This guide emphasizes minimizing digital traces for protesters through practical smartphone security advice. It recommends using a secondary, "burner" phone dedicated to protests, ideally a basic model without internet connectivity. If using a primary smartphone, strong passcodes/biometrics, full-disk encryption, and up-to-date software are crucial. Minimizing data collection involves disabling location services, microphone access for unnecessary apps, and using privacy-respecting alternatives to default apps like Signal for messaging and a privacy-focused browser. During protests, enabling airplane mode or using Faraday bags is advised. The guide also covers digital threat models, stressing the importance of awareness and preparedness for potential surveillance and data breaches.
DualQRCode.com offers a free online tool to create dual QR codes. These codes seamlessly embed a smaller QR code within a larger one, allowing for two distinct links to be accessed from a single image. The user provides two URLs, customizes the inner and outer QR code colors, and downloads the resulting combined code. This can be useful for scenarios like sharing a primary link with a secondary link for feedback, donations, or further information.
Hacker News users discussed the practicality and security implications of dual QR codes. Some questioned the real-world use cases, suggesting existing methods like shortened URLs or link-in-bio services are sufficient. Others raised security concerns, highlighting the potential for one QR code to be swapped with a malicious link while the other remains legitimate, thereby deceiving users. The technical implementation was also debated, with commenters discussing the potential for encoding information across both codes for redundancy or error correction, and the challenges of displaying two codes clearly on physical media. Several commenters suggested alternative approaches, such as using a single QR code that redirects to a page containing multiple links, or leveraging NFC technology. The overall sentiment leaned towards skepticism about the necessity and security of the dual QR code approach.
Little Snitch has a hidden "Deep Packet Inspection" feature accessible via a secret keyboard shortcut (Control-click on the connection alert, then press Command-I). This allows users to examine the actual data being sent or received by a connection, going beyond just seeing the IP addresses and ports. This functionality can be invaluable for troubleshooting network issues, identifying the specific data a suspicious application is transmitting, or even understanding the inner workings of network protocols. While potentially powerful, this feature is undocumented and requires some technical knowledge to interpret the raw data displayed.
HN users largely discuss their experiences with Little Snitch and similar firewall tools. Some highlight the "deny once" option as a valuable but less-known feature, appreciating its granularity compared to permanently blocking connections. Others mention alternative tools like LuLu and Vallum, drawing comparisons to Little Snitch's functionality and ease of use. A few users question the necessity of such tools in modern macOS, citing Apple's built-in security features. Several commenters express frustration with software increasingly phoning home, emphasizing the importance of tools like Little Snitch for maintaining privacy and control. The discussion also touches upon the effectiveness of Little Snitch against malware, with some suggesting its primary benefit is awareness rather than outright prevention.
This post showcases a "lenticular" QR code that displays different content depending on the viewing angle. By precisely arranging two distinct QR code patterns within a single image, the creator effectively tricked standard QR code readers. When viewed head-on, the QR code directs users to the intended, legitimate destination. However, when viewed from a slightly different angle, the second, hidden QR code becomes readable, redirecting the user to an "adversarial" or unintended destination. This demonstrates a potential security vulnerability where malicious QR codes could mislead users into visiting harmful websites while appearing to link to safe ones.
Hacker News commenters discuss various aspects of the QR code attack described, focusing on its practicality and implications. Several highlight the difficulty of aligning a camera perfectly to trigger the attack, suggesting it's less a realistic threat and more a clever proof of concept. The potential for similar attacks using other mediums, such as NFC tags, is also explored. Some users debate the definition of "adversarial attack" in this context, arguing it doesn't fit the typical machine learning definition. Others delve into the feasibility of detection, proposing methods like analyzing slight color variations or inconsistencies in the printing to identify manipulated QR codes. Finally, there's a discussion about the trust implications and whether users should scan QR codes displayed on potentially compromised surfaces like public screens.
A federal court ruled the NSA's warrantless searches of Americans' data under Section 702 of the Foreign Intelligence Surveillance Act unconstitutional. The court found that the "backdoor searches," querying a database of collected communications for information about Americans, violated the Fourth Amendment's protection against unreasonable searches. This landmark decision significantly limits the government's ability to search this data without a warrant, marking a major victory for digital privacy. The ruling specifically focuses on querying data already collected, not the collection itself, and the government may appeal.
HN commenters largely celebrate the ruling against warrantless searches of 702 data, viewing it as a significant victory for privacy. Several highlight the problematic nature of the "backdoor search" loophole and its potential for abuse. Some express skepticism about the government's likely appeals and the long road ahead to truly protect privacy. A few discuss the technical aspects of 702 collection and the challenges in balancing national security with individual rights. One commenter points out the irony of the US government criticizing other countries' surveillance practices while engaging in similar activities domestically. Others offer cautious optimism, hoping this ruling sets a precedent for future privacy protections.
