8 ms·

I'm so tired of these... Is there really no way we can make it technologically impossible for them to exfiltrate user data?

by zexodus 8mo ago

a_paddy 8mo ago
The problem is they'll legislate for the providers to insert back doors, negating cryptographic hardness.
- TingPing 8mo ago
  They have to make custom software illegal at some point.
  - 0xTJ 8mo ago
    Given how many of these stories have been coming out, I'm sure they're considering it.
  - digiown 8mo ago
    They don't have to make it illegal. They can just create all kinds of barriers like only allowing government approved OSes for essential services, and then using custom software can become grounds for suspicion and subject you to searches, etc.
    - thewebguyd 8mo ago
      I'm certain this is the direction we are all heading, unfortunately. Governments will sanction the major proprietary OSes and compel Apple, Google, Microsoft to participate in their surveillance programs, and those will have remote integrity attestation and will be the only hardware and software you will be able to use to access essential services and the internet as whole, most likely. The usage of alternative software won't be outright illegal, but will get you on a watchlist. Like you said, they don't need to make other software illegal, just make circumventing the blocks illegal. They can't arrest everyone, but, it's one more gray area thing that can and will be used against you should the government ever decide they have a bone to pick with you specifically so you can get away with it for a long time, until suddenly you don't.
voxic11 8mo ago
You can make it technologically impossible, but they can also come and arrest you just for using such technology. So its not really a technical problem, its a social/political one.
- jMyles 8mo ago
  Sure, but then they need to send a physical person, which is expensive and impossible to scale. Making it extremely expensive is probably good enough. (Feels like we have this same discussion over and over on HN.)
  - deleted 8mo ago
    [deleted]
  - direwolf20 8mo ago
    [dead]
  - gmueckl 8mo ago
    I don't understand this take. There is no real way in which a private person can make law enforcement "more expensive". The government can always find means as long as it is supported by a sufficiently big fraction of its people.
    - xboxnolifes 8mo ago
      1 person using encryption vs 1 million people using encryption.
      - SauntSolaire 8mo ago
        Sure, they won't go out and arrest all one million, but from an individual perspective it's basically security by obscurity. Once that's the case, otherwise legal activities (e.g. protesting, or making political statements) run the risk of making you a target. Law enforcement can then punish you for your legal activity by selectively enforcing this other law. The resulting situation is one where everyone knows to some extent "you better shut up if you know what's good for you", and puts a chilling effect on otherwise legal forms of civic engagement. You might point out that there are already laws on the books that let them do this, but I'm sure they wouldn't mind another.
mghackerlady 8mo ago
Avoiding centralised services is generally a good start. You could also do something like encrypt any messages through PGP even if the service you're using is already "e2e encrypted" like iMessage or signal
rtkwe 8mo ago
I don't think there's a way with a phone that people would actually be willing to use. At some point it has to be decrypted to be displayed to the user and there's always the chance there's a flaw somewhere in the stack from hardware to OS to app etc that will have a gap to exfiltrate the data.
briandw 8mo ago
https://xkcd.com/538/ https://xkcd.com/538/ User data can only be as safe as the user.
anigbrowl 8mo ago
There are no technical solutions to human problems. This has been explained over and over again, most famously in Randall Munro's XKCD comic where the secret police resort to hitting someone with a $5 wrench until they give up the password. If you're in a repressive state and you're worried about your data being exfiltrated the best security practice of all is not to create records of illegal activity. If you have to store such material, don't keep it on a communications device, put it on an external storage device, hide it somewhere outside your home, and don't tell anyone about it.

I'm so tired of these... Is there really no way we can make it technologically impossible for them to exfiltrate user data?

by zexodus 8mo ago

I'm so tired of these... Is there really no way we can make it technologically impossible for them to exfiltrate user data?

a_paddy 8mo ago

The problem is they'll legislate for the providers to insert back doors, negating cryptographic hardness.

TingPing 8mo ago
They have to make custom software illegal at some point.
- 0xTJ 8mo ago
  Given how many of these stories have been coming out, I'm sure they're considering it.
- digiown 8mo ago
  They don't have to make it illegal. They can just create all kinds of barriers like only allowing government approved OSes for essential services, and then using custom software can become grounds for suspicion and subject you to searches, etc.
  - thewebguyd 8mo ago
    I'm certain this is the direction we are all heading, unfortunately. Governments will sanction the major proprietary OSes and compel Apple, Google, Microsoft to participate in their surveillance programs, and those will have remote integrity attestation and will be the only hardware and software you will be able to use to access essential services and the internet as whole, most likely. The usage of alternative software won't be outright illegal, but will get you on a watchlist. Like you said, they don't need to make other software illegal, just make circumventing the blocks illegal. They can't arrest everyone, but, it's one more gray area thing that can and will be used against you should the government ever decide they have a bone to pick with you specifically so you can get away with it for a long time, until suddenly you don't.

voxic11 8mo ago

You can make it technologically impossible, but they can also come and arrest you just for using such technology. So its not really a technical problem, its a social/political one.

jMyles 8mo ago
Sure, but then they need to send a physical person, which is expensive and impossible to scale. Making it extremely expensive is probably good enough. (Feels like we have this same discussion over and over on HN.)
- deleted 8mo ago
  [deleted]
- direwolf20 8mo ago
  [dead]
- gmueckl 8mo ago
  I don't understand this take. There is no real way in which a private person can make law enforcement "more expensive". The government can always find means as long as it is supported by a sufficiently big fraction of its people.
  - xboxnolifes 8mo ago
    1 person using encryption vs 1 million people using encryption.
    - SauntSolaire 8mo ago
      Sure, they won't go out and arrest all one million, but from an individual perspective it's basically security by obscurity. Once that's the case, otherwise legal activities (e.g. protesting, or making political statements) run the risk of making you a target. Law enforcement can then punish you for your legal activity by selectively enforcing this other law. The resulting situation is one where everyone knows to some extent "you better shut up if you know what's good for you", and puts a chilling effect on otherwise legal forms of civic engagement. You might point out that there are already laws on the books that let them do this, but I'm sure they wouldn't mind another.

mghackerlady 8mo ago

Avoiding centralised services is generally a good start. You could also do something like encrypt any messages through PGP even if the service you're using is already "e2e encrypted" like iMessage or signal

rtkwe 8mo ago

I don't think there's a way with a phone that people would actually be willing to use. At some point it has to be decrypted to be displayed to the user and there's always the chance there's a flaw somewhere in the stack from hardware to OS to app etc that will have a gap to exfiltrate the data.

briandw 8mo ago

https://xkcd.com/538/ https://xkcd.com/538/ User data can only be as safe as the user.

anigbrowl 8mo ago

There are no technical solutions to human problems. This has been explained over and over again, most famously in Randall Munro's XKCD comic where the secret police resort to hitting someone with a $5 wrench until they give up the password. If you're in a repressive state and you're worried about your data being exfiltrated the best security practice of all is not to create records of illegal activity. If you have to store such material, don't keep it on a communications device, put it on an external storage device, hide it somewhere outside your home, and don't tell anyone about it.