101–110 of 195 posts
Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.
This is fairly straightforward with udev, a couple lines of config should be sufficient.
Earlier quoted context omitted.
Speculation: It's possible to produce keyboard and mouse inputs, and also present as a storage device -- autorun isn't even necessary (though spurious inputs would be quite visible to somebody using the computer and something like a mirrored mouse, custom keyboard layout / shortcuts could foil this)
That would only work on a known operating system and window manager with known keyboard shortcuts, unless a terminal is already focused.
I type the above SO often every day, it should be on my gravestone. :D
Earlier quoted context omitted.
In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum…
That's a bit scary. 'Detect crime' could be pure speculation on the polices' part.
"We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."
Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
> Interesting project, I'm sure this is useful for people at risk. Could you expound on what this means? In the USA/UK, people most "at risk" of police kicking down the door seizing their laptops/computers while they are still running are child pornographers. Perhaps this can be used "for good" under oppressive regimes (i.e. if you are a dissenting journalist) but then I think you won't get a fair trial anyway and ha…
Earlier quoted context omitted.
Back in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected. ... I don’t know of anyone actually implementing this though :)
I would imagine that's thermite and not termite ;) If the latter, the server would probably be okay, and it would take a very long time for the termites to damage the surrounding room enough to be a security deterrent.
Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
I have a Lenovo M93P Tiny which came with a chassis intrusion switch installed. It seems you can have it block startup/require a password when the case is opened and notify some central admin. I don’t know what happens if you open the case while it’s running, though. I’m not sure if it’s something they offer on current models, or to individuals at all (I bought it used from a corporate IT asset liquidator so it was l…
Earlier quoted context omitted.
Many of the measures that provide effective physical security also make a device really unsuited for personal usage. Look at HSMs for an example of this. And even they rely on being stored in a physically secure room and protected from theft. It's a matter of being more determined than your attacker. Imagine a device that will irretrievably brick itself if tilted more than a certain angle, if left unpowered for more…
Personal computers have an advantage here: it is acceptable for them not to work when they are not directly used by someone. It means they can be stored in safes when not used and have all the encryption keys securely erased when not used. For example, a screen locker could stop all the processes and erase all the keys from registers and memory assuming both disk and memory encryption. And the locker itself could be…
Putting a regular device in a safe leaves it exposed to someone unlocking the safe and compromising the device by implanting a keylogger inside or even by putting a replacement identical device there and waiting for the user to type the boot password.
As for methods of emergency clearing sensitive data from memory while in operation, whatever method is employed will work once. The next time the attacker is ready for that particular method. For example the police might just have to completely immobilize the suspect (and their hands) and keep the laptop in the vicinity while the "dead man's switch" is bypassed.