Google Play is a rootkit. Google will fully cooperate with any government. If you use GrapheneOS on a pixel device your bootloader is closed source and the system-on-chip is largely undocumented and impossible to audit without serious resources. So yeah. Shit's fucked man.
> Google will fully cooperate with any government. I'll remind you that on previous MacOS versions (8 years ago?) researchers had discovered that the Mac laptop's integrated webcam could be turned on without the green LED turning on. So basically: the webcam turning on without the user knowing it. And way weirder: some random company somehow had the rights to sign code using that "feature". The story got pretty much…
Spying on a smartphone remotely by the authorities: feasibility and operation
81–90 of 98 posts
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#82A little OT but strongly related: in France you can go to prison if you refuse to give your phone's password to the police (nothing like a "free country", I guess). Is there a way to set up a phone so that typing a "special" password puts the phone in an alternate state with different apps and content, etc. (and possibly erase the regular content)?
- I presume that's considered willful destruction of evidence and interfering with an official investigation, and worse charges than whatever you were probably facing (unless you really did fuck up and committed something bad). - Investigators are not going to be typing your password into the running original device, they're going to be trying it against an offline clone of the encrypted storage. All that will happen…
> Investigators are not going to be typing your password into the running original device, they're going to be trying it against an offline clone of the encrypted storage
Oh no, absolutely not. We're not talking about "investigators" here, just random cops in a random precinct who have zero infrastructure, zero knowledge about anything, and aren't pursuing any serious "investigation".
They will absolutely type your password into the running device. They're doing this all the time.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#83Earlier quoted context omitted.
But it’s a good question. I want to know. I am assuming this is not possible. The only thing i know of is capable of doing so is pegasus. But it’s very expensive afak.
You don't know what code is running on your baseband processor, do you? Do you know what other hardware your baseband processor has the ability to inspect?
Ok but we are talking remotely enabling camera and microphone. The baseband is only responsible of intercepting traffic. This needs kernel injection.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#84IANAL nor French, but reading the article, is this just saying that French police can get a warrant, issued by a judge, that allows them to tap a suspect's device (not longer than 6 months)? I just want to make sure I got the facts right. https://www.lemonde.fr/en/france/article/2023/07/06/france-s...
As far as I understand that, since there is no explicit clause prohibiting an extension after 6 months. I think it is safe to assume that it can be extended by another 6 months provided the suspicion persists (i.e. a judge can be convinced).
I'm not french myself, so take it with a grain of salt.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#85Earlier quoted context omitted.
- I presume that's considered willful destruction of evidence and interfering with an official investigation, and worse charges than whatever you were probably facing (unless you really did fuck up and committed something bad). - Investigators are not going to be typing your password into the running original device, they're going to be trying it against an offline clone of the encrypted storage. All that will happen…
About point 2, modern devices have a secure enclave, which means that copying the encryption key is pretty much impossible.
Impossible for the average thief, not impossible for government or Fortune 500 actors. There are private contractors in business solely dedicated to developing and licensing enclave cracks, and popping them is routine procedure for most law enforcement departments, even smaller ones.
Fundamentally you can't have a key and the data inside the same physical box and expect encryption to remain intact. Enclaves are just security through obscurity on steroids.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#86Earlier quoted context omitted.
That part about paranoia was a half-joke. But no, it was not suggested (that was not a «notion») that paranoia would be a «default emergent state». It is tough a temptation of many. And while you will often be able to identify «potential malicious incentives», you have to put those possibilities together with the rest of those which can complete the set. Assessments must be complete. -- Edit: oh, by the way, importan…
I think it's fair to say that money / power / sex will easily account for potential malicious incentives. The mindset that Hanlon's Razor fosters slows down the pattern recognition process that humans have built up throughout our entire existence. When building systems that must be resilient against corruption, the concept of zero trust serves well here.
But you have to always check. Yes, you do slow down «the pattern recognition process that humans have built up throughout»: because it is not reliable. It becomes (more) reliable through the exercise of doubt and assessment.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#87Earlier quoted context omitted.
I think it's fair to say that money / power / sex will easily account for potential malicious incentives. The mindset that Hanlon's Razor fosters slows down the pattern recognition process that humans have built up throughout our entire existence. When building systems that must be resilient against corruption, the concept of zero trust serves well here.
But you have to always check. Yes, you do slow down «the pattern recognition process that humans have built up throughout»: because it is not reliable. It becomes (more) reliable through the exercise of doubt and assessment.
You have to always check in relationships with other people. When it comes to institutions / corporations / organizations, not so much and there are far fewer options to just chalk things up to incompetence. Again, in this context, we’re already talking about governments spying on their own citizens.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#88Earlier quoted context omitted.
But you have to always check. Yes, you do slow down «the pattern recognition process that humans have built up throughout»: because it is not reliable. It becomes (more) reliable through the exercise of doubt and assessment.
You have to always check in relationships with other people. When it comes to institutions / corporations / organizations, not so much and there are far fewer options to just chalk things up to incompetence. Again, in this context, we’re already talking about governments spying on their own citizens.
> When it comes to
Still people.
> incompetence
It is not a matter of technical preparation.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#89To me the real question is. Technical feasibility aside. Would the cell phone manufacturers (Apple, Samsung, Motorola, Nokia, Xiaomi, etc) say no when faced with the possibility of losing market share in France. Because of a law pushed through under the cover of security. Many a liberties have slipped under that blanket cover called security. I think they will put in this feature if it's not already there.
I think the way it probably works is that if the US gov. wants to root someones phone anywhere in the world they just do it via some API given to them by apple/google directly. If a foreign country wants to do it to someone on foreign soil (like the saudis to bezos did [1]) they exploit some vulnerability brought on the free market (like the whatsapp/video message exploit chain the saudis used, or exploits like the N…
Not to undermine the plausibility of your suggestions, but I like to wonder how answers like this read like to someone with direct experience and knowledge.
Re: Spying on a smartphone remotely by the authorities: feasibility and operation
#90Earlier quoted context omitted.
I would assume this is possible. If the gov wants to bad enough, I'd guess most OSes have a way to remotely control and observe. A state has resources to research 0days, bank them, and use them as needed. But probably not worth using unless it's for a high value target.
Well, what would be considered a high-value target? Even if warrants are initially mandated for a specific search, couldn’t this erode into, ‘it’s just a quick scan’? What if it’s ‘useful’ to ‘quick scan’ their own President? ‘Confirming their security’. Could this evolve into a subtle shift in the balance of power? In other words, a political crisis? Where the intelligence agencies have informational advantages over…
If you give the government new extraordinary powers it will use them "only in necessary cases" but "necessary cases" has a way of creeping...
- Year 1: Terrorists.
- Year 2: Powerful gang leaders and drug kingpins
- Year 3: Run-of-the-mill murderers and kiddy diddlers
- Year 4: Deadbeat dads and unpaid parking tickets
- Year 5: Suspects who have encountered police and been released without being charged with a crime
Prime example: Civil forfeiture in the US. Was originally supposed to only be used on the worst of the worst drug cartel types, nowadays they'll use it to confiscate the life savings of some random black kid.
"That government governs best that governs least." You know, those limited government folks might be on to something...nah, they're all crypto grifters and crazy right wingers [/s]