I know it's against the rules to tell people to read the article, but I would encourage everyone to read the article. It specifically says this is a potential threat to
>"elected officials, candidates, political campaigns, [and] political parties"
not to the general public. The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the Russian government can see them and can also see what's in the background (sensitive documents?) or see geo-location from the app (like how Strava was leaking the coordinates at military bases ) or any number of things a hostile foreign government who has already hacked American elections once and is planning to do it again might want to do with pictures that interns/staffers might think are private.
>Russian government can see them and can also see what's in the background (sensitive documents?) or see geo-location
It feels like a boy scout camp rather than government then. The same for a bunch of emails that ‘interfered’ with true democratic elections. If your organization is so fragile that revealing a tip of your pants makes everyone wonder if they are clean, then maybe that is what needs to be fixed, not someone who posts pictures of it to the internets (in this case provides a REST API for you to do that). However evil my country’s govt will ever be, the level of this nonsense is pushing the heliopause.
> I know it's against the rules to tell people to read the article, but I would encourage everyone to read the article.
It's not against the rules at all, so thank you for the encouragement! I will go read the article.
What the guidelines warn against is something different: Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."
Can apps still get information that identifies the specific device? If so, another possible threat model could be more about identifying who uses what device rather than anything specifically in the photos themselves.
For example, I already have a database of high value target's faces built from political sources like house.gov. Now I do facial recognition between that set of faces and the FaceApp faces. That allows me to identify the specific devices used by government officials. That would seem to be super valuable for more targeted attacks and/or pairing with other apps for potential kompromat.
I was thinking more along the lines of hacking because now you have a face and can identify who they work for and that they may have valuable info being a part of X person’s political campaign. Potentially you’d then install some silent update or use some new exploit to gain access to the rest of their phone. Anyone know if that is possible?
I think they're talking about just what device they have and OS version (but that's available in the user-agent anyways), since that tells an adversary what exploits to purchase or put resources into developing. Who knows, maybe 30% of congress people haven't yet upgraded to an iPhone with the A12/A13 chip (which can't be exploited via the checkm8 exploit).
It specifically says this is a potential threat to > "elected officials, candidates, political campaigns, [and] political parties
But that is NOT what it says at all.
I can't emphasise how misleading this summary is! The exact quote is:
> If the FBI assesses that elected officials, candidates, political campaigns, political parties are targets of foreign influence operations involving FaceApp [then the the FBI would investigate].
Note that "IF"? That puts a pretty different spin on it to your interpretation!
Separately, it says:
> The FBI considers any application or similar product developed in Russia, such as FaceApp, to be a potential counter-intelligence threat.
@dang - I think that the current headline "FBI designates FaceApp as counterlintelligence threat" as misleading. "Designates" implies something like being added to an official list (like a sanctions list or something). A better headline would be "FBI responds to congressional query on FaceApp" or "FBI considers all Russian-built apps counterintelligence threats"
Not at all. There's plenty of people in this thread wondering what "potential" means in "potential threat". This is what that potential means. The FBI has assessed that this app is a potential threat but they haven't found any evidence that Russia's government is actually using it in this way. If the FBI finds out that it's being used as an attack vector, then they will jump in to assist.
Not misleading at all. I don't know why so many people are reading this so wrong, it's not a long letter. The Senate asked the FBI if this app was a threat to US politicians, the FBI said it could be but they don't see it being exploited at this time. If that changes, the FBI will intervene. Pretty simple to understand as long as you read the words that were written.
Your version It specifically says this is a potential threat to "elected officials, candidates, political campaigns, [and] political parties" makes it sound like the FBI said that.
In the letter it speaks separately about FaceApp specifically (~"no known campaigns") and general potential threats (~"anything developed in Russia"). Your summary combines a quote from the "no known campaign" and the "anything developed in Russia" bit to say something they never said.
Specifically the letter says the FBI will investigate any foreign influence operations involving FaceApp aimed at officials.
Your version turns that into a claim that the FBI says FaceApp is only a potential threat to those officials. The letter doesn't say that at all.
Additionally you make up a bunch of stuff around the threat model that you claim the FBI sees. ("The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the Russian government can see them and can also see what's in the background (sensitive documents?) or see geo-location from the app (like how Strava was leaking the coordinates at military bases ) or any number of things a hostile foreign government who has already hacked American elections once and is planning to do it again might want to do with pictures that interns/staffers might think are private.")
Again, this letter doesn't say or imply that. In-fact, the foreign influence operations may imply that the FBI is more concerned about foreign adversaries using the politician's likeness (eg for "Fake News" style videos or something).
