Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#211

Post by aio2 »

ghostpepper wrote: post #164
lrvick wrote: post #162

Earlier quoted context omitted.

iOS is a proprietary OS making security research unreasonably difficult with new setbacks on every new version. It can only be regarded as reasonably private and secure if you trust the Apple marketing team.

My understanding is that Apple has gotten a lot better about this with their bug bounty payouts and providing debug hardware to researchers, and it’s not like there’s not a ton of proprietary code running on most consumer android devices. I would also assume the fact that their vertical integration all the way down to silicon is an advantage here as well.

What @Irvick is talking about is the fact that you have more freedom to test the security in an Android than in iOS, such as being able to flash other systems.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#212

Post by ahelwer »

ghostpepper wrote: post #59
gnfargbl wrote: post #9

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-... . It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock s…

Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.

I bought a Turris Omnia used on ebay for about a hundred bucks. Very powerful, open source hardware & software, good community, adblock server built in if you're too lazy to set up a pihole, enough compute power to host lots of neat services on it.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#213

Post by Godel_unicode »

ghostpepper wrote: post #164
lrvick wrote: post #162

Earlier quoted context omitted.

iOS is a proprietary OS making security research unreasonably difficult with new setbacks on every new version. It can only be regarded as reasonably private and secure if you trust the Apple marketing team.

My understanding is that Apple has gotten a lot better about this with their bug bounty payouts and providing debug hardware to researchers, and it’s not like there’s not a ton of proprietary code running on most consumer android devices. I would also assume the fact that their vertical integration all the way down to silicon is an advantage here as well.

Better, sure. A lot better? Definitely not.

The bug bounty is pretty hard to actually get access to, there’s still no source outside of the kernel, and the Security Research Devices are really hard to get access to. You have to be someone they’ve heard of, in a country they approve of, you can’t move the device around, and you have to sign your life away to get it for 12* months.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#214

Post by abirch »

lrem wrote: post #132
andai wrote: post #121

Earlier quoted context omitted.

> it seems it is most further ahead of the mainstream OSes Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reversed in the last few years, or was it never true?

Isn’t most of the value here in not allowing sideloading? In iOS your grandma/child cannot be tricked into clicking “allow apps from untrusted sources”, which is how most breaches happen.

I think Apple will have to allow different stores in Europe soon. It'll be interesting to see what happens.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#215

Post by Grim-444 »

pontilanda wrote: post #167
ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

All that looks good on paper, but a lot of apps require full disk access and can easily run in the background, so how "trustable" can that really be in practice? With iOS at least I know that apps really are sandboxed and cannot access anything unless I grant permission. No app can ever attempt to access my photos unless I explicitly pick a photo or grant partial/total access. Even then it's read-only or "write with…

Well both of your complaints were already addressed. Android introduced the scoped storage system to remove and fix abuse of "full" disk access, and they also added the foreground notification system which forces a system notification to be displayed if any app is doing work in the background, so that you know about.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#216

Post by KineticLensman »

throwawayprank wrote: post #88
KineticLensman wrote: post #51

Earlier quoted context omitted.

> Do you lock your computer every time you leave your desk? This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.

> unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't. Same here. The all time favorite is sending a resignation notice to the person's manager (the manager usually gets a fair warning first and plays along with it).

> is sending a resignation notice to the person's manager

Or a message that says "I love you very much"

Re: Ask HN: How do you trust that your personal machine is not compromised?

#219

Post by Godel_unicode »

ylk wrote: post #195
Dma54rhs wrote: post #155

Earlier quoted context omitted.

You cant verify but just take Apples word for it, it's not a fair comparison in my opinion.

What do you want to verify exactly? Do you think Apple is lying about what lockdown mode does? Why would they do that? Could you at least say what your opinion is based on? But it is possible to verify what it does, the same way you would for an android phone (I.e. not just look at the source code and hope that it matches what’s running on your device). https://youtu.be/8mQAYeozl5I At 26:42 he talks about lockdown mo…

What if he’s wrong? Computers do things their programmers don’t expect them to literally all the time. Security bugs generally come from a mistaken assumption about how something behaves.

He doesn’t have to be a liar to be telling you untruths about how it works.

Post reply on HN