Edit: Changed “the government” to “governments”

I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There’s Intel ME, AMD PSP, so there’s probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?

  • Ephera@lemmy.mlEnglish
    5·
    3 days ago

    Hmm, I just realized that “backdoors” in my previous comment had somewhat of a double-meaning. They do provide the NSA access to data that they have on their servers. In that sense, a backdoor exists, which is also what this PRISM article confirms.

    But knowingly integrating vulnerabilities and making these available to the NSA for attacking customer devices, that is another shtick entirely. And I’m not finding anything in that article that says so (although I only read the parts that seemed relevant).

    • underwire212@lemm.ee
      3·
      3 days ago

      Yes this is something I’m more interested in learning as well. Data access to servers by adversaries can be largely mitigated with E2E encryption and VPN use so that even if, for example, the NSA wanted data on certain servers, unless they had an encryption key, would be largely meaningless (unless metadata wasn’t encrypted). We largely know that if LE wants data, they can get a court order to hand it over.

      What I’d like to know is if there has been any evidence of “hardware” backdoors like what you now describe. I haven’t been able to find evidence of any successful attempts by major agencies/corporations, but I guess part of a successful attempt involves the public not knowing that it exists.

      My threat model has me using an iPhone with Lockdown Mode & Advanced Data Protection enabled. I am wondering if I need to reassess my model to potentially go for the Pixel with GrapheneOS.

      According to my research, the iPhone with these specific settings for reducing attack surface and encrypting everything that gets put onto servers is more than enough for myself (admittedly a pretty stringent threat model). But would also like to hear what others think.