this post was submitted on 05 May 2024
330 points (97.4% liked)

Privacy

31253 readers
653 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
 

Simple steps to take before hitting the streets

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 25 points 4 months ago

Pretty good stuff.

However I read many reactions : "don't take your phone with you" This is a common issue in a lot of activist place to don't ask ourselves why people are acting like this ? before telling them to stop. They may have good reasons, and in a case of protests, there is.

  • Filming the cops : I don't know in the US, but in a lot of countries, cops are less violent when they know someone is filming them. This may help people harmed by the police, in giving them evidence, or helping mobilization in the futur. After mass arrestation, it could be hard to know how as been arrested or not; some legal support hotline ask this kind of evidence for this reasons. Of course this some sensitive material, and need to be secured too. For example, the cops may target you if you are filming them.

  • Calling the legal support hotline : Some of them ask to be called just after arrestation or cops actions, to make a precise report. You could call them when someone you know have been attacked or kidnapped by the police.

  • Call medial support : I don't know how the emergency number is linked with the repressive force in the US, but in a lot of country, it's not. Even if it's rare, it could be a vital issue.

All this actions are important and individuals should compare the risks they take in taking them and what we lost in not acting like that. Of course this risks have to be documented; with flyers at the start of a protests for example.

I would recommend to mutualise actions to decentralize risks. Make a team with one or two people with burned phone and dedicated camera (paid by everyone); let your other phones at home. Stay (at least) by pair, and keep in eye someone with a phone.

They may be better plan of actions, but we couldn't just let down cop watch ant street medic just for the illusion of individual safety. Such thing simply do not exist

[–] [email protected] 12 points 4 months ago

imagine not being a gigachad bringing your nintendo 3ds, that actually has a physical switch to disable wireless communication and can record videos and take pictures ~~that totally don't look like they're from 2011~~

[–] [email protected] 26 points 4 months ago

Don't take it with you, or have a faraday bag and only take it put when you're done

[–] [email protected] 7 points 4 months ago (1 children)
[–] [email protected] 6 points 4 months ago (1 children)

On a secondhand or wiped burner Pixel too. The Crowbar CVE can’t be patched by an OS.

[–] [email protected] 1 points 4 months ago (1 children)

I can't seem to find any CVE called crowbar in regards to Android. Only one for PHP and one for SUSE.
Would you mind giving more info to help me find out more?

[–] [email protected] 2 points 4 months ago (1 children)

Its a tongue in cheek CVE. Crowbar is literally a crowbar. Like.. beat the password or device access from you.

[–] [email protected] 2 points 4 months ago (1 children)

Oh. That went straight over my head. 🤦
Thanks.

[–] [email protected] 2 points 4 months ago

No problem 😄

[–] [email protected] 63 points 4 months ago

Leave it at home.

[–] [email protected] 50 points 4 months ago

Layer one: "front line": folks should be acting on passive listen/pushed information from folks far back that will not get kettled or trapped. Media they collect should be Livestreamed for safe storage... But they should be focused on non violent protest, emit the protest message and find/eject bad actors. Equipment should be "burner" quality, wiped and purpose setup with the expectation of seizure.

Layer 2: "observe, document, report": folks should be using encrypted apps to communicate, and should intend to not be arrested, and to collect as much quality content as possible. These folks should be ready to be arrested, but avoid as possible.

Layer 3: "coordinate": these folks should be digesting all possible data about risks, police activity, lawful orders, movements, etc. They should be feeding information about proper actions. They should use encrypted tools but plan to avoid arrest.

This is all hypothetical.

[–] [email protected] 11 points 4 months ago (4 children)

Signal & WhatsApp are not secure enough. Meta/Facebook regularly give data & metatadata to the cops & Signal is centralized & not self-hosted by your crew so while messages are encrypted, the metadata still isn’t. If you must use Signal, I would pick Molly as an Android client since you can a) encrypt the messages under a separate password for storage on seizure & b) you can use the UnifiedPush version to make sure your notification metadata isn’t going thru Google’s Firebase servers. Protests are the ideal place for Briar as it is works via mesh net so internet & SIM cards are not required (but years ago wden I tried it, the app was a major battery drainer).

[–] [email protected] 2 points 4 months ago (2 children)

If your problem with signal is that it isn’t self-hosted, just self-host it? It’s all open source.

[–] [email protected] 1 points 4 months ago

The developers are very hostile about alternative clients and networks. Also, the app does not support this in any form, so you would have to distribute modified APKs that want to use your hosted server.

[–] [email protected] 5 points 4 months ago

Those components are not really meant for self-hosting, its open to be looked at. You would need to patch out the SIM requirement, point the hardcoded server/clients elsewhere, find some way to sideload modified clients to those using iOS lol, & it’s not federated so you would need a separate app for just this task. At this rate you are 100% better off using a choosing systems where server & clients are actually built with this in mind… Signal’s chat features are not novel

[–] [email protected] 9 points 4 months ago (1 children)

the metadata still isn’t.

That doesn't quite work in the case of Signal

The only data that they have, based on transparency reports and dissections of their source code, is the time you created your account and last connected to the servers.

Messages themselves are essentially only relayed, with sealed sender, and anything that would be actually useful to identify who was at a protest and who wasn't encrypted.

Things like, e.g when messages arrive at the server would have to be monitored live on compromised servers, which reasonably unless you assume* it is wiretapped already prior to a protest, isn't realistic.

*: of course, I am saying this because making an assumption and portraying it as truth (e.g assuming something is already wiretapped based on no evidence at all) is not the smartest of moves when it comes to threat modeling...especially if you wanna stay sane whilst having a threat model

[–] [email protected] 0 points 4 months ago (1 children)

With the right intel you could piece back some of the pieces, especially with some pieces from other sources, with just that metadata. With metadata, it’s about putting together lots of sources to see the picture clearly which is why Facebook bought WhatsApp for just the metadata (& address book). The thing is that you, can skip Signal & you will still have several free software messaging alternativ where nothing is on a US-based server where they can subpoena.

[–] [email protected] 1 points 4 months ago (1 children)

But that'd already entail control over the whole Signal AWS in- and egress as well as any VPN you may be using and/or your local ISP. And then you still have to prove the actual link to the natural person. At that point we're speaking of a threat level assuming the US DoD as adversary. While not impossible, I think if you're willing to pick that kind of fight, you're clever enough not to rely on Signal (or most digital communication).

Signal is not WhatsApp, there aren't a lot of data points linking your communications to end points in the same way Meta does link them.

[–] [email protected] 1 points 4 months ago

Not saying you are wrong, but I think the argument a) should mention WhatsApp in the same breath as Signal & b) stopping at Signal instead of linking to where to find more info

[–] [email protected] 13 points 4 months ago

Also worth noting that OpenStreetMaps works offline too.

[–] [email protected] 7 points 4 months ago* (last edited 4 months ago) (1 children)

You are absolutely right about metadata, but as far as protests, just having encryption is enough to prevent anyone from accessing the data. Extracting metadata from 3rd party companies or extracting a phone requires a lot more resources than cops can spare.

[–] [email protected] 1 points 4 months ago

In the corpo cases, I’m sure all they have to do is ask. There are better alternatives & this guide feels radically incomplete stopping at such pedestrian option instead of labeling them in a bottom tier of like suffiecent-if-you-literally-can’t-use-anything-else.

[–] [email protected] 1 points 4 months ago

Not so difficult to sync yor photos or movies with an Cloud server

load more comments
view more: next ›