Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#191

Post by ghostpepper »

hutzlibu wrote: post #32
jl6 wrote: post #11

I don’t have ultimate trust in any software or hardware, but I get to “good enough” by deciding which providers I trust: * Software: Canonical, Google, Microsoft, Valve, Oracle, Dropbox. I install software from their official repos and keep it up to date. Anything 3rd-party/unofficial/experimental/GitHub goes in a VM. * Hardware: I built my main PC from mainstream commodity components. I have no way of knowing if the…

"which providers I trust: * Software: Google, Microsoft" I trust that Google and Microsoft won't hack into my bank account and steal money, even though they could, but otherwise I assume they collect anything they want and can.

Security and privacy are two separate things and not always aligned.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#192

Post by flanked-evergl »

lrvick wrote: post #159
ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

IMO we have to step back and be honest that the Linux kernel is simply not equipped to run trusted code and untrusted code in the same memory. New bugs are found every few weeks. If history is of any guide Android and ChromiumOS likely still have many critical bugs the public does not know about yet. Sadly the only choice is to burn extra ram to give every security context a dedicated kernel and virtual machine. Hype…

> Linux kernel is simply not equipped to run trusted code and untrusted code in the same memory.

Just for interest sake, is Linux better or worse than MacOS, iOS and Windows at this?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#193

Post by jacooper »

rmkrmk wrote: post #163

Are there any somewhat easy-to-use solutions to isolate a development environment? Preventing or at least decreasing the damage malicious packages could do? Like deleting files or uploading a private ssh key/keychain to a 3rd party server? I was looking into things like GitHub Codespaces, I believe they're isolated per repository and integrated into VS Code, but I'd like something I could run on my machine or a serve…

Docker containers?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#194

Post by Spooky23 »

friendlyHornet wrote: post #126
anonym29 wrote: post #120

I assume it is, per Intel ME / AMD PSP's ability to read everything - memory, CPU registers, disk, inspect all network traffic, directly utilize onboard GbE for bidirectional communication. For adversaries below the level of the US intelligence agencies, I run everything virtualized and compartmentalized with Qubes, the installation image for which I verified the dev-provided cryptographic signature matches. I try to…

> refuse to connect directly websites protected by cloudflare What do you do in case you want to use a website protected by cloudflare?

Since this is a ridiculous troll, so generally speaking the only way to address this to visit the site from a local library, then immolate the computer with thermite and explode the remainder with TNT.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#195

Post by ylk »

Dma54rhs wrote: post #155
zython wrote: post #147

Earlier quoted context omitted.

What is your opinion on ios Lockdown mode ?

You cant verify but just take Apples word for it, it's not a fair comparison in my opinion.

What do you want to verify exactly? Do you think Apple is lying about what lockdown mode does? Why would they do that? Could you at least say what your opinion is based on?

But it is possible to verify what it does, the same way you would for an android phone (I.e. not just look at the source code and hope that it matches what’s running on your device). https://youtu.be/8mQAYeozl5I At 26:42 he talks about lockdown mode. Would be a bit weird if he lied about the impact lockdown mode has.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#196

Post by solarpunk »

tete wrote: post #170
ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

> Android and ChromiumOS are likely the most trustable computing platforms out there I talked to a security researcher specializing on Android at a conference and he didn't sound like he'd agree. While I personally think ChromiumOS does a good job, I think a huge problem is that the issue is in how liberally complexity is added. And complexity is typically where security issues lurk. This has been seen again and agai…

This page has stuck with me since I read it regarding openbsd. It's a bit mean spirited, but I think openbsd mostly benefits from its own obscurity. https://isopenbsdsecu.re/

But the nice parts of ChromeOS, as far as security properties go are the way it can be "power washed" between usages. Along with a desktop Linux system that has less binaries installed at it's base than most. And things that are built in are typically built atop chrome's sandbox.

I used to joke with my friends who ran TAILS Linux that my grandma with her Chromebook had the same threat model.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#198

Post by javajosh »

LinuxBender wrote: post #133

My TL;DR Summary With time I have moved further and further away from using the computer for important things and believe that tech has long since exceeded George Orwell's wildest fever dreams I assume a freshly installed OS is compromised [1] and the hardware it is on is also compromised in the BIOS and firmware at very least by state actors but then I also assume those state actors have poorly vetted contractors th…

>ECHELON AI is yawning

Well, presumably it would stop yawning if you were, like, part of an armed rebellion. The perspective I'd like to hear would be the Ukranian civil and military resistance to Russia's invasion. How do they know their systems aren't compromised? Because, yeah, in their case, being compromised means getting killed.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#199

Post by 2000UltraDeluxe »

jl6 wrote: post #61
BLKNSLVR wrote: post #38

Earlier quoted context omitted.

I have a backup NAS that's normally powered off, but it's scheduled to turn on, perform backup, shut down. It doesn't wake on LAN and there should be no way of knowing it exists outside of checking DHCP static addresses reservations - and now that I mention it, maybe I should remove it from there too. This minimises the size of the window, and network-snoopable information, required to compromise this set of backups.

If your main computer has had all its files encrypted by ransomware, will the backup NAS know not to replace the good backup with a bad one? i.e. hopefully it's not doing something like `rsync --delete`.

Not the GP but I use ZFS snapshots for such things. Should the files be overwritten or deleted I can always fetch an older copy from snapshots.

The trick is to make sure nothing has access to the backup storage, which is obviously easier said than done.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#200

Post by Marc_Bryan »

throwawayprank wrote: post #88
KineticLensman wrote: post #51

Earlier quoted context omitted.

> Do you lock your computer every time you leave your desk? This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.

> unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't. Same here. The all time favorite is sending a resignation notice to the person's manager (the manager usually gets a fair warning first and plays along with it).

Yep. I've sent a party mail and free lunch or snacks sponsor to the team. Have got them a couple of times as well. A lesson well learned...
Post reply on HN