101–110 of 193 posts
Earlier quoted context omitted.
That's a function of there not being penalties. You'd see that change if the laws changed.
Penalties for what exactly, here? Good Samaritanism?
Wait a second, why would he have to go to prison? If all he did was selling phones, what charges could there possibly be?
I'm also missing a third option that he refused to cooperate "for idiological reasons".
Never outsource security if you actually want security...
Never roll your own security if you actually want security, either. What are we supposed to do :).
Earlier quoted context omitted.
Vendor-based scams are not the entirety of the threat model.
Vendor-based scams are what this thread and this article is about. The root quoted that An0m was a 'trick' that couldn't be repeated again. My point is that legitimate businesses would have never had to worry about such tricks, being scammed by a vendor like this is a problem unique to illegal businesses.
Though I think there are actually at least two discussions being had here, apparently talking past one another:
One, that a vendor which promises some service but fails to deliver on it, as An0m did here, would be subject to civil claims for fraud or false representation. This seems to be your general argument.
Another is that any given business has concerns over surveillance and privac breaches, whether from law enforcement or other entities, and that any use of digial communictations and data systems exposes them to this risk. Paper-based systems have, of course, far lower capabiliies to data processing, but also to data exfiltration*.
Both are risks.
You're focused on one. Others take a broader view, myself included.
Earlier quoted context omitted.
Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed. Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out t…
I think that this isn't strictly true. If you naïvely apply bad encryption before good you may weaken the entire system. For a silly example, imagine your "homegrown" crypto adds a publicly known plaintext to the start of the cyphertext. I think this is discussed in Schneier's textbook.
I think that if we are going to be concerned about multiple layers of encryption, as you say, then we should be equally concerned with things such as what encoding we use to send text with, or whether we use gzip or bzip. It would suck having to worry about all that; good encryption algorithms work regardless of how their plaintext is encoded, and home grown encryption is just another form of encoding.
I would ask about legality, but I am worried its in a very, very grey area.
Earlier quoted context omitted.
Sounds like it was mostly word of mouth
Those mouths probably didn't work for free
Earlier quoted context omitted.
You would think that, but the whole an0m thing showed that it wasn't really the case.
That’s one case. It doesn’t apply to all criminal organizations. The cartels in Mexico are sophisticated enough to build their own cell networks [1] to evade wiretapping. Why couldn’t they also recruit engineers to build their own crypto and secure protocols? [1] https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...
There is nobody in the world easier to fool than a technically illiterate person with vague and malformed ideas about privacy and security. Once you've got them all worked up over illusory threats you can sell them any snake oil you want.
https://www.xda-developers.com/fbi-backdoor-pixel-arcaneos-a...
Unlocking the phone with a normal PIN code shows some normal apps like Tinder,
Netflix, and Facebook, but none of the apps actually open when you tap their
icon. However, unlocking the Pixel phone with a different PIN code reveals icons
for a clock app, a calculator app, and the device’s settings. Tapping the
calculator icon doesn’t actually open a calculator app, however. Instead, it
opens a login screen for the ANOM service