Hacker News Reader

Comment by HALtheWise | Hacker News Reader

Am I the only one who has far more sensitive content visible on the screen and filesystem of my computer than through its camera? I feel like, at least for the threat models that I consider likely, if someone manages to hack my laptop and get (for example) microphone access, the thing I am most worried about is that they will use acoustic analysis of keystrokes to recover my banking password, not that they will hear me... singing in the shower, I guess? Based on my understanding of current laptop OS's, just directly making a key-logger the straightforward way is easier anyway, so I'm not that concerned.

I fear that the sense of security people feel from putting tape over their webcam might be hiding much more realistic threats.

View on HN

> Am I the only one who has far more sensitive content visible on the screen and filesystem of my computer than through its camera?

Am I the only one who realizes that I may not be the one who may benefit the most from having a way to physically turn off the camera/mic device?

I.e.

All you people who insist on carrying eavesdropping devices near me are a threat to my privacy.

All of you people who persist in posting to FB and tagging pics I might be in are a threat to my privacy.

Yes. It is a problem.

> far more sensitive content visible on the screen and filesystem of my computer than through its camera

I mean, yeah, being hacked (and thereby compromising your screen/HDD's contents) is an issue in the first place and keyloggers are only a few lines of code, but I don't think there is anything wrong with controlling the parts that you can control.

You can't make a physical "no keyloggers for this piece of text, please" switch, but at least they can't hear you talk to a close friend or watch you walk by as you get into the shower (though the latter is a bigger risk for women than for the more common HN visitor, I guess). You're not the first comment I see wondering why we even want this, and it's really weird to see. Why would we not want this?! I don't think that, just because we have webcam stickers, we suddenly stop caring about malware altogether. I think even (metaphorically) my mom understands that if you tape your webcam, a virus can still steal the bank login that is happening on her computer. Even if she doesn't really get the concept of a process, malware, and a web browser in the first place, taping a cam does not make everything on a computer virus-proof.

There is a conscious and subconscious comfort in knowing that a surveillance camera and/or hot mic in your room is not on.

Obtaining compromising video and/or audio of you or someone you care deeply about will often be more than enough to obtain things like banking information and file access.

Yes. Ultimately the main purpose of any surveillance system is extortion. Nudies are not relevant to the topic. Evidence of crime or other compromising behavior is.

It doesn't even need to be about you. It could be about your parent, child, or sibling. What judge wants to risk exposing a relative to prosecution, even if the relative would be acquitted?

If you wonder about inexplicable judgments, consider the possibilities.

Getting your password isn't as compromising as, say, getting a photo of you nude, in the security theatre-sense.

Think of the OPM hack[0] and the potential for a foreign entity to compromise someone (that they know has a security clearance) with blackmail. This has a much larger and potentially far longer ROI than a simple compromise of a password; which probably has to be changed every 'x' days, anyways.

You have to think of things like this in terms of long-term yield and not immediate results; unless we're talking crackers, then they're almost always after immediate results.

[0] - https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

> Getting your password isn't as compromising as, say, getting a photo of you nude, in the security theatre-sense.

That... really depends on the society you live in and your own insecurities.

Fear and prohibition surrounding the naked body is a cultural/religious thing.

The most prudish US-regions are probably somewhere in the middle of central Europe and Islamic countries like Saudi Arabia.

I won't generalize to the whole of the US because I know there's a wide spectrum.

However US-wide media serve the lowest common denominator, spreading the unfounded phobia and taboo of nude people.

Personally I couldn't give a damn whether someone has pictures of me nude. People probably do since I was bathing in the ocean naked on some occasions. I don't really want any pictures of myself on the internet (with my name), but nude or not doesn't make much of a difference to me.

I'm more afraid of ending up in some facial recognition database and private companies starting to track my every move.

The tracking doesn't bother me as much as the individualization of data-mining does. The use of collected data to run unexplainable AI systems which can do things from determine how the courts treat me, to what is recommended to me, is the real threat.

The problem with blackmail is it almost never happens - i.e. the profitable digital blackmail is cryptolocker. But the real negative to your life is the unaccountable compiling and production of data products which can be used to try and describe your life to others - credit ratings being mapped to internet activity or insurance rates, or digital dossiers being sold to companies to screen new hires in combination with some blackbox "risk" AI system - or surveillance cameras running people in-real time through a profiler which then re-deploys police units on the go.

The risk is...not dramatic? I think is what I want to say. It's mundane - so mundane that its been creeping up on us for decades and is very gradually attacking people all because individually it all sounds reasonable.

You really pricked my interest here: where do you think central Europe is exactly, especially in comparison with western and eastern?

Wikipedia can help you: https://en.wikipedia.org/wiki/Central_Europe

Mostly: formerly Holy Roman and Habsburg Empires.

I started doing it because I _never_ use the camera and it took about 30 seconds. It's a _very_ minor piece of security, but it costs nothing. Incidentally, it was due to a (very obviously fake) spam email:

> You probably noticed your device is acting strangely lately. That's because you downloaded a nasty software I created while you were browsing the Ƿornographic website...

> The software automatically: > 1) Started your Ƈamera and begun recoding you, uploading the footage to my server...[...]

> If you do not do what I ask you now, I will upload this ugly video file with you ... and the stuff you were watching to several video upload sites and I will send the links to all your friends, family members and associates.[...]

> I think 2,000 USD is a fair price for my silence. I know you can handle to send me this money - and it is enough for me to get lost. So how do you send the cash?? Bitcoin.

I wasn't worried about it being real, but being able to dismiss it out of hand is useful.

Settup 2FA, e.g. TOTP — then even directly observing you typing in both the password and the token won't do much.

In any security conversation, the vector one should care about is the path of least resistance.

If the keystroke analyzer was an automated script, being used by some script kiddie who found it on the internet in the near future, the path of least resistance ends up with a really really large number of lanes.

The worry is more about stalkers and abusive partners. Abusive partner using it to further control you or hear that you plan to leave or hear that you talk with someone he disapprove (e.g. vuctim breaking out of isolation and distorted reality victim is in).

Those situations are physically dangerous when they happen.

Sure but you're attacking the problem from the wrong vector: the partner has physical access to the device and control to install malware, and is abusive. Turning off the microphone or camera is going to trigger retaliation anyway - it doesn't help in this scenario because the problem is the abuser.

Helping the victim out of that relationship is what needs to happen - no amount of technical cleverness is going to make it better. Improving our laws certainly would (i.e. taking that sort of device compromise as a serious crime would be extremely useful in this context).

Ability to communicate privately is necessary for that "helping the victim out". The easier it is for abuser to control devices of abused, the harder it is to get out. And the harder it is to stay hidden after being out.

The default being "easy to spy and control someone else's devices" makes abuse easy and escape (both mental and physical) hard.

That helping and escaping and staying away is not something that happens without communication and privacy.

Use a password manager!

Reply on news.ycombinator.com