TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Infosec 101 for Activists

486 点作者 greenie_beans3 个月前

34 条评论

joecool10293 个月前
Hesitant to recommend proton since they can&#x27;t stay out of politics, I don&#x27;t think mullvad has any similar slipups: <a href="https:&#x2F;&#x2F;theintercept.com&#x2F;2025&#x2F;01&#x2F;28&#x2F;proton-mail-andy-yen-trump-republicans&#x2F;" rel="nofollow">https:&#x2F;&#x2F;theintercept.com&#x2F;2025&#x2F;01&#x2F;28&#x2F;proton-mail-andy-yen-tru...</a>
评论 #42944253 未加载
评论 #42951967 未加载
评论 #42946866 未加载
评论 #42948937 未加载
评论 #42970701 未加载
mastazi3 个月前
More resources on this topic:<p>Activist or Protester? by EFF&#x27;s Surveillance Self Defense <a href="https:&#x2F;&#x2F;ssd.eff.org&#x2F;playlist&#x2F;activist-or-protester" rel="nofollow">https:&#x2F;&#x2F;ssd.eff.org&#x2F;playlist&#x2F;activist-or-protester</a><p>The Protester&#x27;s Guide to Smartphone Security by Privacy Guides <a href="https:&#x2F;&#x2F;www.privacyguides.org&#x2F;articles&#x2F;2025&#x2F;01&#x2F;23&#x2F;activists-guide-securing-your-smartphone&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.privacyguides.org&#x2F;articles&#x2F;2025&#x2F;01&#x2F;23&#x2F;activists-...</a>
评论 #42944446 未加载
neilv3 个月前
Step 1: Determine your threat model.<p>Step 2: Realize that none of these measures are adequate for that threat model, in the current environment. (For pretty much any threat model.)<p>Step 3: Realize that some of these measures draw attention to yourself, however.
评论 #42950871 未加载
评论 #42951504 未加载
评论 #42948733 未加载
wayathr0w3 个月前
Some of the crowd here is already aware of the issues with these recommendations, so let&#x27;s take things up a level.<p><a href="https:&#x2F;&#x2F;www.notrace.how&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.notrace.how&#x2F;</a> &#x2F; <a href="http:&#x2F;&#x2F;i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion&#x2F;" rel="nofollow">http:&#x2F;&#x2F;i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6pry...</a><p><a href="https:&#x2F;&#x2F;www.anarsec.guide&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.anarsec.guide&#x2F;</a>
评论 #42949318 未加载
tptacek3 个月前
One of the first things you can do with any of these kinds of lists is to see if they recommend Firefox over Chrome. It&#x27;s an excellent shibboleth, because Firefox codes (rhetorically) profoundly more activist- and privacy- friendly than Chrome does, but Chrome has much more sophisticated and better tested runtime protections. Firefox <i>seems</i> like it would be the better recommendation, but if what you care about is not being easily (==cheaply) targeted by exploits, it&#x27;s not.
评论 #42949156 未加载
评论 #42944563 未加载
评论 #42945414 未加载
评论 #42954928 未加载
评论 #42944325 未加载
评论 #42946557 未加载
some_furry3 个月前
That they recommend a VPN and not Tor in their first table immediately makes me suspicious.<p><a href="https:&#x2F;&#x2F;gist.github.com&#x2F;joepie91&#x2F;5a9909939e6ce7d09e29" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;joepie91&#x2F;5a9909939e6ce7d09e29</a>
评论 #42941952 未加载
cherryteastain3 个月前
I personally don&#x27;t believe basic measures like turning off location services as suggested by the article will make a difference against a sophisticated adversary like a state actor. We know that modern phones are full of proprietary firmware with swiss cheese tier security which allow for 0 day remote code execution exploits [1]. The operating systems, although better, also have been targeted by RCE exploits [2].<p>Not to mention even turning a phone off does not guarantee it goes silent. Apple&#x27;s Find My network works even for turned off devices. Now of course you can turn that feature off, but once the capability to track a turned off device is there, we have to assume that a nation state actor has exploits&#x2F;backdoors that allow agencies to bypass basic software switches.<p>You have to assume everything you do on a mobile phone will end up in law enforcement&#x2F;intelligence agency databases if you&#x27;re put on a watch list.<p>[1] <a href="https:&#x2F;&#x2F;googleprojectzero.blogspot.com&#x2F;2023&#x2F;03&#x2F;multiple-internet-to-baseband-remote-rce.html?m=1" rel="nofollow">https:&#x2F;&#x2F;googleprojectzero.blogspot.com&#x2F;2023&#x2F;03&#x2F;multiple-inte...</a><p>[2] <a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Pegasus_(spyware)" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Pegasus_(spyware)</a>
评论 #42946596 未加载
评论 #42948766 未加载
评论 #42945854 未加载
newscracker3 个月前
This page says it was last updated a few weeks ago, but the recommendation against iCloud backups seems to have glaring errors and omissions.<p>&gt; Keys to unlock the phone’s full-disk encryption are also stored in the iCloud backup. This arrangement allows law enforcement to request the backup data from Apple and use the key to unlock the entire phone. It also offers a convenience, where if the user forgets their unlock code, Apple can still recover the device.<p>This is not true. Even if it were, the advice to activists should in all cases be to enable Advanced Data Protection so that almost everything (except iCloud mail, contacts and calendar) are end-to-end encrypted (including iCloud phone backups). Apple cannot access the data or help in any kind of recovery when Advanced Data Protection is enabled. It is up to the user to set up recovery contacts and recovery key (and keep this safe).
