Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#141

Post by tete »

breck wrote: post #77

"Assume breach" was the phrase they taught us at Microsoft (at least in 2016). I assume everything is compromised. So I make public and distribute/decentralize as much as possible. I #BuildInPublic as much as possible on GitHub and GitLab and dedicate everything to public domain ( http://pledge.pub/ ). I have a number of computers and can be up and running on a new Macbook in under an hour. I run multiple mirrored we…

> "Assume breach" was the phrase they taught us at Microsoft (at least in 2016)

security(7) man pages on FreeBSD and DragonFly, I think originally written by Matt Dillon also tells you to assume breach for example for the root password, which is why you shouldn't allow password based logins over SSH, etc.

This is the earliest I could find, and it already contains assuming breach in 1998.

https://github.com/freebsd/freebsd-src/commit/f063d76ae36ca4...

Does anyone have an idea on how to see the file and its history from where it was moved? I checked 4.4 BSD, because the copyright mentions Berkley, bit I failed to find anything in the man1 directory.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#142

Post by bo1024 »

andai wrote: post #121
ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

> it seems it is most further ahead of the mainstream OSes Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reversed in the last few years, or was it never true?

Maybe you're thinking of privacy, not security?

In terms of privacy, Android is "compromised" by default, i.e. Google collects and stores a ton of private information about you. I believe Apple used to be much better, and still is, but getting worse.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#143

Post by Consultant32452 »

gkbrk wrote: post #137
lrem wrote: post #132

Earlier quoted context omitted.

Isn’t most of the value here in not allowing sideloading? In iOS your grandma/child cannot be tricked into clicking “allow apps from untrusted sources”, which is how most breaches happen.

If the apps sandboxed, how can installing an app cause breaches? As far as I know, iOS apps are sandboxed. Either the sandbox is very weak and Apple instead relies on App Store audits, or they disallow users installing apps outside the app store to protect their 30% tax that makes them a LOT of money.

The sandboxes are regularly breached. Basically any time you hear about people "rooting" their phones, that's an intentional sandbox breach.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#144

Post by etna_ramequin »

From a more security security research point-of-view, the paper “Bootstrapping Trust in Commodity Computers”[1] is a very good overview. Although it would necessitate a bit of an update for more recent developments with e.g. dm-verity etc.

[1] PDF: https://www.andrew.cmu.edu/user/bparno/papers/bootstrapping-...

Re: Ask HN: How do you trust that your personal machine is not compromised?

#145

Post by pixxel »

ttctciyf wrote: post #56
gnfargbl wrote: post #9

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-... . It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock s…

> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additiona…

I’ve no doubt you are referring to uBlock Origin but it’s real important to label it as such so the unaware don’t install uBlock.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#146

Post by lrvick »

I run QubesOS which compartmentalizes your usb ports, network card, and all your various application workflows into separate virtual machines. It is literally designed to protect you even if part of your system is compromised.

https://www.qubes-os.org/intro/

For details on how I use Qubes specifically see: https://github.com/hashbang/book/blob/master/content/docs/se...

Re: Ask HN: How do you trust that your personal machine is not compromised?

#147

Post by zython »

ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

What is your opinion on ios Lockdown mode ?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#148

Post by lrem »

gkbrk wrote: post #137
lrem wrote: post #132

Earlier quoted context omitted.

Isn’t most of the value here in not allowing sideloading? In iOS your grandma/child cannot be tricked into clicking “allow apps from untrusted sources”, which is how most breaches happen.

If the apps sandboxed, how can installing an app cause breaches? As far as I know, iOS apps are sandboxed. Either the sandbox is very weak and Apple instead relies on App Store audits, or they disallow users installing apps outside the app store to protect their 30% tax that makes them a LOT of money.

When you’re tricked into installing a nasty app, you’re likely also tricked into giving it whatever permissions it needs for the nastiness.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#149

Post by SargeDebian »

hotpotamus wrote: post #87
thr717272 wrote: post #64

Earlier quoted context omitted.

Lock my computer: Always[1][2]. Check for keylogger thumbdrives: I use a laptop so it would be immediately obvious. But now that you say it I haven't checked the charger USB-outlet on the back of my cabled keyboard. [1]: it has happened I have failed. Once a year or something. [2]: I sometimes try to allow myself to go downstairs in my own house to fetch a cup coffe without locking when I am alone, but I find it so s…

I've worked in places where that once a year slip-up would mean you sent an email offering to buy lunch for the team or get your background changed to a David Hasselhoff pinup picture from the 80's. I do feel weird locking my computer when I'm alone though.

Screenshot of the desktop, rotate that 180 degrees and set as background. Hide all icons and the taskbar, then rotate the whole screen 180 degrees. Maybe a bit of tape underneath the optical mouse.
Post reply on HN