Waiting for HackGPT to become a thing, so I can use it as a pentester.
Any ways in which AI can already help?
Ask HN: How do you trust that your personal machine is not compromised?
101–110 of 469 posts
Re: Ask HN: How do you trust that your personal machine is not compromised?
#102Earlier quoted context omitted.
Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?
Lock my computer: Always[1][2]. Check for keylogger thumbdrives: I use a laptop so it would be immediately obvious. But now that you say it I haven't checked the charger USB-outlet on the back of my cabled keyboard. [1]: it has happened I have failed. Once a year or something. [2]: I sometimes try to allow myself to go downstairs in my own house to fetch a cup coffe without locking when I am alone, but I find it so s…
What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments.
For example IT enforces that your screen becomes locked after 15 minutes of inactivity and also ties in your local computer 's user login password to your SSO login to access everything. It's a contradiction around password best practices. If you force people to input their password multiple times a day then naturally people will gravitate towards easier to type passwords.
If the idea is "but what if you go AFK in a public place and forget to lock your screen?!?", that's not a valid reason. If you were working in a coffee shop and went to use the restroom for 4 minutes or turned your back for 2 minutes then your machine could be compromised (or even worse stolen). It's extremely reckless to leave your gear unattended in a public place.
It can really break morale to input your password and MFA half a dozen times a day, especially when you're alone in a locked apartment where the laptop hasn't left that location in a year.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#103I use adblock to prevent (malicious) ads from running. Browser malicious downloads warnings are enabled. Configured to show a full screen warning if http is used instead of https. Opening links from email requires manually copy pasting, forcing an extra look at links.
Generally I don't install random software outside the official repos or AUR, but I do blindly trust those repos to not be compromised.
That being said, I don't think I could 100% trust a modern computing device to not be compromised, but since that isn't possible I also don't see it as actionable information.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#104Earlier quoted context omitted.
Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.
> Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik I was thinking about getting a Ubiquity router because it has good support for setting up wired VLANs without needing to go down the path of finding a solid OpenWrt router. Is it really true that you can't access the router's dashboard and configure things without associating an online account to your router?
No
Re: Ask HN: How do you trust that your personal machine is not compromised?
#105Bios? I'm not sure I can ever be certain. For the rest, I run a pretty esoteric setup (compiled-from-source custom configured linux kernel with no binary blobs; all software compiled from source, with no exceptions; aggressive, burdonsome-to-me privilege separation; chroots and VMs for various degrees of potential threat; etc). I have no illusions that it is perfectly safe. What I am comfortable with is that, in orde…
QubesOS may be less cumbersome if it works for your use case.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#106Never allow a company or government to install known and unknown software that spies on you. This means Microsoft, Google, Facebook, Apple, etc.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#107Run Linux. Install only trusted software. Don’t do sketchy (from a security perspective) things like look at porn or use torrent sites on your main computer. Backup often. Reinstall OS annually. Don’t run Windows. Don’t worry too much. Be happy.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#108Earlier quoted context omitted.
Would be interested in hearing other things that HN'ers do to limit risk. Mostly the same basics as you. The document you linked is a good starting point. I'd add extensive use of virtualisation and sandboxing. I run less and less software as native, installed applications on any device I use personally or professionally. Instead it tends to run inside things like VMs or Docker containers or cloud-hosted platforms no…
100% with you on the entirety of your last paragraph. I generally use a device as an access mechanism; a configured window into the data. This configuration is the only thing lost when a device is lost. No data, no function, no service. Configure the replacement device and continue as you were. Virtualisation and Docker-isation makes backups and restores almost enjoyable.
How do you deal with leaking of data?
Re: Ask HN: How do you trust that your personal machine is not compromised?
#109Can You Trust Your Computer?
https://www.gnu.org/philosophy/can-you-trust.en.html
Eben Moglen: The alternate net we need, and how we can build it ourselves:
Re: Ask HN: How do you trust that your personal machine is not compromised?
#110I have several layers of security, including an infosec mindset that comes naturally, but at the end of the day I don't really know. I have faith that if I were to be infected statistically it would be by some malware that would give itself away by mining crypto or doing something else very loud and disruptive. Fun story but my laptop was actually hacked remotely once, without me knowing. It was almost 20 years ago,…
> This thread has inspired me to setup a tripwire for my workstation. It's something I used to use many years ago but I think it's a good setup to have some sort of alerting if files start changing. Can you explain what you setup?
I'm looking at current options, this[1] for example is packaged for Fedora, which is my daily driver.
But then I got to thinking, if I'm going to do a clean Fedora install for the tripwire (it's best practice) I might as well try Fedora Silverblue[2]. Silverblue is an immutable system so it kinda makes a tripwire less useful because no one can change any system files. Only files in your home directory and /etc can be modified statefully.