Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We should have the ability to run any code we want on hardware we own

hugotunius.se

Post reply on HN
Print view View original

381–390 of 1001 posts

Re: We should have the ability to run any code we want on hardware we own

#381

Post by AndyMcConachie »

rahkiin wrote: post #337
spaqin wrote: post #283

Earlier quoted context omitted.

Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures. You can also choose to do your banking at the physical branch. We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely…

In the netherlands we do not have physical branches anymore. They died out. All banking started to go through browser. This was very sensitive to malware and viruses, so two-factor was added through phones. Then less and less people had PCs because phone provides enough. Now mobile apps for banking is the only way to do banking. Or it is required for MFA. Even if you’re calling with the bank it is used as MFA

I still do banking through a random reader at ABN AMRO. I really hope they never get rid of it because I trust that little dumb plastic device 1000% more than my phone.

Re: We should have the ability to run any code we want on hardware we own

#382

Post by extraisland »

josephg wrote: post #359
matheusmoreira wrote: post #299

Earlier quoted context omitted.

> think of the elderly This stuff is not just for the elderly and computer illiterate. It's for you as well. You think they're going to stop? You're giving up freedom for safety. You will have neither.

> It's for you as well. You think they're going to stop? No! Which is why I don't want every npm package I install to have unfettered access to my internet connection and to access all my files. If this is being exploited now, I might not even know! How sloppy is that! > You're giving up freedom for safety. At the limit, sure, maybe there are tradeoffs between freedom and security. But there's lots of technical solut…

> At the limit, sure, maybe there are tradeoffs between freedom and security. But there's lots of technical solutions that we could build right now that give a lot more safety without losing any freedom at all.

Everything you have suggested in this post takes away freedom. There is no solution that doesn't take away freedom / your control. There is always a trade off.

> Like sandboxing applications by default. Applications should by default run on my computer with the same permissions as a browser tab. Occasionally applications need more access than that. But that should require explicit privilege escalation rather than being granted to all programs by default. (Why do I need to trust that spotify and davinci resolve won't install keyloggers on my computer? Our computers are so insecure!)

This already exists on Linux.

I run Discord/Slack in Flatpak. Out of the box the folders and clipboard permissions are restricted. Only the ~/Downloads folder on my PC is accessible to Discord/Slack. You can't drag and drop things into these apps. Which makes sharing content a PITA.

If you don't want to worry about things like keyloggers, you should run an open source OS and use open source programs where you can verify that there are no key loggers. You should also make sure you find out what firmware your keyboard is using (many keyboards themselves have complex micro controllers on them that can be programmed).

Re: We should have the ability to run any code we want on hardware we own

#383

Post by akvadrako »

bee_rider wrote: post #334
zmmmmm wrote: post #165

> In this context this would mean having the ability and documentation to build or install alternative operating systems on this hardware It doesn't work. Everything from banks to Netflix and others are slowly edging out anything where they can't fully verify the chain of control to an entity they can have a legal or contractual relationship with. To be clear, this is fundamental, not incidental. You can't run your o…

I wouldn’t be totally opposed to having some sort of totally locked down device that I was just used for banking. The bank could even sell them or give them away with the account (doesn’t need high performance). Another though; if we were actually able to pass laws that helped people, one that I’d like to see would be: for a totally locked down proprietary device, everything done with it should be the legal liability…

That's basically how it used to work. Before the app my bank required the use of a card and QR reader with a screen that could authorize transactions

Re: We should have the ability to run any code we want on hardware we own

#384

Post by AndyMcConachie »

josephg wrote: post #260
zmmmmm wrote: post #165

> In this context this would mean having the ability and documentation to build or install alternative operating systems on this hardware It doesn't work. Everything from banks to Netflix and others are slowly edging out anything where they can't fully verify the chain of control to an entity they can have a legal or contractual relationship with. To be clear, this is fundamental, not incidental. You can't run your o…

My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like. I like that they have iphones. Doing internet banking on their phone is safer than doing it on their desktop computer. Why is that? The reason is that the desktop PC security model is deeply fl…

The answer to this is a physical switch on the machine that enables/disables hackability.