评论 #42948046 未加载
jmbwell3 个月前
Is it correct that iCloud backups can lead to officials being able to unlock your physical device? That’s not consistent with my understanding of Apple’s circle of trust implementation.<p>I get that the backups can potentially be compromised, and of course having the backup means having most of what would be on the phone, but I would love to know more about how having a copy of a backup can compromise the physical device via iCloud.
tillulen3 个月前
How much does a Firefox 0-day cost these days on the grey market compared to a Chrome 0-day with sandbox escape?
评论 #42946003 未加载
评论 #42947552 未加载
评论 #42945219 未加载
FollowingTheDao3 个月前
Rule 0: DO NOT BRING YOUR PHONE TO PROTESTS.<p>I cannot stress this enough. We survived protests without them in the past. There will be plenty of professionals filming anything going on.<p>Coordination needs to be zero tech.
评论 #42976515 未加载
rpgwaiter3 个月前
Good article, although it stresses the need to have trusted friends to protest with but doesn’t explain how to find, make, keep these friends. To be fair, I’ve been trying to figure that part put for like 10 years but it would be cool to have advice in that area as well.<p>Keep up the good fight!
评论 #42957710 未加载
axegon_3 个月前
I am really struggling to find ways to approve anything if you don&#x27;t have 100% control over it. Signal seems to be a solid choice generally and I do believe they are doing their absolute best to keep it airtight but this is software and some obscene, tiny little hole may very well exist.<p>Generally speaking, with people like comrade elon having so much say into everything, people rushing to pump out new features daily, most often not putting too much effort into security, I&#x27;ve been making a hard push to cut myself off cloud services and self-host everything I can myself.
unethical_ban3 个月前
I wonder how many of the posts here saying &quot;this is all useless&quot; actually go to protest, or in their heart support those who do.<p>Can the full might of the fbi and nsa own you of they want? Likely.<p>The threat model here is local PD, and the goal is to make their job of incriminating you in any way, harder. Meaning making it harder to get into your phone. Harder to passively intercept data like sms and phone calls. Harder to get days by asking the big companies like google.
评论 #42954043 未加载
throwfgtpwd2343 个月前
Signal leads to metadata by virtue of demanding a phone number. Use the fork Session instead that doesn&#x27;t have this vulnerability. Or Mega, which does audio and video calls, chat, and file storage and transfer.
fortyseven3 个月前
If I&#x27;m going to be involved in something like this I&#x27;m sure as hell not bringing my daily driver phone. Get serious. Grab a burner, go in expecting it to get discarded or to fall into unfriendly hands.
_DeadFred_3 个月前
Not infosec but when washing off pepper spray&#x2F;tear gas, don&#x27;t let it run down &#x27;sensitive&#x27; areas.
pithanyChan3 个月前
&gt; Intrusion Protection<p>Any ways to check the current updated official images against what is installed on the phone or notebook via a oneliner or an app?<p>Like in a couple of minutes like a virus scan.<p>Burning the hardware is one thing but having confirmation would be nice.
bitbasher3 个月前
All of their advice is pretty moot because they are saying you should have your phone with you and that alone is going to hit cell towers and put you at the location of the action.
评论 #42966463 未加载
sitkack3 个月前
National Lawyers Guild Know Your Rights reminder: Shut the f** up! <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=nWEpW6KOZDs" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=nWEpW6KOZDs</a><p><a href="https:&#x2F;&#x2F;www.aclu.org&#x2F;know-your-rights&#x2F;stopped-by-police" rel="nofollow">https:&#x2F;&#x2F;www.aclu.org&#x2F;know-your-rights&#x2F;stopped-by-police</a>
评论 #42941910 未加载
评论 #42953283 未加载
DavidPiper3 个月前
Serious question: what are the reasons for Firefox over Safari?<p>I&#x27;m currently a Firefox user at home and work, but thinking about going back to Safari in the near future...