>The potential threat is for someone at Candidate_1's campaign taking selfies with the app, that then uploads them to Russian servers where the Russian government can see them and can also see what's in the background (sensitive documents?)
good old days just less than 20 years ago back at Sun when we were strictly instructed that the computer monitors must be off when the photos would be taken. How times and basic norms of opsec have changed - these days you just tweet the straight photo of the classified monitor screen https://www.npr.org/2019/08/30/755994591/president-trump-twe...
i think it is close to it. I mean for example that FBI guy - Peter Strzok - who led investigation into Clinton's mishandling of emails was himself officially found in flagrant violations of classified information handling policies in particular for storing the classified documents on his personal unencrypted devices, etc.. Somehow i don't think that Strzok is just an exception at FBI - he spent 21 years there after all - , no, he is just the one who got caught because he attracted attention (by his anti-Trump and pro-Clinton text messages on his FBI issued phone while investigating Clinton emails and Trump-Russia collusion - speaking about opsec again :)
> a hostile foreign government who has already hacked American elections once and is planning to do it again
What do you mean by hacked? There is no evidence that any vote counts were changed. So I don't think the election was hacked. The only evidence of any hacking was the theft of DNC emails, but even then the DNC has never turned over the servers they say were hacked to the FBI. And Crowdstrike retracted key parts of their report on the supposed hacking.
Certainly I think the Russian government would love to control the outcome of American elections, and they probably try daily to do that. But saying that they or anyone else hacked American elections is a stretch.
I'm not saying this with any political motivation. I'm just trying to interpret the facts of what happened in 2016.
That's only the most obvious of targets - - there are many other possibilities, some yet to be imagined. What about mafia style hits ? As in the Russian agents who nerve gassed their adversaries in Britain ?
I think FaceApp should be hosted on an AWS-like infrastructure.
Hosting in Russia is expensive and does not provide any advantages, such as dynamic routing that is crucial for world-wide app. Most developers use it to comply with Russian standards: you only need to store information about Russian users on Russian servers.
In addition, currently in Russia there are no good alternatives for reliable cloud neural network inference.
But I can’t understand the negative media about the application, based on the founder’s country of origin. I argue that this is discrimination because there is as yet no evidence of breach of confidentiality.
According to the article, FaceApp says they host in the United States, Singapore, Australia and Ireland. Whether that's true or not, I don't know. The problem the FBI has is no matter where the data is hosted, the Russian government has access to it as long as the Russian developers of FaceApp have access to it.
It’s worth noting that the heads of CIA, FBI, NSA, DHS and the Justice Department have all confirmed the Russian government are currently actively engaged in ongoing global disinformation campaigns propagated primarily on social media designed to sway elections in democracies abroad.
It’s beyond dispute.
The Russian government has breached confidentiality.
The country intervening in most foreign elections is the United States with 81 interventions, followed by Russia (including the former Soviet Union) with 36 interventions from 1946 to 2000—an average of once in every nine competitive elections 
The most effective aspect of this disinformation campaign is that if you share the wrong meme on reddit or Facebook you can get accused of being a tool of the Kremlin, which is pretty grand and hilarious really. Americans have gaslit themselves into thinking the Russians are everywhere (again).
My point is that I do not see a direct connection between the mobile application founded by the Russian indie developer almost 2 years ago and the swaying one of the most established democracy in the entire history.
Thankfully that doesn't happen anywhere else in the world.
Australian government metadata requests was well over 300,000 last year, nearly 1000 requests a day all warrantless, can come from tiny local councils or horse racing orgs. Trust us, they say, there's oversight in hidden tribunals, they say.
Yes all countries do it, but US intelligence doesn't just take into account the action, they take the actor as well. Australia is a friendly nation to the US and shares intelligence data with US intelligence agencies. What we see, they see and what they see, we see. Russia is not a friendly nation to the US and does not share intelligence with US intelligence agencies.
The FBI isn't saying "normal people are at risk from FaceApp" but "US intelligence is at risk from the use of FaceApp". In the (very short) linked letter, it specifically calls out "elected officials, candidates, political campaigns, [and] political parties".
Considering all US intelligence agencies unanimously agree that Russia already attacked US candidates and political parties in the past, saying "yeah but everyone does it" is about as off-topic of a remark as you can get. To my knowledge the FBI has never publicly disclosed Australia's efforts to meddle in US elections.
How any US serving member is allowed to use facebook or random apps is beyond me. The entire premise here is absurd. Of course it is a risk, just like the app partially owned by tencent that one of the most popular sites in the world insists you install when browsing on mobile.
