71–80 of 98 posts
Earlier quoted context omitted.
In most SoC's the answer is 'everything' because there's no such thing as an IOMMU.
How big a concern is this if the data is encrypted by the kernel or user space?
Earlier quoted context omitted.
I’m always amazed at how many people don’t understand this. Hanlon’s Razor is just a way to sound smart while indulging in self-soothing biases.
Malice is not falsifiable: anything could always just be another trick. So unless you want to end up believing everything is malice, it’s best to start with the benign explanations, until you’re sure they don’t fit.
But yes, it is an interesting proposal (perspective) to "resist from tempting explanation and picking the less attractive first" - just like the grit in delayed gratification.
This question has been in my head recently. How feasible is it really? The answer in the link isn’t comprehensive. Is it really out of the question for manufacturer’s to ship a particular version of a device and software for a target country? Nation states have a history of backdooring or weakening particular technologies.
Another means: is it really infeasible for a nation state to intercept and modify devices that are being sent to a specific country/person?
https://www.lemonde.fr/en/france/article/2023/07/06/france-s...
Earlier quoted context omitted.
You don't know what code is running on your baseband processor, do you? Do you know what other hardware your baseband processor has the ability to inspect?
In most SoC's the answer is 'everything' because there's no such thing as an IOMMU.
The main CPU/application processor/main CPU might be running better secured Unix/Linux and might be able to protect itself from peripheral CPUs, but that's not the point; a phone had always been a pair (minimum) of computers, traditionally referred to as Application Processor(AP) and Baseband Processor(BP), of only the slightly faster one is exposed to the user, and it's unclear what is going on inside the other one or how to handle it. That's the problem.
Earlier quoted context omitted.
I’m always amazed at how many people don’t understand this. Hanlon’s Razor is just a way to sound smart while indulging in self-soothing biases.
Malice is not falsifiable: anything could always just be another trick. So unless you want to end up believing everything is malice, it’s best to start with the benign explanations, until you’re sure they don’t fit.
Google Play is a rootkit. Google will fully cooperate with any government. If you use GrapheneOS on a pixel device your bootloader is closed source and the system-on-chip is largely undocumented and impossible to audit without serious resources. So yeah. Shit's fucked man.
I'll remind you that on previous MacOS versions (8 years ago?) researchers had discovered that the Mac laptop's integrated webcam could be turned on without the green LED turning on. So basically: the webcam turning on without the user knowing it. And way weirder: some random company somehow had the rights to sign code using that "feature".
The story got pretty much killed.
I'm sure if some digging had been done, you'd have found some three letter agency behind the shell company enjoying the very strange right to turn the webcam on on MacOS devices without the LED turning on.
For everybody out there: rest assured though, Apple are the good guys and there's no way they have the ability to turn on the webcam of your Mac laptop today without you knowing about it. [1]
[1] yes, this is sarcasm
Earlier quoted context omitted.
The notion that paranoia is the default emergent state of not assuming incompetence when potential malicious incentives can be easily articulated is just yet another ideological presupposition.
That part about paranoia was a half-joke. But no, it was not suggested (that was not a «notion») that paranoia would be a «default emergent state». It is tough a temptation of many. And while you will often be able to identify «potential malicious incentives», you have to put those possibilities together with the rest of those which can complete the set. Assessments must be complete. -- Edit: oh, by the way, importan…
This answer is dangerously naïve. Phone basebands and radios are full of vulnerabilities, if you don't want your phone to be a potential surveillance device given any minimally sophisticated adversary you should either turn off the radio or preferably shut it off entirely and remove the battery.
Say, a transcribed text of a conversation, for example's sake.