评论 #42945289 未加载
评论 #42945055 未加载
评论 #42949489 未加载
评论 #42951755 未加载
seethishat3 个月前
It&#x27;s hard for me to believe that people actually think they can use Signal or some other &#x27;security app&#x27; on a device that is fundamentally compromised already.<p>Sure, your messages are encrypted, but they (whoever they are) have the private keys (both sender and receiver) because the smart phones you are using are compromised by them.<p>It&#x27;s really simple.<p>So next time you read a news story about criminals who were using some supposedly secure app to commit crimes, but got caught anyway... keep this in mind.
评论 #42949003 未加载
评论 #42949121 未加载
sharpshadow3 个月前
One could use a portable programmable network device between the phone and wifi for increased security.
FrustratedMonky3 个月前
Is DuckDuckGo really secure? It&#x27;s just Bing re-skinned. Makes me question the rest of the list.
评论 #42942402 未加载
globalnode3 个月前
This is ridiculous, just don&#x27;t use a network of any kind or you&#x27;ll be tracked by someone somewhere. Simple as that. Misleading people into thinking they can use these tools and be safe is dangerous. I suppose the only way to be safe is to assume you&#x27;re being tracked somehow and use burners or throw aways that don&#x27;t matter.
评论 #42942535 未加载
评论 #42942905 未加载
评论 #42942512 未加载
评论 #42943472 未加载
评论 #42942832 未加载
janmo3 个月前
This is pretty much the 101 on how to get &quot;caught&quot;. It is laughable that they recommend using ProtonMail and ProtonVPN and that there is not a single mention of things such as TOR.<p>Regarding Proton specifically:<p>- Proton has been lying about them not logging their users IP and other information in the past. It got caught red-handed in 2021 when they transmitted the data of a user to a french intelligence agency called DGSI. Source(s): <a href="https:&#x2F;&#x2F;therecord.media&#x2F;protonmail-forced-to-collect-an-activists-ip-address-in-police-investigation" rel="nofollow">https:&#x2F;&#x2F;therecord.media&#x2F;protonmail-forced-to-collect-an-acti...</a><p>- Now they say: &quot;Privacy by default&quot;, what they mean by it that by default they do not log the user&#x27;s information but if an agency asks them to log then they &quot;are required by law&quot; to log the user&#x27;s data. But the user has no way to know if he is still in the &quot;privacy mode&quot; or has switched to the &quot;surveillance mode&quot;.<p>- It is actually possible that they log everything and use the &quot;by default&quot; wording as a &quot;plausible denial&quot;. By saying that your account had been flagged earlier by law enforcement or an intelligence agency.<p>- All Proton mail traffic goes through Cloudflare. Let that sink in. Yes, they says that the traffic is encrypted using https and that Cloudflare can&#x27;t see it&#x27;s content, which might be true. But even if it is true Cloudflare gets to see a ton of interesting meta data, such as the end user&#x27;s IP, the exact time and the length of what the user is being sending or receiving. Source: So even if you are in Switzerland and you use ProtonMail which is in Switzerland too, your connection still gets tunneled through an American company. Source: <a href="https:&#x2F;&#x2F;x.com&#x2F;andyyen&#x2F;status&#x2F;1884907496705339544" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;andyyen&#x2F;status&#x2F;1884907496705339544</a>
hitekker3 个月前
For someone in the know: what&#x27;s the credibility of the authors on this topic?<p>I see <a href="https:&#x2F;&#x2F;infosecforactivists.org&#x2F;#acknowledgments" rel="nofollow">https:&#x2F;&#x2F;infosecforactivists.org&#x2F;#acknowledgments</a> and <a href="https:&#x2F;&#x2F;github.com&#x2F;InfosecForActivistsTeam&#x2F;infosec-activists&#x2F;graphs&#x2F;contributors">https:&#x2F;&#x2F;github.com&#x2F;InfosecForActivistsTeam&#x2F;infosec-activists...</a> but I don&#x27;t see their experience following their own advice.<p>The document by itself looks unpolished. Tor, for example, should be at least referenced once, even if they recommend against it.
评论 #42946502 未加载
cess113 个月前
Yeah, don&#x27;t use Proton, they&#x27;re several types of shady. If you can figure out running Matrix, that&#x27;s better. Email isn&#x27;t built for security, don&#x27;t treat it as if it was. Use PGP on the body if you want, but the metadata will still be very talkative.<p>The Grugq has complementary advice which arguably is more important, regarding foundational principles, personas and so on:<p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=L3j1AhS0iKI" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=L3j1AhS0iKI</a><p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=3w7E4Hhtubw" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=3w7E4Hhtubw</a> (there&#x27;s a bit of presentation and ceremony before they get into the relevant parts)
emocin3 个月前
&gt; proton<p>Immediately closed tab, this post is useless.