Australians legally do metadata and spying better than everyone else on many metrics and then share it with the multiple eyes. Something to remember when the media is whipping up a threat frenzy.
Given Australia's treatment of whistleblowers and slow descent into authoritarianism, I very much envy the few protections Americans take for granted.
I bought microSD reader off Amazon, which has two dongle ends, one USB type A for a computer, one Lightning, for my iPhone. According to the included instructions, it required me to download an app (from the Apple app store) to use on the the iPhone. I didn't trust the App, even with Apple's scans, so I ended up using it with my already-owned Camera Connection Kit (Lightning to USB Host) adapter just fine. The name of the app was something very similar, if not identical, to that name, which is what reminded me of it.
It seems fishy that the Apple provided Files app didn't recognized my SD card
Someone please correct me if I'm mistaken, but this is/was a limitation imposed by Apple before iOS 13. On iOS 13 (on an ipad pro at least) you can now access an SD card via files, but before that it was Photos or a bespoke app from the manufacturer only. I've not tried on an iphone recently.
I wouldn't be surprised if this app collected much less data than the Facebook cancer. Facebook is not only stalking you through its main app but its other brands (Insta, WhatsApp, etc which a lot of people don't even know they're owned by FB) as well as unrelated third-party apps & websites that embed their malicious SDKs.
Facebook is an industrial-scale stalking operation. I doubt FaceApp (or frankly any government actor) could pull off something like that even if they wanted to.
The face picture is not really the problem. The app slurps other data from the device, such as log files, cookies, identifiers, etc. Of course, this app is probably not dissimilar to many of the other 2.5 million Android, 1.8 million Apple, 0.7 million Windows, and 0.5 million Amazon apps. https://www.statista.com/statistics/276623/number-of-apps-av...
There is no threat model for an iPhone app to do nefarious things in an App Store distributed app on a non-jailbroken phone. At most, FaceApp grabs the picture you uploaded and some minor meta-data that every app using an analytics tool (read: all of them) collects.
This is political grand-standing at best, and would be a non-issue if you replaced the geographic location of the dev team with any other countries
I get it, Russia is the Big-Bad-Boogeyman right now. But if you think for a second that a real attempt at counterintelligence would publicly come from such an obvious point of interest, than I have a bridge to sell you
By "non-jailbroken" you should mean "jailbreakable": it is the existence of the vulnerability that makes the phone insecure, not the user having used an exploit to leverage that vulnerability to do something for them. Like, for no avoidance of doubt: if you are running a version of iOS for which you can download an app-based jailbreak (which has been all jailbreaks for current phones that have been released for years now, all reliant on sandbox escapes), the issue is that the attacker jailbreaks your phone, not that you do; and also, to be explicit, as people also often confuse this, the code I would put in an app for a "back door" capable of letting me jailbreak remotely would not look like exploit code but would look like an innocent bug: maybe a vtable use after free bug on my stack while parsing a network response for which I knew the location of all the required ROP gadgets to exploit (put different "if you want to put a back door in software, just leave yourself a vulnerability you know how to exploit, and then claim you weren't evil, you were just bad at memory management or concurrency... like everyone else).
Just to be clear, you’re saying that FaceApp has a yet unfound component that lets them remotely jailbreak an otherwise un-jailbroken Phone via a published AppStore app? and that they’ve done this in the open on one of the most politically criticized apps short of Facebook?
1) I am saying that your assertion that "There is no threat model for an iPhone app to do nefarious things in an App Store distributed app on a non-jailbroken phone." is a misleading statement that is making a very broad and entirely inaccurate claim about something that I personally don't want anyone confused about (the safety of users jailbreaking their own phone, particularly on these newer devices where the jailbreak developer has very limited ability to mess with the sandbox).
However, 2) I would imagine the probability that FaceApp does not have a vulnerability in it somewhere is extremely low, as in my experience essentially every single app has security flaws in them; the problem in your mental model is that you think someone would "find" a "component" that would be a smoking gun of some form, whereas only an idiot would make a back door something other than a security vulnerability (as essentially every single app has security vulnerabilities). Were any placed there on purpose? No one would ever know.
The threat model is that this photo is shared with the Russian government and then the Russian government can match American citizens (or potentially people working in intelligence), and then using that in facial recognition programs. I.e. they can differentiate Americans (insert x country) from their own citizens and know who to watch more carefully.
This is a legitimate threat model. I'm not sure why you think it wouldn't be. Spies and others do use fake identities. The threat model is that there is that there is a way to determine who is faking their identities.