A security vulnerability, dubbed "0-click," allowed remote attackers to deanonymize users of various communication platforms, including Signal, Discord, and others, by simply sending them a message. Exploiting flaws in how these applications handled media files, specifically embedded video previews, the attacker could execute arbitrary code on the target's device without any interaction from the user. This code could then access sensitive information like the user's IP address, potentially revealing their identity. While the vulnerability affected the Electron framework underlying these apps, rather than the platforms themselves, the impact was significant as it bypassed typical security measures and allowed complete deanonymization with no user interaction. This vulnerability has since been patched.
Hacker News commenters discuss the practicality and impact of the described 0-click deanonymization attack. Several express skepticism about its real-world applicability, noting the attacker needs to be on the same local network, which significantly limits its usefulness compared to other attack vectors. Some highlight the importance of the disclosure despite these limitations, as it raises awareness of potential vulnerabilities. The discussion also touches on the technical details of the exploit, with some questioning the "0-click" designation given the requirement for the target to join a group call. Others point out the responsibility of Electron, the framework used by the affected apps, for not sandboxing UDP sockets effectively, and debate the trade-offs between security and performance. A few commenters discuss potential mitigations and the broader implications for user privacy in online communication platforms.
The original poster is seeking alternatives to Facebook for organizing local communities, specifically for sharing information, coordinating events, and facilitating discussions among neighbors. They desire a platform that prioritizes privacy, avoids algorithms and advertising, and offers robust moderation tools to prevent spam and maintain a positive environment. They're open to existing solutions or ideas for building a new platform, and prefer something accessible on both desktop and mobile.
HN users discuss alternatives to Facebook for organizing local communities. Several suggest platforms like Nextdoor, Discord, Slack, and Groups.io, highlighting their varying strengths for different community types. Some emphasize the importance of a dedicated website and email list, while others advocate for simpler solutions like a shared calendar or even a WhatsApp group for smaller, close-knit communities. The desire for a decentralized or federated platform also comes up, with Mastodon and Fediverse instances mentioned as possibilities, although concerns about their complexity and discoverability are raised. Several commenters express frustration with existing options, citing issues like privacy concerns, algorithmic feeds, and the general "toxicity" of larger platforms. A recurring theme is the importance of clear communication, moderation, and a defined purpose for the community, regardless of the chosen platform.
The blog post "Let's talk about AI and end-to-end encryption" explores the perceived conflict between the benefits of end-to-end encryption (E2EE) and the potential of AI. While some argue that E2EE hinders AI's ability to analyze data for valuable insights or detect harmful content, the author contends this is a false dichotomy. They highlight that AI can still operate on encrypted data using techniques like homomorphic encryption, federated learning, and secure multi-party computation, albeit with performance trade-offs. The core argument is that preserving E2EE is crucial for privacy and security, and perceived limitations in AI functionality shouldn't compromise this fundamental protection. Instead of weakening encryption, the focus should be on developing privacy-preserving AI techniques that work with E2EE, ensuring both security and the responsible advancement of AI.
Hacker News users discussed the feasibility and implications of client-side scanning for CSAM in end-to-end encrypted systems. Some commenters expressed skepticism about the technical challenges and potential for false positives, highlighting the difficulty of distinguishing between illegal content and legitimate material like educational resources or artwork. Others debated the privacy implications and potential for abuse by governments or malicious actors. The "slippery slope" argument was raised, with concerns that seemingly narrow use cases for client-side scanning could expand to encompass other types of content. The discussion also touched on the limitations of hashing as a detection method and the possibility of adversarial attacks designed to circumvent these systems. Several commenters expressed strong opposition to client-side scanning, arguing that it fundamentally undermines the purpose of end-to-end encryption.
Researchers discovered a second set of vulnerable internet domains (.gouv.bf, Burkina Faso's government domain) being resold through a third-party registrar after previously uncovering a similar issue with Gabon's .ga domain. This highlights a systemic problem where governments outsource the management of their top-level domains, often leading to security vulnerabilities and potential exploitation. The ease with which these domains can be acquired by malicious actors for a mere $20 raises concerns about potential nation-state attacks, phishing campaigns, and other malicious activities targeting individuals and organizations who might trust these seemingly official domains. This repeated vulnerability underscores the critical need for governments to prioritize the security and proper management of their top-level domains to prevent misuse and protect their citizens and organizations.
Hacker News users discuss the implications of governments demanding access to encrypted data via "lawful access" backdoors. Several express skepticism about the feasibility and security of such systems, arguing that any backdoor created for law enforcement can also be exploited by malicious actors. One commenter points out the "irony" of governments potentially using insecure methods to access the supposedly secure backdoors. Another highlights the recurring nature of this debate and the unlikelihood of a technical solution satisfying all parties. The cost of $20 for the domain used in the linked article also draws attention, with speculation about the site's credibility and purpose. Some dismiss the article as fear-mongering, while others suggest it's a legitimate concern given the increasing demands for government access to encrypted communications.
iOS 18 introduces homomorphic encryption for some Siri features, allowing on-device processing of encrypted audio requests without decrypting them first. This enhances privacy by preventing Apple from accessing the raw audio data. Specifically, it uses a fully homomorphic encryption scheme to transform audio into a numerical representation amenable to encrypted computations. These computations generate an encrypted Siri response, which is then sent to Apple servers for decryption and delivery back to the user. While promising improved privacy, the post raises concerns about potential performance impacts and the specific details of the implementation, which Apple hasn't fully disclosed.