throwaway_432103 个月前
&gt; We recommend Signal, which was built from the ground up for personal security.<p>WhatsApp has E2EE for all messages too, I don&#x27;t understand why people think of Signal as a bullet-proof instant messaging solution for privacy, especially when<p>1. Requires Phone Number in order to use (I&#x27;m sure fanboys have explanations for that)<p>2. It is centralized<p>3. Uses APNs or GCM for push notifications
评论 #42949565 未加载
treebeard9013 个月前
As someone who has decades of tech experience and have been the target of various Government agencies for many years... I have a few things to add:<p>Most devices have some kind of GPS or positioning system. Phones in particular still communicate certain information to cell towers and E911 even if there is no SIM installed. Wrapping your phone in aluminum foil does not block all the signals as many have been lead to believe. It is not certain, especially with 5G what faraday bags can work. Your best bet is a phone where you can remove the battery. Even this could leave residual power in the device.<p>One of the most non technical aspects of Government surveillance, especially in the United States, is that their ability to request data depends on each specific provider. Usually, law enforcement has long standing relationships with all these companies and the higher up you go in the U.S. Govt, you get more of this. After all, there are a million ways the Govt can keep a device off the market if they do not comply with whatever the Government wants. Maybe most importantly, parallel construction is often used here. For example, law enforcement will only follow the rules and get a warrant if they intend to present a case in court. Often, they just want information and if they want to use it they will find a way to parallel construct its source. Do not rely on your constitutional protections or anything else. In many cases it is simply not a factor for them.<p>Everything about your phone comes back to the sim card. It is extremely difficult to get a working SIM without some form of ID. Most SIM cards are traceable this way, especially if you purchase them in the U.S. Most services require a form of authentication as well, often a phone number which requires the SIM belong to someone, or an email address, which very often requires a phone number to create. Used burner phones are your best bet.<p>Any cloud service connection your phone initiates is able to be intercepted and the Govt can deploy a form of a man in the middle decryption attack with the help of your cell provider. This is not used as often but unless everything you have uses certificate pinning, and often this isn&#x27;t the case, it is very easy to man in the middle your end to end traffic and decrypt it.<p>Applications also leak like crazy to various APIs and other things they use. Connections can be downgraded to HTTP and all other forms of tricks to monitor you are used.<p>For example, if you are using an end to end encrypted messaging app, and you have the content of those messages going to the apple or google notification system, you do not have end to end encrypted messaging. This is why Signal disables the content in the notification by default.<p>There are other attack surfaces here as well. Keyboard autocomplete is one as it uses remote services. If LE knows you are using something like Signal, and they can see you created a new contact on your phone to message them, they already know who you are talking to you, and if your phone keyboard is using autocomplete or grammar correct, they could potentially get what both sides are writing to each other without actually breaking the encryption.<p>There are other methods as well. iPhones have the ability to use a form of Remote Desktop that can be accessed over the cell connection. So as you are using the app, your screen can be monitored, thus defeating any encryption security you think you have.<p>If Law enforcement knows you have cloud accounts, say with iCloud or Google Docs, and you are working on something in there, you can be sure that it is possible for your work to be viewed as you are working on it. This has a ton of implications for people just doing normal non activist work as well. Maybe you&#x27;re working on your own legal case and they can literally just watch you build a legal defense and then plan accordingly. It really is endless what they can do.<p>If the Govt is interested in you, most cities are full surveillance cities now. You can have no phone, no RFID anything, change your routes, change your appearance and you will still be found. There are rare exceptions to this but for the most part assume you cannot move around a city without being constantly monitored. Even if you only have a pair of bluetooth headphones, there are all kinds of devices collecting broadcast data, and these can be correlated with device lists uploaded when you pair a device.<p>This is just a short list of things I&#x27;ve experienced personally... There is so much more. Any large formal resistance basically cannot happen without the Govt knowing about it.<p>EDIT: Sorry for the wall of text
greenie_beans3 个月前
all yall HN &quot;well actually&quot; MF missing the point. this is meant for non-technical people
monero-xmr3 个月前
Remember when the FBI and NSA were trying to outlaw encryption? Like a couple years ago? How the turn tables!
评论 #42942841 未加载
pstuart3 个月前
A bit of a tangent, but modern protests are subject to hijacking from agents provocateur and general shit stirrers -- it&#x27;s been quite effective in delegitimizing public protests. It would be nice to find ways to counter that.<p>Case in point: how BLM protests were turned into riots by antagonistic forces: <a href="https:&#x2F;&#x2F;abcnews.go.com&#x2F;US&#x2F;man-helped-ignite-george-floyd-riots-identified-white&#x2F;story?id=72051536" rel="nofollow">https:&#x2F;&#x2F;abcnews.go.com&#x2F;US&#x2F;man-helped-ignite-george-floyd-rio...</a>
评论 #42942611 未加载
评论 #42946585 未加载
评论 #42943130 未加载
评论 #42942942 未加载