Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious flaws in the way Samsung phones encrypt key material in TrustZone

twitter.com

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#41

Post by Gigachad »

account-5 wrote: post #16
rapnie wrote: post #7

Earlier quoted context omitted.

It gives me the impression that, even though I paid good money on it, Samsung doesn't see me as owner and will leech as much private data off me as they possibly can.

This is my impression as an unhappy Samsung smart TV owner, despite being a happy owner of an older Samsung "dumb" TV; the reason I bought their crappy smart TV.

Happy owner of a modern Samsung vacuum cleaner, very unhappy owner of a Samsung smart TV.

Samsung makes perfectly good hardware. They just destroy it with their software.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#42

Post by octoberfranklin »

fulafel wrote: post #35
octoberfranklin wrote: post #23

Earlier quoted context omitted.

I have some bad news for you: that's possible with just about every computer introduced since 2013. Google "Intel Management Engine" or "AMD PSP" or "ARM TrustZone". The last of these could, in theory, be less bad, except no ARM licensee except Rockchip (and maybe Apple -- jury is still out there) has chosen the "be less bad" option.

On a phone it's in active use, on your x86 device it's up to you.

No, it is most definitely not up to you. That's the problem.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#45

Post by dhx »

qiqitori wrote: post #6

I personally don't like how it's possible to store data on my device without me being able to access the data. Also most of the time these keys are used for DRM. So... good IMO.

A particular example of why it's bad that you can't access all the data on your own device is the inability to audit security critical code. As a user, the only security guarantee you get is "trust us we are Vendor123" which means nothing.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#47

Post by hultner »

smnrchrds wrote: post #28
hultner wrote: post #20

Earlier quoted context omitted.

I have two new LG TVs, never connected them to the internet. I do all my media consumption via a ATV and rpi

My new Sony TV wouldn't allow me to do anything without connecting it to the internet during initial setup. I just wanted to use it as a dumb screen to show HDMI signal. But even that wouldn't work without initially connecting it to the internet. I haven't connected it to the internet since and so far it hasn't stopped working, but I wouldn't be too surprised if it does as some point and forces me to reconnect and up…

I wanted to do a firmware update over usb but LG requires NTFS for it to work so I gave up.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#48

Post by dwattttt »

d-gearloose wrote: post #29
ZiiS wrote: post #15

Earlier quoted context omitted.

The user positive use is securely booting to a password prompt to decrypt your data. Without this security working, anyone who steals your phone will be able to get all the data you have saved on it.

That's kind of the thing with Microsoft's bitlocker as well. It automatically decrypts the hard drive on boot, so the only thing it could protect you from is someone removing the hard drive and mounting it somewhere else. But if they have physical access to the device, why would they do that?

That's the default configuration for bitlocker, but there are others, including requiring a password or key provided by USB on startup

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#49

Post by orhmeh09 »

scim-knox-twox wrote: post #18
account-5 wrote: post #16

Earlier quoted context omitted.

This is my impression as an unhappy Samsung smart TV owner, despite being a happy owner of an older Samsung "dumb" TV; the reason I bought their crappy smart TV.

LG does the same. I bought good OLED and still, I had to connect pihole to block ads... New LG's are even worse. I don't know what I do if my current TV will stop working. I want only display, I don't want any additional features (ads, personalization etc.).

Is there a computer monitor that would satisfy your needs? That would spare you the ads. I use a 32” monitor that I found too big for computing as a TV (with external speakers and roku).
Post reply on HN