Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel Security True Key

intel.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Intel Security True Key

#61

Post by twr »

benchaney wrote: post #57
akerl_ wrote: post #56

Earlier quoted context omitted.

I wouldn't consider "running an update where it pulls new code" to be "phoning home", any more than my car is "phoning home" when I drive it to the dealership for repairs. The implication the comment I was replying to gave was that the device sent unexpected network traffic back to Intel HQ, with the connotation that it was doing so to leak information about my system.

"Running an update where it pulls new code" is definitely an example of phoning home, and it opens the door to all sorts of vulnerabilities, such as the one featured in the Apple vs the FBI case.

Intel microcode updates on Linux are provided through regular distribution repositories. There is no phoning home feature.

Re: Intel Security True Key

#62

Post by Sephr »

comboy wrote: post #48
micheljones wrote: post #45

Earlier quoted context omitted.

ME does have ability to do that, tho.

Do you think you could fit drivers for all common ethernet/wifi cards in there and proper TCP/IP implementation? It's below assembly abstraction level.

Intel ME has independent NIC access and usually cannot be disabled by the user.

It has only been six days since it has become possible to neutralize the ME firmware for Sandy Bridge and Ivy Bridge[1].

[1]: https://news.ycombinator.com/item?id=13056997

Re: Intel Security True Key

#63

Post by chei0iaV »

IshKebab wrote: post #53
45h34jh53k4j wrote: post #29

Earlier quoted context omitted.

Dear IshKebab, We at startup xyz take security seriously. We regret to inform you that on the night of 1st December 2016 our database was compromised. The database contained your name, address and fingerprint data. Please see a plastic surgeon about resetting your fingerprints at as soon as possible. Thank you, Startup Xyz

Obviously fingerprints can't be used in that situation, buy think about something like your front door lock. You don't need paranoia-level security (you probably have breakable windows anyway) but you want to stop random people who aren't motivated enough to steal your fingerprint from walking in. Or think about locking your phone. Most people only want to stop their friends and family - they're not going to copy you…

There's a little bit of a difference between breaking a window (noise, glass everywhere), and discretely walking in through your front door and out with your jewellery.

Re: Intel Security True Key

#64

Post by benchaney »

twr wrote: post #61
benchaney wrote: post #57

Earlier quoted context omitted.

"Running an update where it pulls new code" is definitely an example of phoning home, and it opens the door to all sorts of vulnerabilities, such as the one featured in the Apple vs the FBI case.

Intel microcode updates on Linux are provided through regular distribution repositories. There is no phoning home feature.

Do they get updated when you run the package manager, or do they update automatically?

Re: Intel Security True Key

#65

Post by akerl_ »

benchaney wrote: post #64
twr wrote: post #61

Earlier quoted context omitted.

Intel microcode updates on Linux are provided through regular distribution repositories. There is no phoning home feature.

Do they get updated when you run the package manager, or do they update automatically?

Either via the package manager or via the user manually downloading and loading the microcode update of their choosing. For example: http://askubuntu.com/questions/545925/how-to-update-intel-mi...

Re: Intel Security True Key

#66

Post by twr »

benchaney wrote: post #64
twr wrote: post #61

Earlier quoted context omitted.

Intel microcode updates on Linux are provided through regular distribution repositories. There is no phoning home feature.

Do they get updated when you run the package manager, or do they update automatically?

Binary packaging systems download microcode.dat (a text blob containing microcode) from Intel during the build process. Microcode.dat gets converted into an initramfs image that supplies the new microcode early in the system boot. Users download the built binary package, which then modifies the boot parameters of their system.

So normally only the build servers contact Intel. Source-based distributions may. But even then the source files are verified with cryptographic hashes (which are in turn signed by the maintainers' private keys).

Edit: I may have misread your question. I thought you were asking by implication if the microcode blob is pulled after the install. If not, then: No. Updates happen when the package manager decides.

https://www.kernel.org/doc/Documentation/x86/early-microcode...

https://gitlab.com/iucode-tool/iucode-tool

https://downloadcenter.intel.com/download/26400/Linux-Proces...

Re: Intel Security True Key

#67

Post by [deleted] »

benchaney wrote: post #51
temptel wrote: post #43

Earlier quoted context omitted.

You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

How could it possibly patch bugs without phoning home? Are you claiming that it is self modifying code?

[deleted]

Re: Intel Security True Key

#69

Post by watersb »

IshKebab wrote: post #53
45h34jh53k4j wrote: post #29

Earlier quoted context omitted.

Dear IshKebab, We at startup xyz take security seriously. We regret to inform you that on the night of 1st December 2016 our database was compromised. The database contained your name, address and fingerprint data. Please see a plastic surgeon about resetting your fingerprints at as soon as possible. Thank you, Startup Xyz

Obviously fingerprints can't be used in that situation, buy think about something like your front door lock. You don't need paranoia-level security (you probably have breakable windows anyway) but you want to stop random people who aren't motivated enough to steal your fingerprint from walking in. Or think about locking your phone. Most people only want to stop their friends and family - they're not going to copy you…

I don't understand the qualifier "in that situation": the user cannot determine what the "situation" may be at some point in the future.

I do use the fingerprint reader on my iPhone, and I believe that the fingerprint data is never sent to another device. Ever.

There are real problems to using the iPhone fingerprint with apps, in that the apps tells me it needs to store an encrypted version of my password on iCloud in order to enable fingerprint unlock. The Bad Guys could get my encrypted password and I might never know.

But I wouldn't have to change my fingerprint in that case.

Re: Intel Security True Key

#70

Post by wolrah »

Seylerius wrote: post #16

This is an adorably bad idea: + As fdik said above, you can't change your fingerprint or face easily, and it's always public + Face recognition and fingerprint scanning are not robust against spoofing — there are known ways to circumvent both + You can be compelled to authenticate a biometric without a warrant Don't use biometrics as a password; use them as a username.

Biometrics are in a really weird place as far as security goes.

For the average person who's more concerned about opportunistic theft of a device than a targeted attack I'd argue that biometrics are more secure because you can't have the equivalent of a shitty password. There is no fingerprint equivalent of "1111" as your device PIN. A random pickpocket in the subway doesn't know who you are and thus can't implement any spoofs.

For anyone trying to defend against an attacker specifically targeting them, you're completely right.

Post reply on HN