> A picture, that has no good associated data about the user
A picture is a username... Are you trying to say that your face isn't personal identifying identification (PII)? I'm not sure what your argument is here, because it can't be that. That argument would be absurd, so I'm sure I am misunderstanding.
If you work for the government in any way they generally don't want you spreading around PII. Number one concern is that you can be blackmailed. So of course, the lower your informational footprint is the lower the threat model.
It's a tit-for-tat response, showing that if they want to make this a trade war, their companies will get hurt too. So yes, national grandstanding.
Edit: Wups, dates are wrong. This FBI release is from November 25, so the Russian law is likely in response to it, not vice versa. Still national grandstanding, but the idiot party isn't necessarily the Russians.
Why are you sure that’s all it can grab? That seems mistaken on a technical level. “Can’t” and “doesn’t” is an important distinction.
We have seen lots of examples of ad analytics SDKs that push the iPhone beyond its intended sandbox. Most of them have been banned, but some operated for years before getting banned. It would be a disservice to brush away those concerns as fearmongering.
I have seen countries around the world have such a response. Russia freaked out that the latest Windows phones home, USA freaked out about Kaspersky, and so on. Russia has set in motion projects to build homegrown Linux based operating systems etc. I consider all this a good thing.
Why don’t we have the ability to restrict at the OS level which domains an app can send information to? Then we can finally host backend software locally on servers of OUR choice.
I would love to see more OPEN SOURCE apps running on servers of our choice, and communication over mesh networks. In fact I’d love for most functionality to be client-side and an option for ALL data sent to servers to be end-to-end encrypted at the OS level. I dont want to have to trust the APP manufacturer to pinky swear it’s all end to end encrypted. The OS should have a little badge saying none of the data sent by the app is being sent in a way the server can decrypt because the OS intercepts and encrypts it with keys the app can’t get. That may still leave side channels such as timing based information to tunnel through. But if we restrict what domains the app can talk to, we can close that loophole too.
That’s what I would love to see ... finally put an end to server side landlords owning your data just cuz they own the infrastructure!
But Apple is a honey badger - it dont care about ads. Their whole differentiator has become privacy and putting the user first vs apps! Seems like a glorious feature for them no? Safari already leads the way with blocking ads and third party tracking cookies.
Forgive me for chuckling at law enforcement in by far the world's largest exporter of consumer malware for treating a single comedy deepfakes app with so much paranoia and suspicion. How did that common saying go that was bandied around in our teenage years? Something like the person in a relationship who fears cheating the most is the one most likely to cheat
Russian laws obligates all companies and individuals to provide government access to any data, hardware or applications upon initial request or better have backdoor. All information must be stored for minimum 5 years and provided in un-encrypted form or decryption mechanisms must be supplied.
Yeah, except there are no arrests happening in the US based solely on someone being an anti-Trump protester, and Facebook doesn't directly share the user data with anyone.
Inb4 Cambridge Analytica, FB didn't just hand off the data to them, users had to use a special third-party app within FB and explicitly give it permission to access the user data. And those APIs aren't available anymore after the backlash either way.
For almost all people, name and profile picture are set public. It's an incredibly tiny fraction of all the data, which is why I'm amused at all the uproar. There really is very little you can do with that information.
That's silly. Just take a list of leaked emails and run that against gravatar and you'll probably get more photos. Run it through Luminati if you're afraid of getting IP blocked. Bam! You could have a hundred million avatars, most of which will be photos.
Then there's LinkedIn's public profiles, Github's public profiles, Twitter's profiles. This is just privacy theatre.
The best measure would be for “good actors” (universities, government research agencies, the New York Times) to provide a free FaceApp-type app. It’s like a weekend-hackathon of work and can be prioritized by the app stores.
Alternative idea: spend that effort on something more worthwhile than a stupid toy. Like cancer research. Or clean energy. Or simply go outside and clean the beaches. NYT office ain’t that far from the ocean.
Many foreign nation states might have access to like, 500x400 pixel photos of people. Not 12 megapixel direct front selfie camera taken photos, where the person is intentionally trying to get the highest quality photo possible.
I mean isn't law enforcement using that data the threat model? It is just if your own government is doing it vs a hostile state actor. So while our gov doesn't see the former as hostile (they're the ones doing the actions, so who would admit hostility) they do see the latter as hostile. You can call this hypocritical (which seems to be the common argument here in HN), but hypocrisy doesn't nullify the hostility.
Nadler, Mueller, & Schiff all rape and kill boys in Buffalo, NY on the night of January 14th, 2019, as Trump did earlier that morning. The "impeachment" is a vehicle for keeping power, they are all working together. Full audio proving this entirely here, all three admit collusion with the President.
