Live data from Hacker News

Pavel Durov listed in leaked Pegasus project data

theguardian.com

31–40 of 54 posts

Re: Pavel Durov listed in leaked Pegasus project data

#31
post #25
post #7

Earlier quoted context omitted.

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

GNU/Linux don't even have a notion of security let alone having anything comparable to even backdoored android/ios. I think your best bet would be a Pixel phone with GrapheneOS, though I'm not sure whether it was effected here.

Their security model is more reasonable in my opinion: https://news.ycombinator.com/item?id=27908661

Re: Pavel Durov listed in leaked Pegasus project data

#32
post #25

Earlier quoted context omitted.

GNU/Linux don't even have a notion of security let alone having anything comparable to even backdoored android/ios. I think your best bet would be a Pixel phone with GrapheneOS, though I'm not sure whether it was effected here.

Their security model is more reasonable in my opinion: https://news.ycombinator.com/item?id=27908661

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then you might as well just not turn on your device. Seriously, what's up with the linux userspace where goddamn gnome initial setup is a C program?! Like, we were okay with lisp code decades ago in more serious things, and nowadays we actually have memory-safe languages with very close to native performance.

But the biggest problem is the lack of sandboxing, and UNIX permissions are way too crude to be of any use. The attacker at worst can't install a video driver, but can easily add anything to your bashrc, or read the content of your browser's cache, etc.

Re: Pavel Durov listed in leaked Pegasus project data

#33
post #32

Earlier quoted context omitted.

Their security model is more reasonable in my opinion: https://news.ycombinator.com/item?id=27908661

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then y…

> for microphone, even the gyrosensors can record voice in some quality

Turning off all three kill switches kills all sensors.

Concerning the problem with the C code, yes. But it’s the same problem as with Apple, trillion-dollar company.

Re: Pavel Durov listed in leaked Pegasus project data

#34
post #32

Earlier quoted context omitted.

Their security model is more reasonable in my opinion: https://news.ycombinator.com/item?id=27908661

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then y…

I agree about ambient authority etc., but I'm typing this in a sandbox which doesn't allow access to .bashrc. (I'm sure it's not perfect.)

Re: Pavel Durov listed in leaked Pegasus project data

#35
post #34
post #32

Earlier quoted context omitted.

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then y…

I agree about ambient authority etc., but I'm typing this in a sandbox which doesn't allow access to .bashrc. (I'm sure it's not perfect.)

I’m no security researcher so do correct me if I’m wrong but I assume you use firejail which is a suid program - a bug here could cause an escape to even become root. And why would you write a sandbox in a memory safe language…

Re: Pavel Durov listed in leaked Pegasus project data

#36
post #32

Earlier quoted context omitted.

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then y…

> for microphone, even the gyrosensors can record voice in some quality Turning off all three kill switches kills all sensors. Concerning the problem with the C code, yes. But it’s the same problem as with Apple, trillion-dollar company.

You are right, but Apple does try to rewrite most things in memory safe languages and have been doing so for quite some time now. So it is not exactly GNU/Linux.

Re: Pavel Durov listed in leaked Pegasus project data

#37

Pretty tired of seeing people surprised and concerned when they get a look at how the sausage is made like this. Bill Binney in 2002 and Edward Snowden in 2013 should have disabused us all of any pretense of order and justice in this system. World governments, Big Tech be like: "We are shocked, shocked! to find back doors and spying in here!" The two work in tandem to facilitate the needs of each other. This is just…

Yes. People don't know and most don't care.

For example, the EU parliament has just recently passed legislation to allow "providers of e-mail and messaging services to automatically search all personal messages of each citizen for presumed suspect content and report suspected cases to the police."

Most people I talk to don't know about this. When they hear it, they're in shock. And then go on living their lives. It's really very intangible to most people.

Source: https://www.patrick-breyer.de/en/chatcontrol-european-parlia...

Re: Pavel Durov listed in leaked Pegasus project data

#39
Always check for the threat model. I am too insignificant for any government to track. I pay my taxes on time and have nothing to hide.

However, I don't see the argument shifting towards the big tech- they are responsible for giving us the crap operating systems. I genuinely miss BlackBerry 10 now.

Re: Pavel Durov listed in leaked Pegasus project data

#40
post #32

Earlier quoted context omitted.

Their security model is more reasonable in my opinion: https://news.ycombinator.com/item?id=27908661

Hardware kill switches are unfortunately pretty much useless. For camera it's okay, but a tape is just as good, for microphone, even the gyrosensors can record voice in some quality. And here is the big thing: there is hardly any threat model where blocking the camera would help when the software stack is a burning pile of C buffer overflows from top to bottom. If you can't trust the software to such a degree, then y…

How well would putting the phone in a lead box work.
Post reply on HN