Tag: Bluetooth

Posted on
by
Walls of an old castle

I worked in computer security for most of my career. I worked on Unix security, then phone operating system security, then Bluetooth security. It was largely thankless work.

The issue was that no one wanted to work on a secure computer. Every security feature was a small obstacle to the user getting work done. Security features tended to get turned off or worked around. Certainly nobody was willing to pay more to buy a more secure operating system.

The secure Unix system I worked on was pretty secure. It had great security features that made it easy for users to do their work with considerable confidence that neither outsiders nor other users on their computer could hack their way in.

The federal government required that all computers purchased by anyone for any government office be evaluated to the level of security that our system offered. Over a period of years, our system was the only evaluated system available.

Guess how many we sold?

Zero.

Every government office that was buying computers asked for and got an exception to the requirement that they buy a system like ours.

That’s how much people hate security features in their computers. They slow you down. They make it harder for you to get your work done. They make your system different from other systems, so you have to learn new stuff.

It is from that perspective that I’m dismissive of AI hacking tools. Yes, they can hack computer systems, but that’s because people have preferred computer systems that are hackable. It will take a bit of time to go back and redesign and rebuild those systems with security in mind, but not long. How to do computer security is a solved problem. The knowledge is broadly distributed. It’s just a willingness to put up some minor inconveniences that’s been the obstacle to having broadly unhackable computer systems. Maybe with AI hacking tools quickly hacking into every insecure system out there (which is virtually all of them), people will finally be willing to accept the cost and inconvenience of secure systems.

At any rate, it’s no reason to regulate AI. Just a reason to enforce our regular laws.

Posted on
by

To be completely honest I mainly want this because without it the watch pocket in 5-pocket jeans is worthless. But it also occurs to me it might be appropriate as an alternative to a burner phone.

I don’t have the device fully characterized yet, and in fact there are multiple versions that might be differently useful in different circumstances, but here’s a sketch of what I’m thinking about.

First of all, the device has to fit comfortably in the watch pocket of a pair of 5-pocket jeans. That’s its whole raison d’être.

Almost certainly it needs to have:

  • Camera
  • GPS
  • Good-but-small screen
  • Bluetooth
  • WiFi

This is enough to enable all sorts of use cases: Geo-tagged images, navigation, listening to podcasts, tracking workouts, etc.

If I could get just that—and if it were reasonably cheap, and designed with good security—I’d buy one in a heartbeat, simply to have a workout tracking device that fit in the media pocket of my workout shorts. (My phones get bigger faster than I need to buy new running shorts.)

At this point, we need to make a big binary decision: Does the device have a phone?

Without a phone, it’s just a teeny-tiny tablet. As I say, I’d buy one, but without a phone it’s pretty limited—no connectivity unless you’re on somebody’s WiFi.

For most of the use cases I have in mind, this would work great. I could connect my headset & heart-rate monitor, kick off a podcast, start up my work-out tracking app, and go for a run. Along the way I could pause to take photos to document my workout. And the end I could share photos and workout details to social media. (Everybody I know cares deeply about my workouts.)

Some very minor software tweaks would let you use it your pocket watch phone as if you were connected. For example, you could still write texts and social media posts, they’d just be queued up until you went on WiFi someplace at which point they’d all be delivered.

The biggest issue with a pocket-watch non-phone phone would be the inability to make emergency calls. Less of a big deal but important to a lot of people is just generally being connected—making and taking calls, sending and receiving texts, keeping up on and posting to social media, etc.

The downside of adding a phone is that it loses the potential to be a purely off-the-grid device.

It might be possible to compromise: You could have a phone that’s turned off (with a burner SIM). Then you’re covered: In case of an emergency turn the phone on.

Proper burner phone security would require that you dispose of the phone as well as the SIM once you’ve powered it up. That need could probably be avoided if the phone generated a new IMEI on each power-up the way some devices are now generating new MAC addresses on power-up for the same reason. (There might be other numbers that would need to be regenerated. There’d also probably be other software changes necessary, such as obfuscating the list of installed apps, to keep the phones from being self-fingerprinting in all sorts of ways.)

If you can make the phone cheap enough, which having a very small screen would help a lot with, maybe none of that matters. Buy the phones in three-packs for a few dollars, and then give them to homeless shelters as soon as you’re done with one.