Plenty of people were still saying the Snowden revelations were old hat when they came out, we all knew it was happening just didn't have proof, etc. The novelty and seriousness tends to be out-of-whack with the amount of news coverage. It's a poor way to measure the importance of existing news coverage or lack of it for that reason. What matters is that it gets out and incentivizes developers, manufacturers, company policies, and behavioural change.

There are plenty of hot news scare pieces after boring security leaks all the time bringing awareness to issues that technical people have known well. For ex, I'm hearing about friends older parents putting tape over their laptop cameras.

We love to trash bugs that having marketing brands but these exploits, and more importantly obvious attack surfaces like ME or cellphone modems, often just need the right amount of human-interest story, practical real-life example, and wrapped in good news friendly explanation for regular people to care.

It tends to happen a lot more randomly and without a rational order of priority, but it's still happening more and more often. At the end of the day it's always going to come down to the time and effort of a security researcher caring and the tech community putting the effort in to make the journalists care.

Prior to the NSA contractor Edward Snowden's revelations in 2013, Room-641A had already been exposed by an AT&T employee-turned-whistleblower Mark Klein. The EFF sued the government in 2006 over it.

Tape over laptop cameras isn't just a "parents-of-friends" thing, it's a good idea. Buy a set of stickers and support the EFF: https://supporters.eff.org/shop/laptop-camera-cover-set

Anyone know somebody at Wired?

> Tape over laptop cameras isn't just a "parents-of-friends" thing, it's a good idea. Buy a set of stickers and support the EFF: https://supporters.eff.org/shop/laptop-camera-cover-set

Support the EFF! But I hate the stickers.

Everyone puts a sticker on their webcam and completely ignores the hot mic. But you get that false sense of security…

I unplugged the microphone on my daughter's iMac years ago. She did not use it, and was ok with that.

I did not break her phone in that way. Her phone is more dangerous.

> I unplugged the microphone on my daughter's iMac years ago.

Please note that a speaker may also act as a microphone if configured so (at software level). This is especially true for speakers/headphones connected via the jack.

It's likely an internal microphone and speaker; the sound card may not support input through that interface. What you're saying can be true for many other modern computers, though.

There was an article (a while ago) showing that at least one major brand of onboard sound cards has undocumented features to switch the audio-out jack port to input. Cheap headphone/earbuds function as a microphone too, so that's a thing. Only if you leave the earbuds plugged in, of course. It can't listen from an empty jack port.

I (personally) think that intelligence/privacy-wise the mic on many devices is a lot more troubling than a camera. Camera is very directional and (again, personally for me) would at most result in embarrassment? While a microphone can record all conversations in a room/appartment, transmit everything with fairly negligible bandwidth, and taping over it won't do much good. You actually need to open the device and disconnect/cut a wire.

OT: @lightedman you're dead. Apparently due to some heated discussion on the term regression. But from a glance I couldn't find anything that stood out enough to warrant a ban. Might want to send an email and have your account unbanned.

Exactly. I've given up on tape on camera. Frankly my mug just isn't that important compared to the key strokes I make.

audio only nudies are usually slightly less exciting.

Most people’s hacked nudes will come from pictures they take themselves, not webcam snaps.

We should start demanding physical shutters for laptop webcams. Does anyone make those yet?

Even better is a hardware kill switch, especially for the mic.

Librem Purism labtop has hadware kill switches.

I managed to unplug the mic in my Thinkpad and my Dell XPS laptop with about 5min of work for each. It's still possible to do at the moment if you don't mind relying on plugging in headphones w/ a mic to use one.

Of course a switch would be nice, similar to the older Thinkpads which had a hardware switch for the network devices on the front, originally for use on airplanes.

> I managed to unplug the mic in my Thinkpad

Any chance you documented the procedure or have links to relevant documentation?

For Thinkpads the documentation you're looking for is the "Hardware Maintenance Manual" (HMM). E.g. here is one for the X260, it clearly describes where the camera/microphone assembly is, how to get to it and where its wire connections go: https://ok2.de/ThinkPad/HMM/x260_hmm_en_sp40j72016.pdf I haven't taken apart one of the more Ultrabook-style ones, so not sure how accessible those are, but the traditional ones are very serviceable.

I wouldn't be surprised if the better Dell models have similar documentation available.

This is easy in almost all laptops: the microphone is attached to the mobo via a 2-wire tiny plug. Disassemble your laptop, look at the other side of the keyboard pane, a bit away from the speakers. Some laptops might also carry mikes in the screen bezel or multiple mikes, so check all cables that go away from the mobo.

But now you have to trust the switch to really deactivate the mic. I'm a recursive paranoiac !

The usual* way to handle this is to have a small LED next to the mic/camera that shows when it's on -- and have it wired up to the device in series, such that it's software-impossible for the device to be powered without the light being on.

*: it's what we did on the One Laptop Per Child laptop, and I'm sure others have too.

Thank you for inventing the netbook and showing the ODMs how to make low cost PC notebooks.

Any idea where to get a CLI-from-boot notebook for teaching kids programming and encouraging a hacker ethic?

Thanks for the kind words! I haven't used it personally, but a programmer in my Twitter feed recommended this one that they've been using with their kids recently. (I don't think there's a heavy emphasis on CLI.)

https://tksstgiftguide.tumblr.com/post/167274832422/our-kids...

At least you only need to verify a switch once, it won't be compromised by software changes.

Assuming the switch does really cut the mic signal and doesn't instead act on a i/o pin which calls a function to disable the mic input. The second solution would be hackable.

That's a very good point. We have it for wifi already, so...

