Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

briarproject.org

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#11

Post by meibo »

lloydatkinson wrote: post #9
rchaud wrote: post #4

Peer to Peer data transfer via computing devices is something I wish was be more mainstream. It's not, because the commercial cloud storage mafia has invested heavily in telling people that your data has to traverse their toll roads first. I recently discovered Syncthing Fork which was customizable in a way Google Drive or alternatives were not. And it's entirely P2P, transmitting files between my laptop and my phone…

> Bluetooth transfer There was a brief period while I was at school where people would share mp3 files with each other this way. This was before 2010.

Also, small java feature phone games! Was always a highlight when someone was "traded" a brand new feature phone game from another school, and it spread through ours within a day.

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#12

Post by oreilles »

rchaud wrote: post #4

Peer to Peer data transfer via computing devices is something I wish was be more mainstream. It's not, because the commercial cloud storage mafia has invested heavily in telling people that your data has to traverse their toll roads first. I recently discovered Syncthing Fork which was customizable in a way Google Drive or alternatives were not. And it's entirely P2P, transmitting files between my laptop and my phone…

Why Bluetooth when WiFi is a hundred times faster?

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#13

Post by redundantly »

ChuckNorris89 wrote: post #8
jjbinx007 wrote: post #2

Presumably sd cards are safer to connect rather than unsolicited usb drives.

Safer how? On PC at least, SD card readers, both internal and external are attached via the USB protocol and are seen by the OS like mass storage devices, just like USB drives, including being bootable, so whatever malware you have for a specific PC target, the payload should basically work the same from SD cards as via USB drives.

Nyet.

An SD card in a card slot can only be accessed as a mass storage device.

A USB drive can act as a mass storage device as well as a keyboard and mouse and even contain an entire OS on it that could be remotely accessible via WiFi.

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#14

Post by LeifCarrotson »

jjbinx007 wrote: post #2

Presumably sd cards are safer to connect rather than unsolicited usb drives.

A USB drive can operate fully within the USB spec, implementing a USB hub and USB keyboard, and enter malicious code.

The SD interface does not implement a similar spec, so this somewhat safer. The bad news most PC card readers are based on USB, so a targeted attack (which is probably in scope for Briar's customers) may still be possible - you could attack the firmware of the card reader, as described in [1] by Adam Caudill of BadUSB fame. Without breaking that firmware, however, you can't connect USB network->Card reader->USB hub, and you also probably can't connect SDIO/SPI network->SDIO-based-card-reader->USB hub.

There's also the possibility that the card itself can run untrusted code. Just like a USB drive, an SD card typically contains a small 8051 [2] or ARM [3] microcontroller. Running a compromised controller would give the attacker access to all the data that's ever sent to the SD card, but one would hope that Briar does not cache unencrypted data to the uSD card which the user is expected to write to an physically pass to a potential adversary.

Also, be aware of products like the Toshiba FlashAir Wifi SD card, which implement a wireless adapter in an SD card form factor. Replacing the label would be trivial, and it could broadcast or connect to a hidden wifi network without your knowledge. But again, one would hope that Briar does not cache unencrypted data to the SD card where it could, with one of these cards, be exfiltrated wirelessly. I think this capability is only available as an SD card or an obvious uSD-to-protruding-SD-card adapter form factor, not as a microSD card which would typically be used in a mobile device.

Of course, there's still the possibility that the host OS does something stupid, like autorun an executable on the external media...but that's more of a badly configured Windows PC problem, I expect that modern mobile devices do not do that.

[1] https://security.stackexchange.com/a/109595

[2] https://www.bunniestudios.com/blog/?p=3554

[3] https://www.bunniestudios.com/blog/?page_id=1022

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#15

Post by lou1306 »

ChuckNorris89 wrote: post #8
jjbinx007 wrote: post #2

Presumably sd cards are safer to connect rather than unsolicited usb drives.

Safer how? On PC at least, SD card readers, both internal and external are attached via the USB protocol and are seen by the OS like mass storage devices, just like USB drives, including being bootable, so whatever malware you have for a specific PC target, the payload should basically work the same from SD cards as via USB drives.

Still, it's probably much easier for an USB drive to actually pack malicious hardware in addition to software, like sensors (e.g., microphones) or an USB killer:

https://en.wikipedia.org/wiki/USB_Killer

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#16

Post by jqpabc123 »

rchaud wrote: post #4

Peer to Peer data transfer via computing devices is something I wish was be more mainstream. It's not, because the commercial cloud storage mafia has invested heavily in telling people that your data has to traverse their toll roads first. I recently discovered Syncthing Fork which was customizable in a way Google Drive or alternatives were not. And it's entirely P2P, transmitting files between my laptop and my phone…

https://github.com/zhanghai/MaterialFiles

Open source Android file manager with built-in ftp server.

Windows file manager also has built-in ftp.

Linux has built-in ftp.

Transfer files fast and easy over WiFi.

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#18

Post by ChuckNorris89 »

redundantly wrote: post #13
ChuckNorris89 wrote: post #8

Earlier quoted context omitted.

Safer how? On PC at least, SD card readers, both internal and external are attached via the USB protocol and are seen by the OS like mass storage devices, just like USB drives, including being bootable, so whatever malware you have for a specific PC target, the payload should basically work the same from SD cards as via USB drives.

Nyet. An SD card in a card slot can only be accessed as a mass storage device. A USB drive can act as a mass storage device as well as a keyboard and mouse and even contain an entire OS on it that could be remotely accessible via WiFi.

You're right. My bad.

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#19

Post by emptysongglass »

jqpabc123 wrote: post #17

Man can not live by Android alone. I wish it wasn't this way but a communication app that only serves Android is severely limited and won't make the cut on my Android phone.

Yes I wouldn't touch it because even though I'm not into Apple and its ecosystem I do communicate with Apple users and I'd expect activists would want to too.

Re: Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

#20

Post by ChuckNorris89 »

oreilles wrote: post #12
rchaud wrote: post #4

Peer to Peer data transfer via computing devices is something I wish was be more mainstream. It's not, because the commercial cloud storage mafia has invested heavily in telling people that your data has to traverse their toll roads first. I recently discovered Syncthing Fork which was customizable in a way Google Drive or alternatives were not. And it's entirely P2P, transmitting files between my laptop and my phone…

Why Bluetooth when WiFi is a hundred times faster?

AFAIK there's still no standardized, non-proprietary, easy, out of the box way to share files between different phones brands/OS and/or PCs using WiFi as Android/Samsung/Apple each do their own thing here.

You have to resort to setting up an ftp server and/or download extra apps on your phone for this, whereas Bluetooth file sharing is standardized and should work out of the box on any phone brand or OS (not sure on iPhones though) and anyone should know how to use it without needing any third party apps.

Post reply on HN