Slashdot Mirror


Snowden's New App Haven Uses Your Smartphone To Physically Guard Your Laptop (theintercept.com)

An anonymous reader shares a report: The NSA whistleblower and a team of collaborators have been working on a new open source Android app called Haven that you install on a spare smartphone, turning the device into a sort of sentry to watch over your laptop. Haven uses the smartphone's many sensors -- microphone, motion detector, light detector, and cameras -- to monitor the room for changes, and it logs everything it notices. The first public beta version of Haven has officially been released; it's available in the Play Store and on F-Droid, an open source app store for Android.

58 of 134 comments (clear)

  1. so... by Kierthos · · Score: 1

    the "bad guys" have to steal your phone AND your laptop now to get away with their cunning plan?

    --
    Mr. Hu is not a ninja.
    1. Re:so... by DaveyJJ · · Score: 1

      Does this cunning plan involve some feathers, a dress, some oil, an easel, some sleeping draught, lots of paper, a prostitute and the best portrait-painter in England?

      --
      DaveyJJ
    2. Re:so... by AmiMoJo · · Score: 2

      The idea is you use a spare phone and put it somewhere that it hopefully won't be taken.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:so... by Anonymous Coward · · Score: 1

      Nah. Ole Pootin will have a direct backdoor to the app.

    4. Re:so... by Hal_Porter · · Score: 1

      Stop Blackaddering.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    5. Re:so... by networkBoy · · Score: 5, Interesting

      nah, the phone can be taken. The example given is phone placed on top of lappy in safe. Once phone sees evidence of tampering (movement, light level change, etc.) it starts taking pics and audio, and sends them to you over a Signal channel, SMS, or .onion host.

      This isn't to prevent access to your devices (hard), it is to tattle tale that access has happened (easy).

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    6. Re:so... by gweihir · · Score: 1

      That is not what this is about. Common thieves steal the laptop. Actual "bad guys" do _not_ steal it, they tamper with it.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    7. Re:so... by Anonymous Coward · · Score: 1

      Didn't you pay attention? It's on F-Droid. Unless Putin has somehow "On Trusting Trust"-ed F-Droid's compiler, you can calm down.

      Even if they did use Ken Thompson's Trusting Trust Attack, there is David Wheeler's Diverse Double-Compiling that can fully counter it.

    8. Re: so... by Zero__Kelvin · · Score: 1

      Except it can't. Wheelers theory is exactly that, and doesn't work in the real world.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    9. Re: so... by Zero__Kelvin · · Score: 1

      Citation of it actually working needed

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    10. Re:so... by camelrider · · Score: 1

      If you install this, the bad guys already have control of your phone and your laptop

      Sounds like hiring a family of hyenas to guard your sheep!

    11. Re: so... by Anonymous Coward · · Score: 1

      Citation of it actually working needed

      Wheeler demonstrates it as part of his PhD thesis defense.
      There is a video of the defense, look at the 47:40 mark.

      Or, you could read his paper and reproduce the results yourself.
      Look at the linked page for the section "Detailed data to duplicate the experiments".

    12. Re: so... by stiggsinc · · Score: 1

      OH..... SNAP....

  2. Sweet irony by joestar · · Score: 1

    Very interesting use case and development, but this is somewhat amusing to see that Snowden is posting his privacy apps to Google Play (in addition to F-droid)... It's not a good message sent to people in my opinion.

    I think it's time that we get something alternative to Google and Apple, like project eelo.io seems to be starting.

  3. Collaborators? by Headw1nd · · Score: 1, Interesting

    Who are these collaborators, and where are they located? If they are from Snowden's new digs I would be concerned about giving their program access to my phone's sensors. In a perfect world, the open source community will drag a fine tooth comb through the code and we could be sure there was nothing malicious, but I don't believe in that world yet.