I 3d-printed a crude shutter and super-glued it to the bezel: https://youtube.com/watch?v=oOkPP_5bjhs

I think it would be about as easy to make a cardboard one.

Indeed they do. The security team at my work ordered hundreds of them and hand them out to anyone that asks. They even have the company logo on them.

There's been a Kickstarter called Nope for cams for a few years now, they exceeded funding by a large multiple each time. I got the second version a year ago, they are now on version 3 and added a headphone jack blocker.

https://www.kickstarter.com/projects/bungajungle/nope-sound-...

Not really sure about the headphone jack blocker; I'm not aware of an OS where the sound source can't be trivially switched in software, even when headphones are plugged in.

The likelihood is that if an attacker has the ability to record audio, they also have the ability to bypass this device.

My Asus EEEPC has one.

C-slide dot com, the iPad one (round with a pivot) is my favourite

Indeed, bags of lens stick on lens covers (that allow you to open when you need the camera) is a product idea I thought of ages ago, but too lazy to actually do.

it exists already, got one as swag at a conference from Nvidia (???). strange gift, I like the sentiment though.

Yes, got mine as a swag too (not Nvidia), works perfectly. Can be found by looking for "webcam cover slider" on Amazon or I assume any web store that deals with such things.

> Tape over laptop cameras isn't just a "parents-of-friends" thing

Not sure why you took that statement as deriding the practice because some older people are doing it? I noted it merely as an indication of how far the behavioural change has spread as a result of news stories... Of course it's good security hygiene. Not an ideal solution though, as others have already mentioned, compared to a hardware switch or built-in cover.

Ah, apologies; The way I read it was that your friends don't but their parents do.

That's funny, because I noticed something during a recent ~10k device audit.

Across the mobile IT we manage, the groups who covered or unplugged their webcams, internal or external, most consistently were middle to older age women, with the least common as women in their 30s or younger. Men covered randomly across all ages, but still less than women. And while they'll cover their laptop camera, most who didn't have a folding case did not also cover their tablet or phone cameras.

I don't know if it's comfort or awareness, but the ones who covered acted like it was common sense, and the ones who didn't hadn't considered it or felt like they weren't likely to be a target of interest. A few women said they chose their laptops because of the physical shutter over the camera.

I don't know if trust in electronics is more generational or age related, but it's definitely a gradient.

I definitely agree about tapeing the camera. Zuckerberg does it too

https://www.theverge.com/2016/6/21/11995032/mark-zuckerberg-...

While I don't care one way or another what people choose to do to their own devices and am happy to accept that it's probably a good practice, it does always cause me to chuckle when the "Zuckerburg does it" argument is thrown out.

I think the threat profile faced by "the rest of us" is probably just a little less intense than someone as well known, wealthy, famous and influential as the CEO of Facebook, but perhaps that's just me.

The money for that tape came from selling our privacy.

> Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored.

You're right about this new development of the functional JTAG being very recent and needing time to get around. However, security folks and others have been decrying the potential of the IME backdoor for years.

That they've been largely ignored for years lends some credibility to the thought that "we don't seem to care much." It's hard for most laypeople to understand, and it's difficult to get people excited about something they don't understand (unless they are convinced that they do understand, of course).

> A Facebook exec's claim doesn't count as proof.

How about an official statement from Facebook itself over a year ago[1]? If it was true, people could find out by decompiling the app and make Facebook look absolutely horrible.

[1] https://newsroom.fb.com/news/h/facebook-does-not-use-your-ph...

> How about an official statement from Facebook itself over a year ago

That also doesn't count as proof; it carries barely more weight than the Facebook exec's statement.

However, you're quite right about the decompiling argument. And chances are that security researchers have done just that.

It's one thing to lie, it's another thing to lie about something that could easily be found out and possibly get them sued. The risk/reward ratio seems way too high for Facebook to lie (unless they were forced to.) That's obviously not proof, but it seems like pretty strong evidence.

Can you use an ARM Chromebook without it constantly leaking data to Google? I tried to use the C201 without Chrome OS, but with libreboot, and Debian with mainline Linux. I didn't succeed.

A little late to the party, but I also have a libreboot C201, and have successfully installed mainline Debian on a USB drive connected to it. I'm going to put up a comprehensive guide + shell scripts in December when I'm on break from school, but until then, check out these links:

https://github.com/atopuzov/c201/blob/master/debian-install....

https://archlinuxarm.org/platforms/armv7/rockchip/asus-chrom...

The main thing I haven't gotten working yet is the touchpad. For wifi, I'm using an atheros dongle with open firmware.

The gallium os guys have everything working perfectly on my asus chromebook.

Yes, but gallium doesn't support arm [1]

[1] https://wiki.galliumos.org/Support/ARM

See https://johnlewis.ie/custom-chromebook-firmware/rom-download...

Doesn't work for every Chromebook, but it does for many. Working fine on my Chrome Box.

I already had flashed libreboot onto the device. That wasn't hard. The problem was and is mainline Linux support.

Ahh. Maybe this? https://github.com/altreact/archbk

Thanks for the link. The C201 is listed as work-in-progress.

> "Still, there are numerous reports that the Facebook app on your phone listens to every word you say".

> "(Typing this, very gratefully, from an ARM Chromebook.)"

Have you installed a non-stock OS on that Chromebook? Google aren't exactly known for being strong advocates of user privacy.

The most basic analysis will show that Facebook isn't listening to everything you say, even just at the level of realising that either doing speech recognition of everything you say or uploading an audio stream would be both impractical and easily detected by anyone with the inclination.