as far as I've seen), but they're the same developers so theoretically if one could fake one, one could fake both: they could be tightly coupled.
So you have to implicitly trust the ObDev guys, and you have to implicitly trust the hardware, but beyond those two assumptions they function great for any other threat models.
Would still be nice if they were both open source but hey: I use the open source vscode and it phones home uncontrollably all the time, so source code only benefits us so much.
Re: Micro Snitch – Know when someone spies on you
#25And how do I know if this app itself is or is not spying on me?
Re: Micro Snitch – Know when someone spies on you
#26How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.
> How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere. Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally b…
[deleted]
Re: Micro Snitch – Know when someone spies on you
#27Earlier quoted context omitted.
>turn a phone into receive-only device without worrying about what it's broadcasting Then all the spy software has to do is receive a signal to begin recording, saves to a buffer, and waits for you to check twitter before uploading.
You should be able to block which apps have access to the network. I know you can do it with Windows. On iOS, you can only block cellular network access with the exception of third party keyboards where by default network access is blocked. I wish I could block apps from having any network access. Can you block network access in a per process basis with Linux or the Mac?
Software won't help you. The premise is a phone where the spy agency has root and your only defense is "physical on/off switches" to control the I/O interfaces.
Re: Micro Snitch – Know when someone spies on you
#28Earlier quoted context omitted.
Wouldn’t LittleSnitch be ideal in this situation to assist in checking if MicroSnitch is phoning home?
LittleSnitch does tell you when LittleSnitch and MicroSwitch phone home (auto-update checks only as far as I've seen), but they're the same developers so theoretically if one could fake one, one could fake both: they could be tightly coupled. So you have to implicitly trust the ObDev guys, and you have to implicitly trust the hardware, but beyond those two assumptions they function great for any other threat models.…
Agreed. I replied in a sibling[0], which I think is relevant here. It seems I should definitely queue looking into what testing has been publicly done, etc. and collate that.
>Would still be nice if they were both open source but hey: I use the open source vscode and it phones home uncontrollably all the time, so source code only benefits us so much
Yup; definitely true.
Re: Micro Snitch – Know when someone spies on you
#29Or just install Oversight, it's free, does the same thing. And if you want you can support the author on Patreon. https://objective-see.com/products/oversight.html
Is this open source? Is the code on github or something?
Re: Micro Snitch – Know when someone spies on you
#30Or just install Oversight, it's free, does the same thing. And if you want you can support the author on Patreon. https://objective-see.com/products/oversight.html
Is this open source? Is the code on github or something?
Not that I know, right now the only project that has been open sourced is Lulu, a firewall (https://github.com/objective-see?tab=repositories).