    1. Re:Collaborators? by cold+fjord · · Score: 2, Interesting

      In a perfect world, the open source community will drag a fine tooth comb through the code and we could be sure there was nothing malicious, but I don't believe in that world yet.

      I think you are wise not to.

      Over the years that contest has produced some stunning entries, including some that had as many as three different unrelated major functions contained in the same body of code. There is more than one way to hide secondary functionality of a program, some of which you would have to be quite clever to detect. The fact that Snowden is involved would serve to cause many people to drop their guard even if they had the skill and mindset to detect such obfuscated functionality.

      --
      much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
    2. Re:Collaborators? by Bing+Tsher+E · · Score: 2

      You give them access to the sensors on an old phone that you're not using anymore. It repurposes the phone as a security device.

    3. Re:Collaborators? by Anonymous Coward · · Score: 1

      You're wise not to, but not for the stupidity you posted. It's wise not to believe it simply by the fact that the open source community has already shown that almost no code gets regularly audited and most members don't have the ability to audit code even if they were doing so on a regular basis. OpenSSL isn't an IOCCC entry and yet was chock full of security holes despite the supposed "many eyes" constantly looking over the source code.

    4. Re:Collaborators? by Anonymous Coward · · Score: 1

      In a perfect world, the open source community will drag a fine tooth comb through the code and we could be sure there was nothing malicious, but I don't believe in that world yet.

      The open source community can't even do that for libraries already known to not be malicious. In fact, the open source community lazily introduces bugs and then doesn't fix them for years.

    5. Re:Collaborators? by angel'o'sphere · · Score: 1

      I doubt anyone in the "open source community" ever analyzed an piece of open source and combed over the source code.

      I don't even compile stuff myself, but download the binaries.

      The last thing I cloned from github was the source code of the groovy language. Close to 270k files ... who will ever review them?

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
    6. Re:Collaborators? by networkBoy · · Score: 1

      True, but...
      OpenSSL was full of [assumed] accidental holes.
      IOCCC proves it's trivially possible to make those accidental holes intentionally.

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    7. Re:Collaborators? by Swave+An+deBwoner · · Score: 1

      And possibly repurposes your cellular and/or wifi network as a covert communications channel; but for whom?

  4. Completely safe and secure by Burdell · · Score: 2, Insightful

    I'm sure that after requiring full access to all your phone's sensors, the app would never share that data with Russian hackers.

    1. Re:Completely safe and secure by hcs_$reboot · · Score: 3, Informative

      The app is Open Source and is available from an open source app store.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    2. Re:Completely safe and secure by thegarbz · · Score: 3, Informative

      I'm sure too. The source code is here: https://github.com/guardianpro...

    3. Re:Completely safe and secure by cold+fjord · · Score: 1

      Strange as it may seem to you that isn't a guarantee that it is:

      - Free of bugs
      - Has no subversive behavior
      - Has no hidden or obscured features

      Even if you want to trust the contributors of that code, has either their development environment or the distribution means been compromised?

      Has anyone publicly stated that they have audited and tested the code? I might trust the OpenBSD project contributors.

      --
      much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
    4. Re:Completely safe and secure by thegarbz · · Score: 1

      Why would you trust people rather than trust code? The pope himself could sign it. Makes no difference.

  5. Re:Who was Haven written by? by Anonymous Coward · · Score: 1

    HE IS HERO FOR ALL PEOPLES

  6. DA! by Templer421 · · Score: 3, Insightful

    KGB Phone!

  7. Physical vs network by AHuxley · · Score: 1

    Do the security services really need to enter your room and the open safe?
    They know the room the interesting person is in due to the hotel, CC, ID used.
    Everything networked in the room can be set to collect it all during your stay.
    Sooner or later that secure laptop on average under the cell phone is going to be online again.
    Having a need to use such software just makes the security services more sure the person is worth collecting on.
    Once the security service know a person has such software their hotel room not be entered.
    All surrounding hardware and networks will be used to try and access the persons laptop.
    Physical access to the laptop can be done at any airport during a "random" request to look at the laptop.
    Domestically once a person is in and out of their hotel room security services can just use a smart tv or other networks in a room to collect on the person of interest.