\\January 14, 2019 23:23: Jerrold Nadler steps up to take his turn during the Illuminati "rape party". Nadler rapes and kills three boys in under a minute, however, there was a problem. One of the boys was already dead, so he requests a new one. Jerrold Nadler then requests another ten boys. Donald Reeves: "That's a million dollar request". Nadler responds: "...you guys will cover it. I'm gonna keep Trump in power" (Trump raped and killed a dozen boys 6:30-7:00am that morning). By the time Nadler is finished, he had raped and killed 24 boys. Audio pulled from the video linked below:
14JanCh4_2300-0000.mp3 - Nadler starts at about 20:00 in.
Further disclosure by Porter @24:47 in: Oblivious tenant Brian Schlenker comments on something unrelated to the ongoing events: "..call the fucking police...", to which is responded with: "...that's funny because we own the police (Buffalo Police Department), we pay them six million dollars a month."
19 minutes in Fred Norris, formerly of the Howard Stern show, is acknowledged on the system.
At 19:47 in Porter admits that Brian Schlenker will be the owner of this footage should it be discovered.
January 15, 2019 00:20: Special Counsel Robert Mueller takes his turn at the Illuminati "rape party" in Buffalo, New York. Mueller ra[es and kills twelve boys. About roughly 00:55 Representative Adam Schiff who will also be leading an impeachment effort, also requests the same deal as Nadler, and then tries to make a case for getting more than Nadler and Mueller. Adam Schiff rapes and kills three boys. Mueller and Schiff all receive $3 billion dollars each for joing the group. Nadler came back to witness these two rape to make sure they were all bound together under one purpose: keep Trump in power, and also to confirm the payments to each, including his $10.5 billion dollar payment.
Between Mueller and Schiff turns, the group issues orders for ten women to begin prepping more boys for rape. They are former friends and family of Brian Schlenker, and also some long standing Illuminati members who include Elsa Hosk, Gigi and Bella Hadid. Again, the "prep" these females engage means they perform oral sex on the boys’ penis and anus, as a child rapist like Henry Porter would, while trying to remove fecal matter from the boy prior to handing them over to be raped and subsequently murdered. Just a head's up, my voice is scattered throughout all of the footage within the links posted for this update, and is quite loud relative to the desired content at times. Audio links below:
\\Previously: President of the United States Donald J. Trump rapes and kills 15 boys in Buffalo, NY on January 10, 2019. This is audio of the event from 10Jan2019. Download the mp3 and put on headphones, and turn the volume all the way up.
This is audio of the President, Donald J. Trump, demanding a $4 billion dollar bribe from child rapists to “take a blind eye” on January 3, 2019. Trump becomes one on January 14, 2019. Also, here is the big reason the major networks do not report any of it.
//Download the video, turn the volume all the way up and put head phones on. Note: there is not much to see in the video, the audio is picked up from another [illegal surveillance] system. Trump is on a call from with Henry Porter and Gigi Hadid. See page 63. Bribe demand at 10:18am:
//A big reason this has not been reported by the major news networks is right here. Lester Holt of NBC Nightly News, apparently a member of the Illuminati since the 1980's, along with ABC Nightly News lead anchor David Muir, stop over to the Porter studio in Buffalo on January 14th, 2019 at 5:00am. They both rape and kill about two dozen boys by 6:00am. Muir starts around 5:15am, then Holt about 5:38am. Multi-billionaire Rupert Murdoch, owner of News Corp & Fox Corporation, takes his turn after Holt. Video links below:
Let me be clear up front: I'm questioning your motives.
Every citizen of a democracy is a political actor and a participant in the economy and society. The Russians are agnostic, just like our intelligence services. They'll target economic actors, political actors, anyone on the social graph that looks potentially useful. In a world of micro-transactions, targeted advertising, and fake news, that's pretty much anyone.
The only point of the quote you excerpted is that's the bright line at which the FBI would directly spend taxpayer dollars to insert themselves into this issue. If you're trying to tell people they shouldn't worry about FaceApp because they're a member of the "general public", I worry that you are intentionally misdirecting citizens of a democratic society.
Looks like these ‘questioning motives’ comments are becoming more prevalent in HN.
Which is horrible, because you judge by what is said or done, not accusing people of wrong think/motive. It’s akin to self censorship, the suppression of view points in the name of ‘protecting freedom/democracy’
There will be hostile forces and actors, but we cannot lower ourselves down to their level to fight them because it’s convenient, while sacrificing our own value in doing so. In which case, we would have lost before we even begin.