I use 2fa where i can and accept the fact that if im not already compromised, i could be at any moment.
Thats also why 2fa is the first thing i configure after setting up a kubernetes cluster too.
Ask HN: How do you trust that your personal machine is not compromised?
311–320 of 469 posts
Re: Ask HN: How do you trust that your personal machine is not compromised?
#312Earlier quoted context omitted.
Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.
> Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik I was thinking about getting a Ubiquity router because it has good support for setting up wired VLANs without needing to go down the path of finding a solid OpenWrt router. Is it really true that you can't access the router's dashboard and configure things without associating an online account to your router?
They did add back non-cloud support a while ago after the cloud forcing didn't go over well, but it is a second-class experience.
The day after I set my UDM Pro up as non-cloud, it corrupted the login somehow and I had to factory reset it and redo all settings (as it hadn't been running long enough to run any automatic backups first). I capitulated and just set it up again as a cloud login to avoid having the same fiasco at some random point in the future again.
I immediately regretted going with the UDM to save (quite) a few bucks over a OPNsense/pfSense appliance to fit my requirement of handling a full 10G of WAN.
I will admit having the app to monitor usage remotely is a somewhat neat trick. I find the firewall configuration in GUI obtuse enough to be next to unusable.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#313ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
I can’t discuss my former role in too much detail, but it has convinced me that all the above is insufficient in a number of very realistic threat models.
One issue is that software has vulnerabilities and bugs. I’m not talking about the software that users run in sandboxes environments. I’m talking about the sandboxes environments. I’m talking about cryptography implementations. I’m talking about the firmware running in the “trusted” hardware.
The other major issue is as you alluded to: the need to trust vendors and hardware. Without protection and monitoring at the physical level, the user has no way to verify the operation of the giant stack of technology designed to “protect them”. Without the ability to verify operations, how is the user to trust anything? Why do companies tell users to “trust them” without any proof they are trustworthy?
This may seem like a minor point, but this is really the crux of the issue. Building this giant house of cards on top of a (potentially) untrustworthy hardware root of trust does not buy anyone anything. Certainly it does not buy “security”.
Large companies and nation states are the most likely adversaries one wants to be wary of these days (e.g. journalists, whistleblowers, etc.). What good does the technology do them if the supply chain is compromised or vendors are coerced to insert backdoors? These are the threats that actually face people concerned about security, not whether or not their executables are run in a sandboxed VM or not. Great, you’ve stopped the adversary from inserting malicious code into your device after purchase. Good thing for them, they did it prior to or during manufacture.
The technology you alluded to above is mainly useful for protecting company IP from end users, IMO. That’s how I’ve mainly seen it used, and the marketing of “security for the user” is a gimmick to justify the process.
EDIT: I forgot to mention this entire class of security issue since I am used to working on air gapped systems. I don’t care if you are operating in a sandboxed VM with a randomized MAC over a VPN over Tor. If you’re communicating with any other device over the Internet, you have to trust every single other machine along the way. And you shouldn’t.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#314Great question. I don't anymore. Decades ago when I had a 286 and knew what each file did and what all the software was, and threats were limited and crude, I had good confidence of controlling my machine. Today, when my laptop has millions of files and each website - even hacker news - could inject something malicious and my surface is so broad (browsers applications extensions libraries everything) and virtually an…
> how to make backups safe in age of encrypting ransom ware.
Versioned, offsite backups. For instance, if you have a database in an AWS account:
* Give the backup process write only (I.e. no delete permissions) to a GCP account.
* Create the backup in AWS and timestamp it
* Copy the backup to GCP using the above permissions.
* If you want to be more secure, copy the backup to a USBHDD (daily/weekly) and unplug it.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#315Earlier quoted context omitted.
