Essays: NSA Surveillance: A Guide to Staying Secure – Schneier on Security

https://www.schneier.com/essays/archives/2013/09/nsa_surveillance_a_g.html

by lifeisstillgood • 2 years ago

94 39 2 years ago

schneier.com

Loic• 2 years ago

For the context, this from September 6, 2013.

talldayo• 2 years ago

If only we knew how bad things really are.

Citizen8396• 2 years ago

I completely agree. For example, I don’t think people are aware to what extent China is attempting to infiltrate the US energy sector. No one could imagine to what extent Russia would attempt to influence our elections, either.

I’m hopeful it won’t get worse. It probably has something to do with the capabilities others are alluding to in this thread.

OutOfHere• 2 years ago

I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit,

Let's update this for 2024:

Signal/Session/Matrix/^, Tails/Whonix/Qubes/Heads/BSDs, VeraCrypt/Cryptomator/^, GrapheneOS/CalyxOS/PureOS/^, KeePassXC/Bitwarden/^, Mullvad, NetGuard(Android)

^ represents others that I am leaving out for convenience.

maqp5• 2 years ago

You're missing Tor, and metadata reducing messaging like https://cwtch.im/

Also Mullvad Browser is a worthy addition given that its basically Tor Browser with the VPN instead of Tor-gateway. Same excellent metadata reduction tweaks, and you don't have to configure anything.

Oh and since this is against APTs my work might be useful for messaging: https://github.com/maqp/tfc It's as close to NSA-proof you can get. Naturally, if the government parks their flower van across the street and grabs your keyboard cable's spurious radio waves* or installs a cam in your house you're SoL, but otherwise you should be pretty good.

* https://en.wikipedia.org/wiki/Tempest_(codename)

ementally• 2 years ago

basically Tor Browser with the VPN instead of Tor-gateway.

You don't need a Mullvad VPN for it work, you can use it without Mullvad VPN or any VPN at all.

zahlman• 2 years ago

Tails/Whonix/Qubes/Heads/BSDs... Mullvad, NetGuard(Android)

I don't even know what kind of things these are... ?

salawat2• 2 years ago

Tails is an immutable distribution of Linux that runs entirely out of RAM, persisting nothing to long term disks. Typically used in a LiveCD like manner.

https://tails.net/

Heads similar.

https://heads.dyne.org/

Qubes is an OS endeavoring to isolate literally everything conceivable from each other.

https://www.qubes-os.org/

BSD is a kernel specifically focused, iiuc, on being as secure and straightforward as possible.

https://en.m.wikipedia.org/wiki/FreeBSD

Whonix seems to be focused around decreasing online or browser based metadata leakage?

Mullvad is a paid VPN service.

https://en.m.wikipedia.org/wiki/Whonix

Calyx/Pure/GrapheneOS

Apparently security focused Android distros.

KeePassXC, password manager, self hosted.

TrueCrypt/VeraCrypt: Encrypted volume management.

Bitwarden, FDE solution iirc.

Notably no mention of Wireguard, managing your firewalls/routers/network architecture, IDS's/Intrusion response plans, key hygiene, and focusing on getting end users prepped for the infosec environment; noting that an ineffective infosec engagement with end users completely undermines everything you're trying to work for. Trying to go all in on most of those tools is a recipe for disaster for any org that actually has something else to do other than jumping through endless security hoops.

Tools aren't the be all end all. Educated and invested users are.

ignoramous• 2 years ago

NetGuard(Android)

GrapheneOS warns of NetGuard leaking connections: https://discuss.grapheneos.org/d/8330-app-compatibility-with...

mmh00002• 2 years ago

If your adversary is someone who can … quite literally … send ninjas in attack helicopters at you. You’re probably going to lose.

upofadown• 2 years ago

The idea is to prevent them from developing a motivation to do that by keeping them out of your business in the first place.

mmh00002• 2 years ago

I get the motivation. But good luck keeping an organization out of anything you care about when they can:

. Legally kill you

. Legally compel corporations to embed backdoors

. Legally seize all your equipment

. Throw away millions of dollars pursing “petty” crimes.

Technical means of defending against something like the NSA is, in my opinion, a lost cause.

I believe the way to deal with this is by being politically active. Getting people engaged and limiting the powers of these organizations.

fulafel• 2 years ago

This is a black-and-white reasoning bug that people often have when thinking about this. The vast majority of targets aren't worth top resources or a risk of exposure.

ratlrrr• 2 years ago

Haha-ha hoow do you know?

LennyHenrysNuts• 2 years ago

What do people think of SimpleX?

https://simplex.chat/

maqp5• 2 years ago

There's a LOT of SimpleX shilling lately on HN.

tldr, it's snake oil. The company lies about its system being able act as a server without knowing anything about the users. The SimpleX clients don't route via Tor so the server will by definition know the IP addresses of the conversing parties. SimpleX claims to be the most metadata secure app, yet it fails to address the first issue of hiding IP addresses. Also a server has access to each IP addresses' social graph when they see to which target IPs they are forwarding packets. So much for metadata-free.

epoberezkin2• 2 years ago

Either you didn't understand the design, or this is not genuine criticism.

Every server that user connects to of course knows IP address of the user, be it Tor relay, VPN provider, Nym node, or SimpleX relay - the user chooses which server to trust.

Neither of the approaches guarantees transport anonymity.

Recently added private message routing protects IP addresses of the users from the destination servers: https://simplex.chat/blog/20240604-simplex-chat-v5.8-private... , which was #1 point of criticism that IP addresses are not protected by default.

jokoon3• 2 years ago

I don't see why one would try to protect himself from the NSA.

I understand privacy from my neighbor and criminals.

But I want the government to spy on potential criminals.

I trust the courts and the process.

If you don't, you're just paranoid.

hulitu• 2 years ago

But I want the government to spy on potential criminals.
I trust the courts and the process.

Good luck then. You _will_ need it.

jokoon3• 2 years ago

Seriously, what are you so afraid of?

We don't live in China or Russia, what matters is political culture, not hiding from the government.

What is the worst that ever happened?

Do you think corporations would use the NSA to influence the government?

Or do you think the NSA would become a shadow government?

I understand the fear of 1984, but 1984 described China and Russia, not the US.

Assange and Snowden might sound like heroes to you, but to me they are not.

kaliqt• 2 years ago

I don't even know where to begin on how incorrect that is.

hellojesus• 2 years ago

Just trust the courts, bro. Civil Asset Forfeiture totally doesn't violate due process or the 5th amendment, bro. Big brother knows best, bro.

Essays: NSA Surveillance: A Guide to Staying Secure – Schneier on Security

Related Stories