Ask HN: How do you trust that your personal machine is not compromised? • Hacker News Board

Re: Ask HN: How do you trust that your personal machine is not compromised?

#441

Post by mikewarot » Mon, Jan 16, 2023, 6:59 PM UTC

TeMPOraL wrote: post #418

mikewarot wrote: post #402

Earlier quoted context omitted.

Obligatory mention of capability based security goes here. We really need a way to run untrusted code and give it just the files we want, at run-time .

Obligatory reminder of the human angle here: we need also a way for untrusted code to not be able to nag the user into granting them extra permissions.

That's not capability based security, though everyone seems to think it is. (Perhaps it's just survivor bias effecting replies?)

You never get nagged to take $5 out of your wallet to hand to an untrusted person, why should you get nagged to drop a file into an application you don't trust.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#442

Post by omniglottal » Mon, Jan 16, 2023, 7:09 PM UTC

drozycki wrote: post #317

ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

Hasn’t this all been long true for iOS as well? There are reasons to hate it, but a walled garden is safer in many ways (as long as you trust Apple). You mention baseband - Android hardware comes with max 3 years of baseband support, compared to 7-9 years on iPhone. The story is similar when it comes to stock OS support. So from my pov, iPhones can be a comparable value (security and otherwise) to the best Android ha…

Accuracy. You're missing "making accurate statements" here. And context - neither Apple's proprietary practices nor "trust" of them are applicable solutions to the problem domain here. A 7-9 year old iOS device is crippled today, with non-user-replaceable parts (both software and hardware). A 3-year-old Pixel is newer than the one I use, running sshd and accepting connections only from the bearer of my private key. The market for old iPhones drops sharply, and is just for folks with an iCloud account. The market for old Pixels allows a Pixel 6 to be sold for >$1000 less than half a year ago (with a more trustworthy third party OS installed), ready for the user to choose whether this trust model of a pre-installed OS is even sufficient.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#443

Post by TeMPOraL » Mon, Jan 16, 2023, 8:17 PM UTC

mikewarot wrote: post #441

TeMPOraL wrote: post #418

Earlier quoted context omitted.

Obligatory reminder of the human angle here: we need also a way for untrusted code to not be able to nag the user into granting them extra permissions.

That's not capability based security, though everyone seems to think it is. (Perhaps it's just survivor bias effecting replies?) You never get nagged to take $5 out of your wallet to hand to an untrusted person, why should you get nagged to drop a file into an application you don't trust.

  onSave() =>
    fh1 = GetFileWritePerm($documents + "/project.foo");
    fh2 = GetFileReadWritePerm($myFolder + "/cache.db");
    while(!fh3) {
      fh3 = GetFileReadWritePerm("/etc/passwd");
    }

Re: Ask HN: How do you trust that your personal machine is not compromised?

#444

Post by lrvick » Mon, Jan 16, 2023, 8:34 PM UTC

ElectricalUnion wrote: post #439

lrvick wrote: post #427

Earlier quoted context omitted.

I regret my poor description of seL4. It has proofs for how it functions, and how code execution is isolated, etc. That is not -every- security issue by any means but reviewing a spec is easier than reviewing code, and a small code footprint that forces things out of the kernel that do not need to be there is a major win. I hope more projects follow their lead. As for Linux, piles of companies pay for Linux kernel se…

> QubesOS is the Linux distro QubesOS is a Xen distro that happens to use Fedora by default as dom0 vm.

Xen, which uses a Linux kernel, which is therefore a distribution of Linux.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#445

Post by anonym29 » Mon, Jan 16, 2023, 9:31 PM UTC

pieter_mj wrote: post #435

anonym29 wrote: post #120

I assume it is, per Intel ME / AMD PSP's ability to read everything - memory, CPU registers, disk, inspect all network traffic, directly utilize onboard GbE for bidirectional communication. For adversaries below the level of the US intelligence agencies, I run everything virtualized and compartmentalized with Qubes, the installation image for which I verified the dev-provided cryptographic signature matches. I try to…

Did I misunderstand or do you really have a baseband hardware killswitch? That's some dedication.

