301–310 of 330 posts
Earlier quoted context omitted.
The CIA reportedly used the “Save the Children” charity as a front for a fake hepatitis B vaccination program in Pakistan to help confirm Bin Laden’s location. A ban on the polio vaccination program in some Taliban territory and attacks on vaccine workers followed.
Hint to Spy Game where Brad Pitt plays a Journalist as an active CIA agent was no mistake.
It should be explained to public how such exploit take place, with open sourcing necessary parts. Otherwise there is no way for us to know it wasn't intentional at first place. I am not meaning there is a possibility like Apple as a company decides to put exploits. However governments can easily do it with single engineer at right place.
According to wikipedia[1] Pegasus is usually installed via a zero-click iMessage exploit. Open-sourcing Pegasus doesn't seem likely as NSO Group sells it for big bucks. It seems unlikely that Apple has colluded with NSO, as Pegasus is actually a bit of a black eye for the company. I'm not sure what governments can do with an engineer in the right place - in general I'd say "not much, and certainly not as much as with…
Earlier quoted context omitted.
I just go solid opaque bar. Way easier to do and harder to screw up.
Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.
I think you mean "illegally hack the black bars".
So how do we protect our privacy from the advance of technology? It doesn't seem possible. Just going after NSO is useless.
It depends on what your threat model is. If its individuals, local law enforcement, or even national law enforcement (context dependent) you are trying to hide from, you can obtain phones with cash and make it very difficult to link them to you (use a sim card bought with cash and never give out that number, use a VOIP service for your primary number, use an OS that doesn't send back much telemetry, turn off location…
Earlier quoted context omitted.
Not quite the same thing, but I had to head home early one night recently because my phone had died (which almost never happens to me) so I couldn't show vaccination-proof. I would guess that a person's phone dying while bar-hopping is much more common than dying while dining alone (since when dining with others, you can just look at their menus). You're not wrong that this fundamentally excludes those who don't have…
because my phone had died (which almost never happens to me) so I couldn't show vaccination-proof. I'm in Canada, and we use QR codes, signed by the government, to show and validate status. Mine is printed out, and in my pocket. No phone is required. Thus, no one needs to avoid anything, phone or not.
Also, in your case, is this a federal system or a state by state one? If the latter, this sounds way worse than what NY is doing; with my CA vaccination I couldn't get in anywhere.
Earlier quoted context omitted.
Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.
It would be funny to place fake data behind the removable bars for tech savvy people to find.
Tech savvy people, but also journalists
https://arstechnica.com/tech-policy/2021/10/missouri-gov-cal...
I really hope the blur on the picture ( https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima... ) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.
man why do people even take the gamble of using a blur just use a opaque box
I did blur over black box because the blur was less visually obtrusive
Earlier quoted context omitted.
You don’t need any input from the user/target. Once the malicious code reaches the device the exploit works its magic.
An open source cellular modem firmware is long overdue, but there's no government on Earth that would be keen on allowing it to happen, the best we have is 2G/3G stuff that has been illegally leaked and reverse engineered. A lot of dragons lurking in the dark there.
Earlier quoted context omitted.
because my phone had died (which almost never happens to me) so I couldn't show vaccination-proof. I'm in Canada, and we use QR codes, signed by the government, to show and validate status. Mine is printed out, and in my pocket. No phone is required. Thus, no one needs to avoid anything, phone or not.
Well yes, the point of this subthread is not that it's impossible to do this well, but that bars/restaurants don't seem to care whether they're excluding the occasional unlucky customer. I'm in New York City and not a single person has scanned my vax QR code: they just see a vaguely official looking app with a name that matches my ID, or a physical vaccination card (conveniently sized to not fit in any wallets). Also…
The QR code is provincial, but it only requires minor changes to have one provincial app, look at other validation sources.
I agree that sadly, restaurants may find some metrics too high/annoying to deal with, and opt for a lost sale.
Earlier quoted context omitted.
Just use a dumb phone and a garmin like journalists did in the early 2000s?
How do you communicate with your sources?