Some coverage of our paper here (but, as always, we urge you to read the paper itself). nytimes.com/2021/10/14/bus…
Building in scanning for illicit content on client computing devices, however laudable the goal, is a radical architectural concept, introducing significant security risks. And so far, specific proposals for client scanning, while often novel, have been less than encouraging.
Re-upping because much of the press coverage of our “Bugs in your Pocket” paper fails to include a link to it. cs.columbia.edu/~smb/papers/bu…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Don’t encode SSNs of people in the HTML of publicly available webpages. And if you do, don’t call the cops if someone notices and (quite responsibly) warns you.
This case reads like a spy novel, and also illustrates the limits of cryptography. He set up encrypted communication and dead drops with a foreign government (even calling the endpoints “alice” and “bob”), but was actually communicating with the FBI.
My guess for COUNTRY1 is France: has subs, independent enough that someone might approach but friendly enough to rebuff the approach and cooperate with the US, not English speaking.
A couple things jumped out at me. As soon as the FBI got the package from COUNTRY1, they clearly took it VERY seriously. Within just a week they had analyzed the SD card and sent an initial response to the Proton account.
Imagine if FB owned AWS (or something with a similar footprint) right now.
“The Internet was designed to survive a nuclear war” has always been a myth, but it’s wronger than ever after decades of quiet centralization.
A really bad takeaway from this would be “look how badly FB was engineered”. They no doubt made some (serious) errors, but they’re about as technically good as anyone is at their scale.
Spending a lazy sunday afternoon testing faraday bags for phones. (Preliminary results so far: You don’t always get what you pay for, but you never get what you don’t pay for.)
Motivated by the fact that iPhones officially can’t be powered off, which, even if they implement really good privacy protections, will inspire other manufacturers to try similar things, often less carefully.
Some quick preliminary results, testing at 1, 2, 3, 4 , 5 and 6GHz: The expensive (~USD 40-60) phone-size bags from Mission Darkness (sold on Amazon) and EDEC (online store) work reliably well: >60dB attenuation at 1M distance, IF closed properly.
I knew this was coming eventually, but it finally happened. I asked a class today, as I periodically do, “how many people here have a landline phone at home” and the answer was zero.
“Plain old telephone service”, used to mean the once ubiquitous 48V,20ma local loop. The kids today think it means a cellphone with no data service.
That Apple origin story about Woz and Jobs financing the company by selling Blue Boxes for making free long distance calls requires a lot more explanation than it once did.