Vendors must start adding physical on/off switches to devices that can spy on us

Post by 50656E6973 » Sun, Apr 21, 2019, 3:52 PM UTC

lucb1e wrote: post #121

HALtheWise wrote: post #101

Am I the only one who has far more sensitive content visible on the screen and filesystem of my computer than through its camera? I feel like, at least for the threat models that I consider likely, if someone manages to hack my laptop and get (for example) microphone access, the thing I am most worried about is that they will use acoustic analysis of keystrokes to recover my banking password, not that they will hear…

> far more sensitive content visible on the screen and filesystem of my computer than through its camera I mean, yeah, being hacked (and thereby compromising your screen/HDD's contents) is an issue in the first place and keyloggers are only a few lines of code, but I don't think there is anything wrong with controlling the parts that you can control. You can't make a physical "no keyloggers for this piece of text, pl…

Post by gdubs » Sun, Apr 21, 2019, 4:10 PM UTC

fenomas wrote: post #141

justinjlynn wrote: post #80

Earlier quoted context omitted.

Max Headroom was an extremely subversive program and I continue to be amazed it was actually greenlit, produced and broadcast on mainstream television - in the United States for primetime broadcast, even!

There was a great article some time back about the hisstory behind it. A lot of the episodes satirized the show's own network and specific network executives - some of which flew under the radar and some of which probably hastened the show's demise, etc. Fake edit: I think this is it: https://www.theverge.com/2015/4/2/8285139/max-headroom-oral-...

Post by monocasa » Sun, Apr 21, 2019, 5:17 PM UTC

int_19h wrote: post #151

monocasa wrote: post #142

Earlier quoted context omitted.

We just had a situation where they insisted on a design that they admitted was less safe in context but fit their standards better.

That's exactly what I would expect from a standards-based certification. But it's also why it's useful - "it is safer" is much easier to fudge (see also: Boeing) than "it is in compliance with this 40-item check list". Either way, it sets the baseline, so there's a net benefit so long as most products would be below that baseline without market pressure to certify.

Post by dcbadacd » Sun, Apr 21, 2019, 6:54 PM UTC

userbinator wrote: post #68

NegativeLatency wrote: post #31

Earlier quoted context omitted.

What you’re describing is possible and is done currently in corporate environments by forcing devices to accept a self signed cert that allows companies to spy on their employees traffic. Haven’t seen anything for the home market yet, and I’m not sure how you’d get a consumer IOT device to accept your cert.

Whenever the topic of MITM middleboxes comes up, there is usually a vehement opposition to them from much of the security community... while they bring up some valid points, I can't help but wonder if there is some deeper agenda behind that opposition, since these also seem to be the same people who are pushing the user-hostile walled gardens. (Personally have been using a MITM proxy on my network for over a decade.…

Post by squarefoot » Sun, Apr 21, 2019, 7:49 PM UTC

rolph wrote: post #143

acct1771 wrote: post #131

Earlier quoted context omitted.

Explore and evaluate meshnet projects, find one that you like, and educate others about them. Set up the hardware, link up with existing mesh if you're in a dense enough area. Push federated services like Matrix and ActivityPub based services like Mastadon, so when it's time to go mesh, people don't laugh when you say "It doesn't reach Facebook/Insta".

and check out the Project-Byzantium. https://github.com/Byzantium/Byzantium https://project-byzantium.org/ https://hackaday.com/2015/04/28/meshing-pis-with-project-byz...