The FBI considers FaceApp to be a potential counterintelligence threat [pdf] • Hacker News Board

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#71

Post by slg » Tue, Dec 03, 2019, 1:36 AM UTC

freehunter wrote: post #68

I know it's against the rules to tell people to read the article, but I would encourage everyone to read the article. It specifically says this is a potential threat to > "elected officials, candidates, political campaigns, [and] political parties" not to the general public. The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the R…

Can apps still get information that identifies the specific device? If so, another possible threat model could be more about identifying who uses what device rather than anything specifically in the photos themselves.

For example, I already have a database of high value target's faces built from political sources like house.gov. Now I do facial recognition between that set of faces and the FaceApp faces. That allows me to identify the specific devices used by government officials. That would seem to be super valuable for more targeted attacks and/or pairing with other apps for potential kompromat.

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#72

Post by _jal » Tue, Dec 03, 2019, 1:38 AM UTC

freehunter wrote: post #60

ShorsHammer wrote: post #35

Earlier quoted context omitted.

Thankfully that doesn't happen anywhere else in the world. Australian government metadata requests was well over 300,000 last year, nearly 1000 requests a day all warrantless, can come from tiny local councils or horse racing orgs. Trust us, they say, there's oversight in hidden tribunals, they say.

Yes all countries do it, but US intelligence doesn't just take into account the action , they take the actor as well. Australia is a friendly nation to the US and shares intelligence data with US intelligence agencies. What we see, they see and what they see, we see. Russia is not a friendly nation to the US and does not share intelligence with US intelligence agencies. The FBI isn't saying "normal people are at risk…

> saying "yeah but everyone does it" is about as off-topic of a remark as you can get

I've seen this sort of "argument" a lot lately. Not sure why people think it communicates anything other than lazy cynicism.

That everyone (to a rounding error) has sex does not mean that everyone has sex with everyone.

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#73

Post by trhway » Tue, Dec 03, 2019, 1:41 AM UTC

freehunter wrote: post #68

I know it's against the rules to tell people to read the article, but I would encourage everyone to read the article. It specifically says this is a potential threat to > "elected officials, candidates, political campaigns, [and] political parties" not to the general public. The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the R…

>The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the Russian government can see them and can also see what's in the background (sensitive documents?)

good old days just less than 20 years ago back at Sun when we were strictly instructed that the computer monitors must be off when the photos would be taken. How times and basic norms of opsec have changed - these days you just tweet the straight photo of the classified monitor screen https://www.npr.org/2019/08/30/755994591/president-trump-twe...

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#74

Post by sjwright » Tue, Dec 03, 2019, 1:44 AM UTC

ericfrederich wrote: post #38

walrus01 wrote: post #29

Earlier quoted context omitted.

Notably ES File Explorer was recently removed form the Google play store because of suspicious behavior. One of the most popular Android file managers.

Total Commander was the recommended replacement a while ago when ES started to become shady.

Android: for people who want the freedom to do anything.

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#75

Post by JaRail » Tue, Dec 03, 2019, 1:44 AM UTC

slg wrote: post #71

freehunter wrote: post #68

I know it's against the rules to tell people to read the article, but I would encourage everyone to read the article. It specifically says this is a potential threat to > "elected officials, candidates, political campaigns, [and] political parties" not to the general public. The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the R…

Can apps still get information that identifies the specific device? If so, another possible threat model could be more about identifying who uses what device rather than anything specifically in the photos themselves. For example, I already have a database of high value target's faces built from political sources like house.gov. Now I do facial recognition between that set of faces and the FaceApp faces. That allows…

Current-gen devices provide an advertising id. It's unique to the device but can be reset to a new random value by the owner in the OS settings.

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#76

Post by slovenlyrobot » Tue, Dec 03, 2019, 1:45 AM UTC

jjeaff wrote: post #66

slovenlyrobot wrote: post #59

Forgive me for chuckling at law enforcement in by far the world's largest exporter of consumer malware for treating a single comedy deepfakes app with so much paranoia and suspicion. How did that common saying go that was bandied around in our teenage years? Something like the person in a relationship who fears cheating the most is the one most likely to cheat

So, your logic is that since the U.S. spies on people, it means they have no credibility in calling out other people for spying on U.S. citizens? Seems like a "pot" should have more knowledge than average on which kettles to call "black".

I'm not sure where I stated they have no credibility, only that the situation was deeply humorous

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#77

Post by godelski » Tue, Dec 03, 2019, 1:50 AM UTC

zzzcpan wrote: post #31

dessant wrote: post #25

It's not clear what is the potential threat this specific app introduces. A nation state can easily perform facial recognition on the majority of the human race by scraping social media.

No need to be a state actor, private companies do that too and sell data to law enforcement. There is no realistic threat, just propaganda.

I mean isn't law enforcement using that data the threat model? It is just if your own government is doing it vs a hostile state actor. So while our gov doesn't see the former as hostile (they're the ones doing the actions, so who would admit hostility) they do see the latter as hostile. You can call this hypocritical (which seems to be the common argument here in HN), but hypocrisy doesn't nullify the hostility.

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#78

Post by Merrill » Tue, Dec 03, 2019, 1:51 AM UTC

Wissmania wrote: post #4

I wonder how many people with a profile picture of their face on their Twitter/Facebook accounts are seriously concerned about this

The face picture is not really the problem. The app slurps other data from the device, such as log files, cookies, identifiers, etc. Of course, this app is probably not dissimilar to many of the other 2.5 million Android, 1.8 million Apple, 0.7 million Windows, and 0.5 million Amazon apps. https://www.statista.com/statistics/276623/number-of-apps-av...

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#79

Post by TheRealPomax » Tue, Dec 03, 2019, 1:51 AM UTC

rauchp wrote: post #5

Looks like the FBI designated FaceApp as a threat because of its crazy data policy and its Russian origin. Even though I think it's a really shady app, that's a pretty low bar.

Not during an election year, at a point in time that sees _much_ heavier use of these apps than even 4 years ago, no.

Re: The FBI considers FaceApp to be a potential counterintelligence threat [pdf]

#80

Post by godelski » Tue, Dec 03, 2019, 1:52 AM UTC

JoeCortopassi wrote: post #40

godelski wrote: post #32

Earlier quoted context omitted.

The threat model is that this photo is shared with the Russian government and then the Russian government can match American citizens (or potentially people working in intelligence), and then using that in facial recognition programs. I.e. they can differentiate Americans (insert x country) from their own citizens and know who to watch more carefully. This is a legitimate threat model. I'm not sure why you think it w…

A picture, that has no good associated data about the user, is a real threat? Heaven forbid Russia figures out how to take pictures in public places

> A picture, that has no good associated data about the user

A picture is a username... Are you trying to say that your face isn't personal identifying identification (PII)? I'm not sure what your argument is here, because it can't be that. That argument would be absurd, so I'm sure I am misunderstanding.