    --
    Domestic spying is now "Benign Information Gathering"
    1. Re: Physical vs network by AHuxley · · Score: 1

      AC if you read the linked https://theintercept.com/2017/...
      The word hotel is mentioned a few times ....
      "You lock your laptop in a hotel safe"
      "like the hotel’s network"
      "phone in a hotel safe"
      " considering hotel safes are not very secure"
      If you want to know about the smart TV part AC try Weeping Angel "CIA, MI5 hacked smart TVs to eavesdrop on private conversations"
      http://www.zdnet.com/article/h...

      --
      Domestic spying is now "Benign Information Gathering"
  8. So it's a nannycam? by Edis+Krad · · Score: 1

    Here, have another one!

  9. Re: Who was Haven written by? by Anonymous Coward · · Score: 2, Funny

    He has skills. He wrote his own WordPress theme.

  10. Re:Who was Haven written by? by jellomizer · · Score: 2, Insightful

    That was my thoughts as well, however despite the ego of software developers, making an app like that doesn't take super programming abilities, just some time and effort.
    But my main worry is why should I trust an App built by a guy who admitted stealing NSA data? It is like getting your keys duplicated by an admitted house burglar.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  11. or just wait for the battery to die by Joe_Dragon · · Score: 1

    or just wait for the battery to die

  12. Snowden and Fancy Bear by Martin+S. · · Score: 1

    So Snowden releases a 'spy app' on the same day the scope of Fancy Bear operations against journalism are exposed.

    Um, no connection here, nothing to see, move on.

  13. Re:Who was Haven written by? by samkass · · Score: 1, Flamebait

    ... who is living in Russia at the pleasure of the Russian Government. Do you REALLY want to give a Russian-supplied application access to all the device's sensors? I know it's open source, but a lot of stuff can get hidden in code...

    --
    E pluribus unum
  14. Re:Who was Haven written by? by phayes · · Score: 1

    Isn't HERO FOR ALL PEOPLES == Hero of the Soviet Union?

    --
    Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
  15. Re: Who was Haven written by? by phayes · · Score: 1

    Ooooh... a wordpress theme! Wow! Knowing that really makes me think he could code a secure application on Android without screwing it up!

    --
    Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
  16. Re:Who was Haven written by? by angel'o'sphere · · Score: 1

    Because:
    1) he did not steal the data
    2) he published it, and that is his crime
    3) he is concerned about your privacy and gives you a tool to protect/warn you from/about NSA and other guys putting surveillance devices into your room

    --
    Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
  17. whats with the shills? by nimbius · · Score: 5, Insightful

    im seeing a lot of suspicious attempts at character assassination in the comments and theyre fairly easy to debunk, so here goes.

    Even worse, I believe he was a sharepoint admin...

    check wikipedia or the guardian project to figure out what this man actually did and who he worked for. He was a BAH contractor. Just because your employer is too daft to assign you anything but a menial job shoveling the sharepoint shit, doesnt mean you're too stupid to do real work.

    I'm sure that after requiring full access to all your phone's sensors, the app would never share that data with Russian hackers.

    except that Haven is open source you tit. It has 5 developers and currently 1 asshole from slashdot trying to torpedo it
      https://github.com/guardianpro...

    --
    Good people go to bed earlier.
    1. Re:whats with the shills? by Zontar_Thing_From_Ve · · Score: 1

      check wikipedia or the guardian project to figure out what this man actually did and who he worked for.

      That's really good advice. I believed the original reports about Snowden and let's just say that they ended up being very far from the truth. Some time ago I did exactly what you suggest and I was very surprised to find out that Snowden's life was actually quite different from what some reports claimed.

