[saagarjha]

I don't think this is a useful model to have, because it's too simple and not actionable. Who is compromising you? What is their cost to doing so? What level of compromise can they achieve? If you just go "you are always hacked" what is your suggestion? That I never touch a computer ever again?

[dmbche]

That you treat the computer as compromised.

You need to calculate something? Great, do that.

You need to encrypt files, and keep them on your device which is connected to the internet, and want to trust that you are the only person that can access them? Think twice. Can be considered trivial for many attackers to have full access to your device, and assume ring 0 access. They could realistically record all keypresses and your screen, no need to decrypt anything.

Need to hide things from state actors? Never touch a computer again and go live in a cave somewhere until they find you.

[SirHumphrey]

> Need to hide things from state actors? Never touch a computer again and go live in a cave somewhere until they find you.

I always found this kind of thinking to be a bit unhelpful. Because what is an alternative? Paper? Hope you don't live in jurisdiction of the country because search warrant is not a difficult thing to get and even an illegal search is not that hard (even outside of the country).

As with everything - people in IT and IT security vastly underestimate the security of IT infrastructure while overestimating the security of non-IT infrastructure. IMO the use of computers makes you much more vulnerable to broad "we monitor the members public for signs of terrorism" kind of spying, rather than specific targeted state actor attacks - as was shown recently with the whole pager fiasco - there are many others non IT vulnerabilities around.

[dmbche]

It might have not been that clear, but the "until they find you" in my original comment is worded that way because it's a question of time rather than probability - they're gonna get you. You can try to make it harder (going in a cave, not touching computers) but, realistically, you're getting caught - if not through IT, through things like the pager attack.

Most people are not worried about state actors having an interest in them, my comment was aiming to clarify that as well.

[impossiblefork]

It is actionable. It means you don't use the phone for anything important-- effectively, that you accept that it is useless and that you should use other means of communication.