431–440 of 566 posts
Earlier quoted context omitted.
2FA should be TOTP not SMS
95% of my 2FA accounts are TOTP. My issue is that not all providers give me printable backup codes - some just say "get two devices!" and that's just not reasonable for a variety of reasons.
This always allows me to recreate the TOTP entry.
Earlier quoted context omitted.
Your argument, and that of many others here, seems to be that any govt surveillance is illegitimate, and that govt cannot have any legitimate reason to capture information on anyone. There couldn't be any actual reason for intelligence operations. "It is your politics showing". Any such view is hopelessly ignorant and naive, yet it pops up here often. The person to whom I'm replying is blatantly implying that it is n…
> If you want to do that, we might as well simply declare anarchy, and let everyone deal with the criminals and warlords who will take over, and that's no exaggeration. Bruv … Honestly I can’t tell if you’re for real or no. You already did that! California. People robbing stores in broad daylight, nothing happens to them. Chicago. Do I need to say anything about that third world enclave? Bloody hell man, chaz. A lite…
It has already been tried, both the ages before govt, every time govt fell down, and in the case of San Francisco, just got way too lax.
The idea that we can somehow get away without governance (or intelligence ops, or policing) is born completely of very high privilege — it completely assumes that all the things that the govt does just happen automatically.
It is just like the idiot new manager who arrives and sees that the halls and offices are clean so fires the janitorial staff as excess cost or because they are inconvenient.
Of course there are overreaches and abuses of intelligence, and the very concept of policing and everything about it's training, practice, accountability, and results needs to be burnt to the ground and overhauled.
But that does NOT mean that we can get away without it. Because, as you noted, even a little time without it becomes a disaster.
The key is not to abandon intelligence. The key is to strengthen democracy, make sure that the institutions of democracy, lawmaking, executive, judicial, press, academia, industry, ngos, and individual people all have their own separate power base and independence.
In autocracies, all of these are bent to the service of the leader/oligarch.
In democracies, there are all kinds of visible flaws, but they tend to be self-correcting, because there is oversight and balance of power. That alone does not prevent overreach or abuses, but it does lead to them being eventually corrected.
As Churchill said: "Democracy is the worst form of government, except for all others."
Even if you are a person who will never in your life end up as any kind of person of interest for the government, handing over data in this way could still be quite dangerous. Phones will often contain data that can facilitate theft and fraud if ending up in the wrong hands. If they're able to copy everything, including private data from all apps that could be quite bad. For example many countries now use apps to log…
Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Apple vs Android is irrelevant in this, there is no truly safe mainstream phone in 2022, period. Are people really that lazy? I do manage quite a few financial things but for none of those phone apps is crucial and…
How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app.
How do you withdraw money from an ATM? Again, this is moving primarily app based.
Your definition of sane may be security at all costs, but for most convenience and social norms trump this.
Even if you are a person who will never in your life end up as any kind of person of interest for the government, handing over data in this way could still be quite dangerous. Phones will often contain data that can facilitate theft and fraud if ending up in the wrong hands. If they're able to copy everything, including private data from all apps that could be quite bad. For example many countries now use apps to log…
Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Apple vs Android is irrelevant in this, there is no truly safe mainstream phone in 2022, period. Are people really that lazy? I do manage quite a few financial things but for none of those phone apps is crucial and…
Because it's convenient, and security is a trade off with convenience. I use banking apps on my phone, and I suspect many (most, even) people here on HN (and who are technically savvy in general) do as well. That doesn't make it smart or good or correct, but I suspect that is the status quo.
I haven't traveled outside the US since before the pandemic, but these days I may only travel with a burner phone the next time I do so.
> Phones are not secure
Neither are laptops or desktops, or anything, really. Everyone needs to decide for themselves what level of security they're willing to accept, and what their threat model is.
Even if you are a person who will never in your life end up as any kind of person of interest for the government, handing over data in this way could still be quite dangerous. Phones will often contain data that can facilitate theft and fraud if ending up in the wrong hands. If they're able to copy everything, including private data from all apps that could be quite bad. For example many countries now use apps to log…
> Even if you are a person who will never in your life end up as any kind of person of interest for the government Literally no way to ensure that.
https://www.congress.gov/bill/117th-congress/senate-bill/295...
Earlier quoted context omitted.
> If you think you’re immune just because you’re a US citizen, you’re not. That's a pretty big claim, do you have a particular example in mind? You might have your phone seized, sure, but denying a citizen entry to the country? Even CBP understands they can't do that and it would make the evening news if they did it.
This thread is confusing. Are you implying that Canada can't deny entry to Canada to an American? Canada denies entry to tons of Americans. Americans with a DUI on their record have trouble visiting Canada.
If you are a citizen of the United States of America, and you are returning to the United States from a foreign country, Customs and Border Patrol are not allowed to deny you entry to the United States of America.
Of course the caveats - if you, as the citizen, have an outstanding warrant, they can arrest you. They can take your electronics. They can delay you. They can put you in a room by yourself for some period of time. But they can’t deny you entry without some kind of legal reason. They can’t hold you indefinitely.
It just comes down to how much the citizen is willing to be inconvenienced.
And I believe any American with any felony on their record will have trouble visiting Canada. I once traveled with a guy who had a felony assault conviction from a college bar fight 15 years prior. They wouldn’t let him in.
Terrifying for only 2 reasons: 1. Any malicious person savvy enough to pull off a crime of interest to the Feds is smart enough to provide a wiped or burner phone to DHS/ICE, and they have to know this. So, what is the point in doing this if not to target law abiding citizens. 2. USGOV has a spotty track record of keeping this information secure. A foreign actor is likely to access this info eventually. As one former…
This is one thing that has always confused me about the data collection in democratic countries. I understand the appeal from an authoritarian perspective, but it seems that people don't recognize that this same data can be used as a weapon against their own citizens.
So you're left with three real options: 1) Minimize data collection, 2) Spend massive amounts of money on encryption, research, and constant audits to minimize the risk of data leakage (which will eventually get leaked in some form), 3) leave your population (and your political positions) vulnerable to manipulation by foreign and domestic entities that do not have the public's (or your) interest in mind. It seems like we're going with #3 but it even seems like a bad strategy for authoritarians. #2 seems better for that one. But #1 seems best for democracies and people in positions of power where power is not highly centralized. (Can we at least get homomorphic encryption and learning algorithms?) But I guess these same people are still under an impression that a backdoor doesn't work like any other door: that anyone can use a door as long as you can figure out how to break or crack the lock (which always happens).
Earlier quoted context omitted.
> Even if you are a person who will never in your life end up as any kind of person of interest for the government Literally no way to ensure that.
It doesn't even have to be the government itself. Let's say the sheriff in your town takes interest in your partner. Or his kid gets in a spat with your mom because the kid was DUI.
Earlier quoted context omitted.
> 1. Any malicious person savvy enough to pull off a crime of interest to the Feds is smart enough to provide a wiped or burner phone to DHS/ICE, and they have to know this. So, what is the point in doing this if not to target law abiding citizens. This isn't even remotely true. See for example the recent Anom honeypot[1]. Criminals do more or less the same things that ordinary citizens do, and often have strictly wo…
Criminals who get caught do more or less the same things that ordinary citizens do, because the systems setup to catch them assume they'll act like a normal person, because you catch the greatest number of criminals that way. By definition, we have no information about what criminals who don't get caught do, because they're never identified as criminals. That's the point. Selection bias is the most powerful force in…