371–380 of 555 posts
Earlier quoted context omitted.
We just broke the locks on the cages with a screwdriver. Locks only keep honest people honest.
I don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system.
You'd be driven mad trying to find what the intrusion was on your system.
"But the case is locked!" Are the peripherals? Even if the case connectors are locked away behind a bird-box/knockout, if someone left one of these dangling unplugged off of the keyboard, do you think your field technician won't unlock the box and plug it right back in?
Earlier quoted context omitted.
The real answer? Because these people are just like us, geeks, nerds, techies, early adopters. They are just the same people we live and work with. The film Enemy of the State (1998) was science fiction except with the parts where the techy operators were just normal nerds like us. That what was most scary part of the film not the (at the time fantastic) surveillance.
And let's not forget that many of them are probably browsing HN at this very moment. They could be you, they could be me!
Couldn't be me: the private sector pays me waaaaaaaay more.
Also, you can't work for the feds if you ever touch the ganja, which is ridiculous. Everyone I personally know in infosec leads a very... alternative west-coast lifestyle which is not conducive to career progression in an east-coast, button-down-shirt environment.
Earlier quoted context omitted.
It’s a copy of the NSA ANT Coppermouth cables. That was part of the Snowden leak, so it’s been possible since at least then (the doc itself is circa 2008) if you have a three-letter name and a national security black budget. https://en.m.wikipedia.org/wiki/NSA_ANT_catalog
Why is the NSA so good at coming up with sweet codenames for things? I swear it's someone's full time job there.
Unfortunately the only real legit use for it is boring security work.
The best way to use this while avoiding big legal trouble would be to stalk a single target that would never have any idea they are being stalked and doesn’t have much resources to come after you legally. Maybe an ex-girlfriend or something.
Earlier quoted context omitted.
And let's not forget that many of them are probably browsing HN at this very moment. They could be you, they could be me!
> They could be you, they could be me! Couldn't be me: the private sector pays me waaaaaaaay more. Also, you can't work for the feds if you ever touch the ganja, which is ridiculous. Everyone I personally know in infosec leads a very... alternative west-coast lifestyle which is not conducive to career progression in an east-coast, button-down-shirt environment.
I entertained the idea of working in the public sector a while ago, for a brief time, until I learned that pot is fine in my past, but not in my present. "How the heck do you expect me to get the code written?"
Also, I've been told that getting a clearance is more burden than blessing. You have restrictions that an "ordinary person" doesn't have, along with criminal penalties for violating them. Whereas, without a clearance, if they really need you for something, they'll bring you in anyway.
Earlier quoted context omitted.
The real answer? Because these people are just like us, geeks, nerds, techies, early adopters. They are just the same people we live and work with. The film Enemy of the State (1998) was science fiction except with the parts where the techy operators were just normal nerds like us. That what was most scary part of the film not the (at the time fantastic) surveillance.
And let's not forget that many of them are probably browsing HN at this very moment. They could be you, they could be me!
Earlier quoted context omitted.
IIRC the funny thing is, the system that provides the codenames is random in order for the system to not leak information about what the code name is for. But since there's no limit to how many times you can request a code name, the system is being abused and users try until they get a good one.
What was the codename for the project to create that system?
https://en.wikipedia.org/wiki/Rainbow_Code
See this from the article:
"During WWII, British intelligence was able to glean details of new German technologies simply by considering their code names. For instance, when they began hearing of a new system known as Wotan, Reginald Victor Jones asked around and found that Wotan was a one-eyed god. Based on this, he guessed it was a radio navigation system using a single radio beam. This proved correct, and the Royal Air Force was able to quickly render it useless through jamming."
Read R.V. Jones book "Most secret* war" if this kind of war-engineering interests you.
* Pay attention to "most secret" rather than the ghastly Americanism "top secret"!
Earlier quoted context omitted.
It’s not really practical to defend against for most end users. Keeping a whitelist of known keyboards and mice is really the only defence even on Linux, and unless you work in a data centre that’s probably way overkill. With a home PC that doesn’t really work though, because in order to authenticate your mouse without some kind of central mouse log on a server you probably need to click a button, which you can’t do…
Whitelists don't work. As an attacker I just have the bootloaders of my malicious devices advertize the USB IDs of whitelisted devices like Apple Keyboards. The computer has no way of knowing it is not authentic. There is no signing or certification for USB devices. The only solution is a kernel that can place all newly attached USB devices in a queue for manual approval. This is what USBGuard and QubesOS both do. Th…