How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/
Didn't know about this. They should have gone with AMD.
AMD has it too: https://libreboot.org/faq/#amdpsp
ORWL – The first open source, physically secure computer
21–30 of 195 posts
Re: ORWL – The first open source, physically secure computer
#22How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/
Didn't know about this. They should have gone with AMD.
If you want to get away from that kind of thing, right now I think you're options are POWER8: https://www.raptorengineering.com/TALOS/prerelease.php
AMD has something similar to the Intel Management Engine: https://libreboot.org/faq/#amd
Re: ORWL – The first open source, physically secure computer
#23Earlier quoted context omitted.
Unless you also want to perform the AES operations in your head, you have to rely on the hardware and software of your computer to perform them. An attacker could then replace the AES routine you use with one that stores a shadow copy of your key, or exfiltrates it over some covert channel.
What if the crypto side of things is remove-able and carry-able on your person? Or what if it could be subdermally implanted so you know no one can pick pocket you and replace it? Just a thought.
> What if the crypto side of things is remove-able and carry-able on your person?
You might as well have the entire computer removable and portable.
Re: ORWL – The first open source, physically secure computer
#24Appreciate the fully secure boot process, even if the Intel situation isn't fully secure. Wish I had an external uC with burned-in firmware on my machine that I trusted to verify my BIOS firmware and orchestrate the boot process.
Re: ORWL – The first open source, physically secure computer
#25Re: ORWL – The first open source, physically secure computer
#26"When tampering is detected, ORWL immediately and irrevocably erases all your data" IMHO that is beyond stupid, it's criminally irresponsible. Well, to be fair, perhaps there are some uses cases, just not many. I'd rather go with tamper-proof seals instead.
how is it "criminally" irresponsible on a personal computer? I should be able to delete my own data whenever i want to, unless ordered by a court not to. Also OpenBSD has had the ability to wipe the system on failed password attempts for many years now.
Re: ORWL – The first open source, physically secure computer
#27> If someone has physical access to your computer with secure documents present, it’s game over! Err, why? Is AES encryption not sufficient? And the key is secure in my head - not something someone could steal. So, why is this even a thing?
The key isn't in your head: you know the passphrase used to decrypt the key which is then kept in system memory. Techniques like the cold boot attack[0] or row hammer[1] can be used to retrieve the key and access your data. In the case of non-hardware-TPM secured encryption schemes the kernel or bootloader which must remain unencrypted for the system to boot can be backdoored to record the passphrase and/or the key.…
There is a section at the end of the page outlining mitigation techniques against these sorts of attacks. I'm not knowledgable enough to determine if these are sufficient measures but I just wanted to point it out since it sounds like you didn't see that.
They specifically cover cold boot attacks for example.
Re: ORWL – The first open source, physically secure computer
#28This doesn't seem all that secure. Against an Evil Maid attack, your best mitigation is to be able to keep everything, OS and all, on a portable drive which is self-encrypting; essentially an encrypted PE.
Why not? Seems secure against evil maid to me (barring hardware backdoors like Intel).
Re: ORWL – The first open source, physically secure computer
#29How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/
FTA:
This project is about having a standard, physically secure computer that anyone can use – as open as we can make it. All these concepts are important, and they mean that x86 and flawless out-of-the-box Windows support are not optional. There are reasons everyone is using x86, even in the security community and in governmental agencies around the world: compatibility, performance, and security. Make no mistake, some of us own Yeeloongs, and others are veterans of the silicon industry. We would love to ship a completely free and usable desktop processor, but we know very well that there is no alternative. Some people seem to think that switching to AMD can solve problems related Intel’s Management Engine (ME), microcode, or SMM. It doesn’t, as there are equivalents of these technologies in all recent x86 processors.
Re: ORWL – The first open source, physically secure computer
#30"When tampering is detected, ORWL immediately and irrevocably erases all your data" IMHO that is beyond stupid, it's criminally irresponsible. Well, to be fair, perhaps there are some uses cases, just not many. I'd rather go with tamper-proof seals instead.
how is it "criminally" irresponsible on a personal computer? I should be able to delete my own data whenever i want to, unless ordered by a court not to. Also OpenBSD has had the ability to wipe the system on failed password attempts for many years now.
It's criminally irresponsible to sell such a computer, because it will easily result in data loss and not all users are educated enough to understand the consequences of such a flawed "security" design. Of course, you can claim that it's ultimately the customers fault in this case, and I agree, but they should nevertheless expect some lawsuits.
There is always a tradeoff between security and data integrity, something which the people who downvoted my post apparently don't understand. When even your mom can mount a 100% successful denial of service attack with a screwdriver, then you're screwed.
If you disagree, I challenge you to show me a use reasonable case that couldn't also be solved by actual physical security or by locking down booting and the BIOS and using tamper-evident seals.