> Android and ChromiumOS are likely the most trustable computing platforms out there I talked to a security researcher specializing on Android at a conference and he didn't sound like he'd agree. While I personally think ChromiumOS does a good job, I think a huge problem is that the issue is in how liberally complexity is added. And complexity is typically where security issues lurk. This has been seen again and agai…
This page has stuck with me since I read it regarding openbsd. It's a bit mean spirited, but I think openbsd mostly benefits from its own obscurity. https://isopenbsdsecu.re/ But the nice parts of ChromeOS, as far as security properties go are the way it can be "power washed" between usages. Along with a desktop Linux system that has less binaries installed at it's base than most. And things that are built in are typ…
No other general-purpose OS that runs on my laptop has the track record of OpenBSD: only 2 remotely exploitable security holes in the default installation since ~1996. And then the other mitigations let you control carefully what more attack surface to expose--those mitigations dramatically reduce it. I appreciate the general lack of privilege escalation 0-day exploits, as seen over time.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#316Earlier quoted context omitted.
> Everything else would seem to be a reimplementation of common best practices... True, but those protections are enabled by default (on Pixels at least). Users don't have to do anything here. > And from what I remember, a plain AOSP install seemed to still phone home to Google to check for Internet connectivity and whatnot. You're not wrong, but GrapheneOS and CalyxOS are valid options, if you don't trust the ROM Pi…
Sure, but full disk encryption was also enabled on my Mom's Ubuntu laptop 15 years ago, because I chose the correct options when I set it up. What commercial vendors offer out of the box has never been a good yardstick for talking about security features, and it's only gotten worse with the rise of the surveillance economy. My fundamental problem with Graphene/Calyx is that I don't trust the devs have enough bandwidt…
Concretely, what discourages me from going Pixel is the Qualcomm integrated baseband/application chipsets.
Google Pixel hasn't used Qualcomm chipsets since the Pixel 5.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#317ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
Hasn’t this all been long true for iOS as well? There are reasons to hate it, but a walled garden is safer in many ways (as long as you trust Apple). You mention baseband - Android hardware comes with max 3 years of baseband support, compared to 7-9 years on iPhone. The story is similar when it comes to stock OS support. So from my pov, iPhones can be a comparable value (security and otherwise) to the best Android has to offer, specifically because of their (usable to me and the next guy to own my phone) 7-9 years of life, compared to 3 years max with a Pixel. What am I missing here?
Re: Ask HN: How do you trust that your personal machine is not compromised?
#318You simply cannot. Unless you want to go Richard Stallman path, and work on a laptop from 2008, with only open source software, unable to use Netflix, banking site, etc.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#319For malware that was downloaded through activity, even if it required no clicks, they usually present themselves as slower performance or other quirks. Maybe one has eluded discovery but I'd never know.
I'm much more wary of systemic malware at lower levels that I don't have an opportunity to detect. There's not so much I can do about that other than try to use devices from vendors I trust (or distrust less) that have the least preinstalled software. Lobbying for open firmware or hardware is the long-term strategy.
I also use multiple machines: work, personal, gaming, and utility (Surface Go). E.g. I use the mouse configuration software on the Surface Go and only the mouse hardware with its configured profile on the other machines.
Ultimately I can't know I'm not compromised but don't lose sleep over something I don't have more control over.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#320Earlier quoted context omitted.
All that looks good on paper, but a lot of apps require full disk access and can easily run in the background, so how "trustable" can that really be in practice? With iOS at least I know that apps really are sandboxed and cannot access anything unless I grant permission. No app can ever attempt to access my photos unless I explicitly pick a photo or grant partial/total access. Even then it's read-only or "write with…
Well both of your complaints were already addressed. Android introduced the scoped storage system to remove and fix abuse of "full" disk access, and they also added the foreground notification system which forces a system notification to be displayed if any app is doing work in the background, so that you know about.
Right, but if the average real-world Android experience lags behind say iOS in terms of security, then the point, even if outdated, still serves to disprove the parent’s premise that AOSP is the most secure.