Hacker News users discussed the practical implications and limitations of homomorphic encryption in iOS 18. Several commenters expressed skepticism about Apple's actual implementation and its effectiveness, questioning whether it's fully homomorphic encryption or a more limited form. Performance overhead and restricted use cases were also highlighted as potential drawbacks. Some pointed out that the touted benefits, like encrypted search and image classification, might be achievable with existing techniques, raising doubts about the necessity of homomorphic encryption for these tasks. A few users noted the potential security benefits, particularly regarding protecting user data from cloud providers, but the overall sentiment leaned towards cautious optimism pending further details and independent analysis. Some commenters linked to additional resources explaining the complexities and current state of homomorphic encryption research.
Home Assistant has launched a preview edition focused on open, local voice control. This initiative aims to address privacy concerns and vendor lock-in associated with cloud-based voice assistants by providing a fully local, customizable, and private voice assistant solution. The system uses Mozilla's Project DeepSpeech for speech-to-text and Rhasspy for intent recognition, enabling users to define their own voice commands and integrate them directly with their Home Assistant automations. While still in its early stages, this preview release marks a significant step towards a future of open and privacy-respecting voice control within the smart home.
Commenters on Hacker News largely expressed enthusiasm for Home Assistant's open-source voice assistant initiative. Several praised the privacy benefits of local processing and the potential for customization, contrasting it with the limitations and data collection practices of commercial assistants like Alexa and Google Assistant. Some discussed the technical challenges of speech recognition and natural language processing, and the potential of open models like Whisper and LLMs to improve performance. Others raised practical concerns about hardware requirements, ease of setup, and the need for a robust ecosystem of integrations. A few commenters also expressed skepticism, questioning the accuracy and reliability achievable with open-source models, and the overall viability of challenging established players in the voice assistant market. Several eagerly anticipated trying the preview edition and contributing to the project.
Summary of Comments ( 82 )
https://news.ycombinator.com/item?id=42829317
Hacker News users discussed the practicality and necessity of the guide's recommendations for protesters. Some questioned the threat model, arguing that most protesters wouldn't be targeted by sophisticated adversaries. Others pointed out that basic digital hygiene practices are beneficial for everyone, regardless of protest involvement. Several commenters offered additional tips, like using a burner phone or focusing on physical security. The effectiveness of GrapheneOS was debated, with some praising its security while others questioned its usability for average users. A few comments highlighted the importance of compartmentalization and using separate devices for different activities.
The Hacker News post titled "The protester's guide to smartphone security" (linking to an article on PrivacyGuides.org) has generated a moderate number of comments, mostly focusing on practical aspects of the advice offered in the article and expanding on specific points.
Several commenters discuss the trade-offs between security and usability. One points out the difficulty of following all the recommendations while still maintaining a functional device for daily use. They highlight the challenge of balancing the need for secure communication with the practicality of accessing essential services and maintaining contact with people who aren't using secure platforms. Another echoes this sentiment, arguing that the level of security suggested in the guide might be excessive for most protesters and could hinder their ability to organize and communicate effectively. They suggest a more tiered approach, offering different security levels based on the individual's risk profile.
A recurring theme in the comments is the importance of threat modeling. Commenters emphasize that the appropriate security measures depend heavily on the specific threats a protester might face. For instance, someone protesting a local issue faces different risks compared to someone involved in activism against a powerful authoritarian regime. One commenter suggests focusing on specific risks, like location tracking and data extraction from a confiscated device, rather than attempting to achieve absolute security.
There's also a discussion about the effectiveness of certain security practices. One commenter questions the advice to disable biometric unlocking, arguing that a strong passcode is sufficient. They suggest that the risk of forced biometric unlocking is relatively low in most protest scenarios. Another commenter challenges the recommendation to use GrapheneOS, suggesting that CalyxOS might be a more practical alternative for less technically inclined users.
A few comments dive into technical details. One provides specific instructions on how to disable location services on different Android devices. Another discusses the importance of using end-to-end encrypted messaging apps and recommends specific apps known for their strong security features.
Finally, some comments offer additional advice not explicitly covered in the article. One suggests carrying a "burner" phone for sensitive communications and keeping a separate device for everyday use. Another emphasizes the importance of physical security, reminding protesters to be mindful of their surroundings and avoid leaving their devices unattended.
While the comments don't offer groundbreaking new information, they provide valuable context and practical considerations for anyone looking to implement the security advice offered in the linked article. They highlight the importance of balancing security with usability, tailoring security measures to specific threats, and understanding the limitations of different security practices.