Hacker News Reader

Comment by ardy42 | Hacker News Reader

> Seriously, the quickest, cheapest, easiest way to spy on someone in the US (or any 5 eyes) is through our own "security" agencies, but I'm going to go with stupidity rather than malice on the NSA's part.

No. The quickest and easiest way is probably to send them a phishing message, the next easiest is probably figuring some of their password recovery answers using dossiers compiled by data brokers, maybe after that it's tapping into their phone line using SS7. Probably the hardest way is to first hack a security agency, which I'd imagine have some of the better intrusion detection out there.

View on HN

You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out. On the other hand it's all sitting right there at the NSA et al. Your other attacks are similarly focused on individuals, although the credit and health agencies are prime surfaces for data mining, you're not going to get the metadata/connectivity needed.

I'm interested to know what you're proposing, but I suspect you simply misunderstood what I meant, and perhaps what your (and everyone else's) file at the TLAs looks like. It's a mighty plump target, and not comparably secure.

>>> Why spy on your own citizens when that makes them blackmail-able by foreign nation states?

>>> Seriously, the quickest, cheapest, easiest way to spy on someone in the US (or any 5 eyes) is through our own "security" agencies

> You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out.

You're moving the goalposts: before your ninja edit, you were only talking about the easiest way to spy on someone, not everyone.

If you phish someone, you can get the content. Why settle for just metadata? And what good is metadata for your blackmail use-case? The difference between metadata and content is the difference between knowing you communicate with your coworker and knowing you're cheating on your wife with her. Only one of those things is useful to a blackmailer.

Also, what exactly is a foreign power's use case for targeting everyone in the US, or being really interested mainly in metadata, when their goals mean they're mainly really interested in specific people and organizations and the content or systems they have access to?

As if ninjas wore neon... phishing and attacking a national database of compromises aren't opposite or even orthogonal they're a component. Not realizing that is scary.

https://www.washingtonpost.com/national-security/russian-gov...

Phishing provides a great avenue for escalation type attacks (both lateral and vertical). Might not give you what you’re looking for right then but it gives you a foot in the door.

Intercepting an sms message for 2FA is also easy nowadays via sim cloning.

Had a customer with an ex who did this.

Not fun.

Reply on news.ycombinator.com