Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#121

Post by andai »

ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

> it seems it is most further ahead of the mainstream OSes

Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reversed in the last few years, or was it never true?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#123

Post by Spooky23 »

nickjj wrote: post #95
ghostpepper wrote: post #59

Earlier quoted context omitted.

Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.

> Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik I was thinking about getting a Ubiquity router because it has good support for setting up wired VLANs without needing to go down the path of finding a solid OpenWrt router. Is it really true that you can't access the router's dashboard and configure things without associating an online account to your router?

That’s not true. You need to use the gui though. I think some folks preferred the cli in the past.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#125

Post by transpute »

andai wrote: post #121
ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

> it seems it is most further ahead of the mainstream OSes Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reversed in the last few years, or was it never true?

> Running blobs traditionally run in higher exception levels (like ARM EL2) in a restricted, mutually untrusted VM

The pKVM hypervisor is new to Android 13 and requires Pixel 7 hardware, both of which are a few months old.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#126

Post by friendlyHornet »

anonym29 wrote: post #120

I assume it is, per Intel ME / AMD PSP's ability to read everything - memory, CPU registers, disk, inspect all network traffic, directly utilize onboard GbE for bidirectional communication. For adversaries below the level of the US intelligence agencies, I run everything virtualized and compartmentalized with Qubes, the installation image for which I verified the dev-provided cryptographic signature matches. I try to…

> refuse to connect directly websites protected by cloudflare

What do you do in case you want to use a website protected by cloudflare?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#127

Post by f4c39012 »

jonstewart wrote: post #90
Alifatisk wrote: post #79

Earlier quoted context omitted.

I would wait with getting the latest Windows updates, If I don't see anything in the news after a month, that's when I update.

Would very much recommend updating Windows ASAP.

There's nothing as secure as a brick, not getting any data out of that

Re: Ask HN: How do you trust that your personal machine is not compromised?

#128

Post by shamiln »

nickjj wrote: post #95
ghostpepper wrote: post #59

Earlier quoted context omitted.

Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.

> Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik I was thinking about getting a Ubiquity router because it has good support for setting up wired VLANs without needing to go down the path of finding a solid OpenWrt router. Is it really true that you can't access the router's dashboard and configure things without associating an online account to your router?

My UDM and UDR aren’t connected to UI’s cloud services, so it’s not really cloud first.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#130

Post by [deleted] »

BLKNSLVR wrote: post #38
jl6 wrote: post #25

Earlier quoted context omitted.

On the backup question, this is one reason why I have a set of backups that are physically disconnected and not automated.

I have a backup NAS that's normally powered off, but it's scheduled to turn on, perform backup, shut down. It doesn't wake on LAN and there should be no way of knowing it exists outside of checking DHCP static addresses reservations - and now that I mention it, maybe I should remove it from there too. This minimises the size of the window, and network-snoopable information, required to compromise this set of backups.

[deleted]
Post reply on HN