Edit: Changed “the government” to “governments”

I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There’s Intel ME, AMD PSP, so there’s probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?

  • kadup@lemmy.world
    483·
    2 days ago

    We know they do, actually.

    All US companies provide the NSA with backdoors. All modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.

    Put the two things together and now you know.

    • EpheraEnglish
      42·
      2 days ago

      I’m not aware of us knowing that they provide backdoors vulnerabilities to the NSA. If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act). The NSA may also separately develop backdoors (e.g. EternalBlue). But that the NSA coerces US companies to actively attack their customers, is news to me.

        • EpheraEnglish
          5·
          2 days ago

          Hmm, I just realized that “backdoors” in my previous comment had somewhat of a double-meaning. They do provide the NSA access to data that they have on their servers. In that sense, a backdoor exists, which is also what this PRISM article confirms.

          But knowingly integrating vulnerabilities and making these available to the NSA for attacking customer devices, that is another shtick entirely. And I’m not finding anything in that article that says so (although I only read the parts that seemed relevant).

          • underwire212@lemm.ee
            3·
            2 days ago

            Yes this is something I’m more interested in learning as well. Data access to servers by adversaries can be largely mitigated with E2E encryption and VPN use so that even if, for example, the NSA wanted data on certain servers, unless they had an encryption key, would be largely meaningless (unless metadata wasn’t encrypted). We largely know that if LE wants data, they can get a court order to hand it over.

            What I’d like to know is if there has been any evidence of “hardware” backdoors like what you now describe. I haven’t been able to find evidence of any successful attempts by major agencies/corporations, but I guess part of a successful attempt involves the public not knowing that it exists.

            My threat model has me using an iPhone with Lockdown Mode & Advanced Data Protection enabled. I am wondering if I need to reassess my model to potentially go for the Pixel with GrapheneOS.

            According to my research, the iPhone with these specific settings for reducing attack surface and encrypting everything that gets put onto servers is more than enough for myself (admittedly a pretty stringent threat model). But would also like to hear what others think.

      • Venator@lemmy.nz
        2·
        1 day ago

        modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.

        If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act).

        The key used to sign the remote code could be considered data that they’re legally obliged to make available to the NSA? 🤷😅

        That said, the lengths they had to go to for stuxnet kinda implies it’s still not super easy to do, but I guess maybe they were using older cpus that don’t have the signed code vulnerability? 🤷