  18. Re:Who was Haven written by? by Anonymous Coward · · Score: 5, Insightful

    He is a whistleblower because he published documents proving that the US government agency he was contracted to work for violated the law. I'm not sure why you are directing your anger at him.

  19. Re:Who was Haven written by? by Sys32768 · · Score: 1

    Even if he did go searching for something and even if he did do it for fame (I dont believe so, given all he sacrificed. And his demeanor did not suggest that -- watch Laura Poitras' film.), he IS in fact a whistleblower who outed the US government for illegal activity. He did America and all Americans a favor.

  20. Re:Who was Haven written by? by jon3k · · Score: 1

    His motivation is in question here. Just because what you do happens to benefit me doesn't mean you're not a scumbag.

    And second of all I don't know how much it did benefit me. Do you think the government stopped those programs and didn't replace them? I'm certainly not sure.

    And your opinion of his performance in a movie is truly irrelevant.

  21. Re:Sad news ... Christopher Reimer, unnoticed at 4 by Anonymous Coward · · Score: 1

    Chris, people are now openly and proudly mocking you. You and your 6 YouTube subscribers.

  22. Re:Fuck him by Killall+-9+Bash · · Score: 1

    Pro tip: The US govt. should hire professional shills instead of unleashing an army of 19 year old Air Force sysadmins.

    --
    "Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016
  23. Re:Who was Haven written by? by mysticgoat · · Score: 1

    His motivation is as irrelevant as whether he parts his hair on the left or right. Nor, for that matter, does his seeking asylum in Russia. What is relevant is not Snowden; what is relevant is the illegal and unconstitutional practices of agencies of the USA government that Snowden exposed.

    Your comments, Sir, have as much value as the food critic who damns the pastry chef for wearing a plaid apron over a striped shirt.

    This is not an ad hominem attack. I don't know you well enough for that. This is an attack on your misplaced criticism, which

    1) might be intentional on your part because you are incapable of coming up with something that was truly relevant to the issues Snowden raised, or

    2) might be unintentional because you sent your comment before you engaged your brain, or

    3) might be for any number of other miscellaneous reasons.

    So you see, I just don't know enough about you to deliver an ad hominem attack.

  24. Re:Who was Haven written by? by cold+fjord · · Score: 1

    (I dont believe so, given all he sacrificed. And his demeanor did not suggest that -- watch Laura Poitras' film.),

    CNN headline: Snowden to newspaper: I took contractor job to gather evidence

    Laura Poitras was a collaborator with Snowden. Why would you think she would portray him in a bad light?

    --
    much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
  25. Re:Spy, yes. Whistleblower .... mmmmm .... by Dasher42 · · Score: 1

    You really freaking don't get Snowden or why some of us appreciate him. There's not been any soup. I don't even know what you're comparing to the soup, and I actually don't think you do either. You couldn't even explain that payoff or gratifying factor.

    It doesn't take much historical or political theory to see why what the NSA is doing fundamentally breaks the contract between the government and citizens that characterizes the USA. If you're an authoritarian and might makes right, well... you don't understand what the USA is supposed to be at least for the citizens it recognizes as such. But if you imagine yourself at all interested in the rule of law or the rights of people even against politically powerful entities, you're being dissonant and duped.

    The USA's agencies make the East German Stasi look crude and, if you're outside the sphere of privilege, benign.

    If you paid any attention to the expansion of war powers between Bush, Obama, and now Trump's administration and applied the same observation and concern to technology, you'd be clear on the danger and why Snowden did the world a huge favor.

  26. he should make an app that detect activities that by maybe111 · · Score: 1

    he should make an app that detects activities that we like to keep private and alert the user whenever they are detected to make them more aware of the privacy implications of have a computer with so many sensors in your pocket all the time.

