Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosec 101 for Activists

infosecforactivists.org

Post reply on HN
Print view View original

161–170 of 220 posts

Re: Infosec 101 for Activists

#161

Post by LWIRVoltage »

janmo wrote: post #69
joecool1029 wrote: post #41

Hesitant to recommend proton since they can't stay out of politics, I don't think mullvad has any similar slipups: https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...

As I pointed out they also route all of their traffic through Cloudflare. They also have been caught red-handed logging the IP of an activist despite having previously advertised that they didn't keep any logs. Now they are using misleading terms such as "privacy by default" which according to them means that by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks th…

Not sure why you didn't mention the law ruled heavily in favor of protonmail as a result of that massive fight between Protonmail and the authorities after that happened( they had to comply, while fighting back) - so as a result, they now have legal law BACKING for privacy even more and cannot be compelled like that again-

when they got that court order that wanted them to retain logs, they , challenged it immediately- and the rulingcame down - and they won.

They can no longer be compelled to cooperate in cases of crimes in other countries that match crimes in Swiss laws, as happened here- and this happened because they fought back -it just took time for the ruling to come down.

https://www.msn.com/en-us/money/other/protonmail-wins-privac...

https://protonmail.com/blog/court-strengthens-email-privacy/

So they are in a good position on that aspect -most countries aren't as solid legally.

Re: Infosec 101 for Activists

#162

Post by idlewords »

Dem0ngo wrote: post #72
tptacek wrote: post #67

One of the first things you can do with any of these kinds of lists is to see if they recommend Firefox over Chrome. It's an excellent shibboleth, because Firefox codes (rhetorically) profoundly more activist- and privacy- friendly than Chrome does, but Chrome has much more sophisticated and better tested runtime protections. Firefox seems like it would be the better recommendation, but if what you care about is not…

The point isn't that Firefox is less exploitable it's that it has less blatant tracking than alternatives like Chrome. If you're an activist I'd imagine that exploits are a scary thought but the more direct threat is the tracking we (un)knowingly succumb to every day.

If your threat model is tracking, then worry about carrying around the 24/7 tracking device more than the specific software you run on it.

Re: Infosec 101 for Activists

#163

Post by monero-xmr »

lyu07282 wrote: post #107
redeux wrote: post #27

Earlier quoted context omitted.

I’m not sure I understand why the tables are turned now.

It's complicated to explain, but in the republican(/conservative/trump supporter) mind "activists" are (in support of) "far-left marxist communist liberal extremists" like Biden, Obama or Harris, so the FBI/CIA/NSA under the Biden administration were protecting them and calls for making encryption illegal only targeted "the republican" so activists supported ending encryption because it benefited them in their unjust…

It’s not complex to explain. The establishment was all Democrats and they tried to ban encryption. Now the establishment is Republican and the same elites who tried to take away encryption are now using it.

Re: Infosec 101 for Activists

#164

Post by fsflover »

neilv wrote: post #97

Step 1: Determine your threat model. Step 2: Realize that none of these measures are adequate for that threat model, in the current environment. (For pretty much any threat model.) Step 3: Realize that some of these measures draw attention to yourself, however.

Please stop with the security nihilism: https://news.ycombinator.com/item?id=27897975

See also: https://qubes-os.org (my daily driver OS).

Re: Infosec 101 for Activists

#165

Post by LWIRVoltage »

some_furry wrote: post #43
bagels wrote: post #40

Earlier quoted context omitted.

A more constructive response is to explain why it won't work.

A more constructive response is to explain why it won't work, rather than telling me to explain why it won't work. My first post in this thread has a link that explains why VPN services aren't trustworthy. But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN. Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing us…

There is one reason- VPN traffic, vs tor traffic monitoring. Tor traffic stands out and that has been used to nab people famously, like that bomb hoax incident. Which suggests cloaking tor with a solid VPN is the way to go. Yes, bridges may be an option as well, but I don't know that their ease of use is where it should be for everyone wanting to be hidden

Re: Infosec 101 for Activists

#166

Post by myrmidon »

ReptileMan wrote: post #160
myrmidon wrote: post #154

Earlier quoted context omitted.

Do you think the blanket-pardon for J6 was ethically justifiable? To me, a blanket pardon appears very problematic because I firmly believe that the underlying action (violent protest directly aimed at government representatives) was and is still a crime (I think that a group of protestors similarly storming the capitol or white house now would --and should-- not be pardoned either). The whole thing is even more prob…

[flagged]

> Yes, because the governments in 2020 have shown that rioting, setting building on fire, attacking police departments and declaring shit like CHAZ was totally ok and won't be persecuted.

Are you sure that this is not a distorted perception, fueled by media that profit off of outrage? There have been >14000 arrests following the George Floyd protests; I don't think it was ever established that setting public property on fire was fine (legally), not during the last administration and most certainly not now...

> But since Trump JD is not trying to put people from that summer in jail - I am totally fine with both group of thugs being free

Even if people had not been arrested during the protests (they were), this is still super iffy. This is a bit like saying "since Trump never did anything against Pelosis insider trading, its fine if he engages in it himself"-- in my eyes, thats not "morally cancelling out", thats him failing twice...

Re: Infosec 101 for Activists

#167

Post by fsflover »

idlewords wrote: post #162
Dem0ngo wrote: post #72

Earlier quoted context omitted.

The point isn't that Firefox is less exploitable it's that it has less blatant tracking than alternatives like Chrome. If you're an activist I'd imagine that exploits are a scary thought but the more direct threat is the tracking we (un)knowingly succumb to every day.

If your threat model is tracking, then worry about carrying around the 24/7 tracking device more than the specific software you run on it.

Isn't it the software which is tracking you? You can switch off the cellular connection whenever you need to not be tracked by the towers (if you trust your software, or with a hardware switch on some phones).

Re: Infosec 101 for Activists

#168

Post by fsflover »

lukev wrote: post #145
seethishat wrote: post #137

It's hard for me to believe that people actually think they can use Signal or some other 'security app' on a device that is fundamentally compromised already. Sure, your messages are encrypted, but they (whoever they are) have the private keys (both sender and receiver) because the smart phones you are using are compromised by them. It's really simple. So next time you read a news story about criminals who were using…

If you have evidence of how the secure enclaves on mobile devices are compromised, you should share those details. You can also believe that there is an industry-wide conspiracy in which everything is backdoored. But that's a philosophical/political claim, not a technical one. Which type of claim are you making?

> secure enclaves on mobile devices

Which secure enclaves? If you can read a message on your screen and your OS obeys somebody else, not you, then they can also do it.

Re: Infosec 101 for Activists

#170

Post by ReptileMan »

myrmidon wrote: post #166
ReptileMan wrote: post #160

Earlier quoted context omitted.

[flagged]

> Yes, because the governments in 2020 have shown that rioting, setting building on fire, attacking police departments and declaring shit like CHAZ was totally ok and won't be persecuted. Are you sure that this is not a distorted perception, fueled by media that profit off of outrage? There have been >14000 arrests following the George Floyd protests; I don't think it was ever established that setting public property…

The best solution would have been for Biden to pardon everyone non violent (in violence defined something greater that what you would find in a hardcore mosh pit) and leave the rest - but that is long gone.

As a person that has set fire once to the building of my country parliament and overthrown the government - honestly it is not such a big deal

Post reply on HN