undefined | Better HN

0 pointszer0x4d3y ago0 comments

From my experience, people who do take this type of an exaggerated approach often end up exposing themselves more in ways that they don't even realize...

How do you pay for jmp.chat? Do you trust their code to be bug-free and without possible exploits? Do they do regular security audits and code reviews? Do they have enough users and maintainers to be able to quickly detect and address security issues? Are you sure Airplane Mode turns off the baseband and cuts off all cellular communication? It doesn't, you can still emergency receive alerts in Airplane Mode. Your phone can tell exactly where you are by comparing your wifi search results + RSSIs to known public databases without even having to use GPS. How much do you trust your VPN provider to keep no logs? How do you pay for VPN?

0 comments

5 comments · 3 top-level

kornhole3y ago· 2 in thread

jmp.chat can be paid for with a virtual card and not tied to any ID. However I have it associated to my real ID in this case as it is the number everybody knows.

I use the word 'mitigate' not 'solve' since closed source baseband modems are a problem. Cellular traffic is off in airplane mode, but the baseband could be exploited if someone wanted to find me AND knew which IMEI to target. Because the IMEI has never been associated to me, that is a challenge.

I run my own VPN and share it with a few other people.

zer0x4dOP3y ago

>I run my own VPN and share it with a few other people.

How confident are you in your VPN server configuration skills? Gaining access through mis-configured self-hosted boxes is the easiest attack vector usually as most people who self-host aren't experts in the software they are using leading to leaks. Besides that, do you keep a list of packages installed on your box, open ports, etc? How about security patches and regular updates as well as auditing access logs to ensure no one gained access to your box?

iudqnolq3y ago

We're talking about the FBI here. They see traffic coming from a server. The ask who's server it is, your host tells them your name and address. The FBI asks the host for physical access to the server, and installs whatever monitoring they want regardless of your patch schedule. The FBI asks them to keep this off the access logs, and they do.

1 more reply

torben-friis3y ago

All that plus the fact that, under general surveillance, behaving in a way that is consistent with avoiding tracking at great inconvenience is a great way to get flagged.

BizarroLand3y ago

I'm willing to bet that if you generate roughly the same data as your peers, you're invisible, but if you generate NO data at all, you become worthy of checking into, as either the algorithm has no ability to correctly record your data or you are working very hard to hide yourself from the system, possibly for nefarious reasons, and therefore need to be monitored just in case.

Squeaky wheels get the grease and squeaky nails get the hammer, but silence in a noisy forest is alarming.

j / k navigate · click thread line to collapse