Hacker News Reader

Comment by hadlock | Hacker News Reader

The ultimate serverless dead drop was a USB thumb drive epoxied into a hole in the wall, with only the port sticking out.

The only criteria the thumb drive in the wall fails is "Accessible via Tor to protect against traffic analysis.", however it doesn't need network access at all so I think it is kind of a moot point.

There is some minor risk of surveillance on the site, but that can be defeated with a fake mustache or whatever. Also physical security risk, the drive might be designed to damage computers that connect to it via a voltage spike.

View on HN

The increase in density of security cameras makes physical dead drops less ultimate than they once were.

As a thought exercise I sometimes wonder how far I can go from a specific location without being captured on a camera.

I don't think I can even leave my neighborhood. I hate it.

One of my previous homes was in a neighborhood that put a security camera at the entry roundabout, ostensibly because “teenagers were doing drugs.” It was one of my deciding factors to leave that neighborhood.

Even if you could, there are now satellites and airplanes capturing photos of major cities constantly.

GMan is not yet using that to track dope dealers, but it is not impossible to imagine access to this data being “democratized” to other government agencies.

Yeah Gorgon Stares make me wanna kill myself

Don't worry, you'll get used to it. And then you'll be scared to live without it.

Parks, woods, thermal camera

Worst case you could try underwater

All significantly harder though

Mylar, gait obfuscation, shadowing canaries

Worst case, if you cant beat em join em

Balls, figs, and sour dough

I think the best way to do a public dead drop would be to use something that is already there and transfer in a way that looks normal. E.g. giving a certain shop in a mall a modified EC card reader and then have your courier "pay" via NFC.

Ideally you'd like your data transfer to be completely invisible even to watching eyes, ears and attenas, so the best option is to use signals (or the absence of signals) one would expect to be there.

How about a little microcontroller and SD card entirely encapsulated in a brick, with a coil for power and communication with the outside world?

Pull in power inductively from power lines to recharge battery. [0] Use ESP chip with rechargable coin cell [1]. Only turn on chip with no ssid broadcast every hour at some odd minute for a short time. [2] Put/get only URI & decrypt key, main body is on Mega or similar.

Might also make for a neat Geocache.

0. https://hackaday.com/2024/01/27/harvesting-electricity-from-...

1. https://www.instructables.com/Remote-Control-ESP8266-With-Co...

2. https://arduino-esp8266.readthedocs.io/en/latest/esp8266wifi...

Put that on a solar-powered drone that sleeps on commercial roofs where there is free WiFi, autonomously finding another if discovered.

Drones on power lines: https://www.zmescience.com/science/news-science/drones-recha...

May as well just use RFID tags, unless you have a lot of data.

I'm trying to think of a reason not to just drop a microSD card in the mail addressed to the journo. Are we going to do better than physical media delivery? The only way to be found out would be some sort of surveillance of the mailbox or your fingerprints/DNA, which you could be careful with.

> surveillance

That's how they got the Harvard bomb threat suspect. Even though he was using Tor, he was one of only a few people directly accessing it from the university's network at the time it was sent, and they had logs.

Actually, if you want that, go with a rapberry pi with a hidden Ssid

All you need is to e loitering nearby, connect and drop the data then move

But phyaical tracking is very much a threat

Have fun getting hacked with BadUSB.

Reply on news.ycombinator.com