  27. Re:Who was Haven written by? by jimtheowl · · Score: 2

    "why should I trust an App built by a guy who admitted stealing NSA data"

    It depends on whether you think that he stole data from the NSA, or that he took data from the NSA gathered from the people it was supposed to serve as proof of their illicit activities.

    There is a big difference between a selfish coward and someone who risks everything for what is right. It would be nice if people had enough attention span to discern between the two, but it could also be because most people cannot relate to sacrifice for a higher cause.

  28. Re:Who was Haven written by? by farble1670 · · Score: 1

    making an app like that doesn't take super programming abilities, just some time and effort\

    Sooo.... like most software?

    But my main worry is why should I trust an App built by a guy who admitted stealing NSA data?

    It's OSS. I guess you hope that not a few people will be pouring over the code looking for issues.
    https://github.com/guardianpro...

    I seriously doubt Snowden had much to do with this other than giving it his stamp of approval. The primary (only?) contributor is not Snowden (obviously).

  29. Re:Who was Haven written by? by farble1670 · · Score: 1

    I know it's open source, but a lot of stuff can get hidden in code...

    Because we're all running background checks on the authors of the OSS we use, right? Or maybe you are looking to see if they use words like "comrade" in their comments. That's probably good enough.

  30. And where iare Snowden and his friends living now? by Budenny · · Score: 1
    Yes, where are they living? And on what are they living?

    I know, they are living in a freedom loving country that offered asylum because of its long standing commitment to open culture, citizen privacy, and free speech, so they felt it was important to protect the noble whistleblower. A country that leads the world in its protection of open journalism and has for centuries, well decades anyway, led the struggle against state surveillance of citizens.

    Apparently they were so impressed with Snowden's nobility of purpose that they awarded him a state pension immediately he arrived. Of course, his travel was sponsored by the British Guardian newspaper, itself a noble advocate of free speech and opposition to global warming, now enthusiastically promoting the noble Corbyn, having belatedly finally discovered his nobility when his takeover of the Labour Party was secured. A paper that has systematically revealed the iniquities of various US organizations, and has usefully countered the disgusting neo-liberal capitalist denigration by the evil Murdoch Press of the great contribution of the Soviet Revolution to human freedom and well being.

    Maybe the Guardian gives them a stipend too?

    Well anyway, these are my kind of guys and I will download and install their app right away. They are about the only people I would trust with accessing all my sensors on my mobile. I mean, anyone else, how do you know who is sponsoring them?

    I hope they keep their app up to date. I am sure they will make the updates available immediately to everyone who has installed it.

  31. A fool and his privacy by Martin+S. · · Score: 1

    ... are easily separated.

  32. Re:Who was Haven written by? by mysticgoat · · Score: 1

    You are failing to recognise that Snowden's actions and motivations are only germane to a very minor distraction from the major story that concerns the contents of the data he released. Why is this distraction so important? Does the color of the envelope affect the meaning of the message in the letter?

    I think not.

    I don't much care why Snowden did what he did or whether he was a heroic patriot or a snivelling traitor. I don't think anyone outside his circle of family and acquaintances should care very much about that right now. For one thing, it is very unlikely that any irrefutable proof one or the other will ever come to the fore, and it is a waste of time and energy to involve yourself in unresolvable arguments. Maybe when Snowden is brought to trial assessments of his character should become part of the public discourse, but now that is just shadow boxing.

    What I do care about is persons who seek to distract others from significant issues with these kinds of meaningless arguments. What is significant here is what Snowden has revealed: agencies of the USA government have been engaged in unamerican activities. Do you have anything to say about how to keep that from happening, or do you simply want to distract people from thinking about it for some reason?

  33. Re:Who was Haven written by? by Riceballsan · · Score: 1

    maybe your definition of a scumbag and mine are very different. Would you also hate someone who goes bursting in saving children from child rapists, just because he wants to see his face in the headlines? Do you spend any time to find out whether the firemen or similar jobs save lives or families because the job pays well or they just like the social respect the job gives them?