Check out Purism's Librem 5. It's extremely expensive for the specs you get, but for me personally, the peace of mind is worth it.

https://puri.sm/products/librem-5/

They also have a "made in USA" version (though the case is made in China and the wifi chip is made in India). It's even more expensive, and I certainly don't trust that USG/IC hasn't attempted to backdoor this either - we know a lot of ARM processors have the TrustZone, which is very similar to ME/PSP (I believe an ARM TrustZone core is actually how PSP is implemented), but the lead time is much shorter.

https://shop.puri.sm/shop/librem-5-usa/

Note that I'm not formally endorsing them, just sharing what I use.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#446

Post by anonym29 » Mon, Jan 16, 2023, 9:32 PM UTC

hdivider wrote: post #344

anonym29 wrote: post #120

I assume it is, per Intel ME / AMD PSP's ability to read everything - memory, CPU registers, disk, inspect all network traffic, directly utilize onboard GbE for bidirectional communication. For adversaries below the level of the US intelligence agencies, I run everything virtualized and compartmentalized with Qubes, the installation image for which I verified the dev-provided cryptographic signature matches. I try to…

May I ask what necessitates this level of security? E.g. work, or personal preference in terms of security and privacy?

Personal preference + knowing how the sausage is made (red team).

Re: Ask HN: How do you trust that your personal machine is not compromised?

#447

Post by anonym29 » Mon, Jan 16, 2023, 9:33 PM UTC

milkey_mouse wrote: post #395

anonym29 wrote: post #120

I assume it is, per Intel ME / AMD PSP's ability to read everything - memory, CPU registers, disk, inspect all network traffic, directly utilize onboard GbE for bidirectional communication. For adversaries below the level of the US intelligence agencies, I run everything virtualized and compartmentalized with Qubes, the installation image for which I verified the dev-provided cryptographic signature matches. I try to…

Isn't a (non-Android) Linux phone a security downgrade unless you get Qubes running on it or something? (And secure boot, and an HSM of some sort, and...)

Yes in some ways, for sure. Unfortunately, there are not a lot of options if you want hardware baseband killswitch that doesn't kill your wifi too.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#448

Post by anonym29 » Mon, Jan 16, 2023, 9:37 PM UTC

Spooky23 wrote: post #194

friendlyHornet wrote: post #126

Earlier quoted context omitted.

> refuse to connect directly websites protected by cloudflare What do you do in case you want to use a website protected by cloudflare?

Since this is a ridiculous troll, so generally speaking the only way to address this to visit the site from a local library, then immolate the computer with thermite and explode the remainder with TNT.

Not trolling, just extremely conscientious about privacy and security, far outside cultural norms / overton window, though frankly, that's not saying much in an age where almost everyone has smart assistants all over their house, insurance companies tracking accelerometer/gyro/gps data from every drive they take, and exclusively chat on systems produced by major corporations that are logging everything indefinitely and eaglerly cooperating with law enforcement / intelligence community without even requiring warrants for data requests - almost all closed source and with a client-server architecture with no way of even auditing how much is being recorded, whether any of these companies are actually honoring their privacy policies or not, etc.

I understand that trust by default is an enormous aspect of our economy, and trust may be characterized as the single most valuable commodity, but my work involves adopting a strict zero trust mindset, and it can be difficult to turn that off after so many years.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#449

Post by lukan » Mon, Jan 16, 2023, 11:53 PM UTC

mikewarot wrote: post #441

TeMPOraL wrote: post #418

Earlier quoted context omitted.

Obligatory reminder of the human angle here: we need also a way for untrusted code to not be able to nag the user into granting them extra permissions.

That's not capability based security, though everyone seems to think it is. (Perhaps it's just survivor bias effecting replies?) You never get nagged to take $5 out of your wallet to hand to an untrusted person, why should you get nagged to drop a file into an application you don't trust.

"You never get nagged to take $5 out of your wallet to hand to an untrusted person"

I suppose, you never have been to a significantly poorer country? (outside of the protected tourist areas).

Or well, spend time with kids, who really want something.

Begging can get very intense.

And about file permissions, well - are you aware, what kind of permissions the standard free app on the google play store will ask of people? And yes, I won't use them. But I use WhatsApp. Did not wanted to give permission to read contacts, or wide file access. But denying it, means it is allmost unusable, so I also eventually gave in ..

Re: Ask HN: How do you trust that your personal machine is not compromised?

#450

Post by arcastroe » Tue, Jan 17, 2023, 12:58 AM UTC

I use Windows as my main OS. In Windows 10 and 11, there is a feature called Unified Write Filter that essentially resets your computer after every reboot.

When I first got my laptop, I installed a fresh copy of Windows 10, installed all my commonly used applications, configured all my settings, and then enabled UWF. On every reboot, it goes back to this clean snapshot, no matter what I do - And reboots are quick too (~10 seconds).

I'm never worried about making changes to my laptop to try them out (installing a new program, configuring obscure settings, etc). If I don't like it, I can get back to my clean state with a simple reboot.

Still vulnerable to BIOS-level malware though, I suppose.

(Note: I repeated most of this from a previous hackernews comment of mine)

https://news.ycombinator.com/item?id=29374928