Hacker News Reader

> its a good opportunity to educate them

Am I the only one to receive disarming responses when trying to educate anybody over this matter? The vast majority of people (and when I say "vast majority" I mean everybody but two or three people tops, so far) I tried to explain things to don't care. All they have to say are things like "Where is your tinfoil hat?", "This is conspiracy theory", "If they want to spy us there's nothing we can do" and the never old "I have nothing to fear because I have nothing to hide."

Even when you provide material from authoritative sources you still risk being told "Bullshit, go figure who wrote this".

My laptop is black and I keep a piece of black electrical tape over it so it's mostly unnoticeable if you aren't close enough. I do this to avoid giving explanations because from my experience it is pointless.

"I have nothing to fear because I have nothing to hide."

The best comeback to this is usually asking if they have drapes/shades for their windows at home. I think I read that in a CCC guide to talking about privacy/security somewhere. At least that has lead to somewhat interesting discussions and the occasional moment of "you might have a point".

"I have nothing to fear because I have nothing to hide."

Cool. Now, can I have your wallet/purse? Also, get naked. I want to see what you're hiding under your clothes.

And you can forward your medical record, along with your business emails to me as well.

Because you have nothing to hide....

I like, "Mind if I read your text messages? Hand me your phone"

I agree. It's more of a statement than a meaningful security measure.

There should be a term for this.

Maybe something like 'security theatre'.

"Security theater" is an established term, but usually refers to useless security measures implemented by organizations (companies or governments) to soothe the public (their employees/citizens/guests), rather than to actions of individuals onto themselves.

Right. Sorry, it was sort of a joke. I've been told I'm not very good at them.

That webcam might have a microphone. Your laptop has one too. Neither have a little LED to tell if they're on (the one on most cameras isn't hard wired to the sensor. You can sometimes turn it off in the drivers). There's a microphone in your phone, in your tablet, your PS4 controller, your land line (why do you still have one of those?!), that USB gaming headset you left plugged in, your fitbit, your overpriced voice activated IoT refrigerator (Your out of milk; here are some Amazon ads for milk), and your watch.

The potential to listen to audio on unpatched, compromised devices, is a huge attack vector! And yet we tape up cameras.

The potential for burglars to get in through windows is a huge attack vector. And yet we lock our door.

We never used to tape up cameras, now we do. Perhaps one day we will cover microphones or disable them even though we don't now.

I suspect most people who currently tape over their camera would do the same for their microphone if it was as easy. But there's no easy, quick way to do it that allows to re-enable it when needed.

You just rip the mic/cam pair out with pliers and use an independent usb webcam when you actually need it.

Worked like a charm.

Of interesting note: ThinkPads have (had?) independent mute, volume and microphone buttons with LEDs to indicate volume or microphone muting. It's clearly at least partially software or driver driven, because with Windows 10 microphone muting is no longer functional.

The warm and fuzzy feeling that discovery gave me is why my daily driver is still on Win7 since I almost always have both audio directions muted.

Surely that leaves open the possibility Windows7 was always in control and if hacked, could lie to you?

The fact that Windows10 breaks it surely suggests it's a software feature?

Yes, but....

There's a difference between "I can turn this off as long as the driver is properly installed and has not been hacked" and "I can't turn this off." While the second statement is abstractly true for both, the bar for some software silently and invisibly turning on the microphone is quite a bit higher if it also requires replacing or hacking the audio hardware drivers.

The warm and fuzzy feeling should have gone away immediately upon discovering that it was not a hardware mute, but instead a software-defined feature... no?

I mean, if you can turn the LED off through software, it's really no better than the little menu bar icon that every other laptop has. If it were done all in hardware, that would be cool.

MSI laptops too. They have an Fn+Fkey, but when you use it, it disconnects the camera from the USB bus. It disappears from your device listings in lsusb/linux, or device manager on windows.

Why does everyone strip down in front of thier computers?

When I'm done using my laptop I close it.

...do I have to spell it out for you?

Please spell it out for me. Seems being 0001 1001 years old hasn't opened up my mind to such basic concepts. Also, what about the front camera on my phone?

Watching porn?

Also, the camera on your phone rarely points out towards the whole room.

Oops. I use a dock. Mine always does.

Ah, yeah, edge-cases :)

> Why does everyone strip down in front of thier computers?

Personally, I only use my laptop when I am away from my office. And my office happens to be my bedroom.

My room has 30 deg C in summer, which is a big incentive to be less than fully clothed.

I don't use a laptop if I can avoid it. My personal workstation is right across from my bed, and it's powered 24/7 since it's acting as a file-server and game-server.

Given how everything is angled, I suppose a webcam infiltrator would have a perfect view of me sleeping.

> If you use one of the bookmark post-it notes, it makes it easy to remove the sticker and put it back when you're done with your video conversation.

My mother learned to do this from the IT Security team at her company. And I learned to do that from her. It simply never occurred to me that the Facetime camera, hidden on the MBP, can be turned on at anytime without the status light being activated. I keep a small box of those post-its in my go bag and share them liberally.

Ditto this. I use the EFF webcam stickers. Probably nobody cares about watching my bearded face staring at a computer, true. To me though, it's a visible and constant reminder to keep privacy/security in the front of my mind.

I sympathize with your goals of raising awareness, but I think it is in general a bad idea to teach security measures which are only for show. If education is your goal, don't you risk teaching people the wrong threat model?

It's not. I do the same thing. And it works better then I expected. People do this in my office too now and thy come back with questions regarding security that go further then this. This happens also because they are being asked why they do this. It makes them think. They ask themselves why they put tape on their cam but "hide" their crappy passwords under the keyboard and so on.

It is creating general awareness.