Re: We should have the ability to run any code we want on hardware we own

#385

Post by josephg »

spaqin wrote: post #283
josephg wrote: post #260

Earlier quoted context omitted.

My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like. I like that they have iphones. Doing internet banking on their phone is safer than doing it on their desktop computer. Why is that? The reason is that the desktop PC security model is deeply fl…

Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures. You can also choose to do your banking at the physical branch. We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely…

> Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures.

So what? The lack of perfect security is a terrible argument against better security.

For example, lockpicks exist. Is that a reason to stop locking your house? Our TLS ciphers might eventually be broken. Should we throw away TLS and go back to unencrypted HTTP?

I'm not expecting anything to 100% stop all scams. But modern computer security is a joke. We could do an awful lot better than we are today at keeping people safe from this stuff.

> We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely available if you needed it as well

Yes. I want something like this on desktop too - but I want to own the signing keys, of course. It seems strange that this is so controversial.

Re: We should have the ability to run any code we want on hardware we own

#386

Post by ACS_Solver »

rahkiin wrote: post #337
spaqin wrote: post #283

Earlier quoted context omitted.

Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures. You can also choose to do your banking at the physical branch. We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely…

In the netherlands we do not have physical branches anymore. They died out. All banking started to go through browser. This was very sensitive to malware and viruses, so two-factor was added through phones. Then less and less people had PCs because phone provides enough. Now mobile apps for banking is the only way to do banking. Or it is required for MFA. Even if you’re calling with the bank it is used as MFA

Same in Sweden, physical bank branches are rare and even they will often require an appointment. All banking is through bank apps or websites, and you use 2FA extensively. Sweden's digital ID system is called BankID because it was made by banks and, initially, for banking, though now BankID is used extensively for all kinds of government and private services.

That doesn't stop scammers. They also keep getting more sophisticated, often using a combination of social engineering and technical skill, and they keep tricking people into giving them money. So unfortunately, while malware is pretty much a non-factor, scammers still thrive.

Re: We should have the ability to run any code we want on hardware we own

#387

Post by b112 »

rahkiin wrote: post #337
spaqin wrote: post #283

Earlier quoted context omitted.

Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures. You can also choose to do your banking at the physical branch. We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely…

In the netherlands we do not have physical branches anymore. They died out. All banking started to go through browser. This was very sensitive to malware and viruses, so two-factor was added through phones. Then less and less people had PCs because phone provides enough. Now mobile apps for banking is the only way to do banking. Or it is required for MFA. Even if you’re calling with the bank it is used as MFA

So far in Canada... I must reiterate this, so far, this can and has been fought by one thing. Rural life, and nationalism.

There are plenty of places where mobile phones don't work, especially in the summer when there are leaves on the trees. This means SMS won't really work. So for this path, SMS, the bank has an alternative -- call a number on your account with a voice reading the 2FA code. Thus, landlines or VOIP work here.

When it comes to an app, forcing Canadians to use a phone OS controlled by US companies, still has pushback. An example being, the concept of "A Canadian having to use software from a US company, to identify themselves to a Canadian company" is still a hotspot. Especially with the US wanting to annex us.

So this lock in has not yet occurred.

Really, the phone call to a phone number on your account, not using SMS is as solid a protection, as an app running on a phone controlled by a foreign country's company. It's an alternate path. And it solves the whole 'rural person' access.

Many people living in rural areas don't even bother with a phone type device. Some have Kindles. But by buy a phone, if it doesn't work where you live?

This logic, combined with them closing rural banks, means they have to be quite sensitive here. EG, closing rural banks, then making it difficult to do online banking is political poison for our banks.

Re: We should have the ability to run any code we want on hardware we own

#388

Post by josephg »

vrighter wrote: post #380
josephg wrote: post #260

Earlier quoted context omitted.

My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like. I like that they have iphones. Doing internet banking on their phone is safer than doing it on their desktop computer. Why is that? The reason is that the desktop PC security model is deeply fl…

All this will do is ensure that if malware does get through the official channels (which it can and regularly does) it will be more widely distributed

Security doesn't need to be 100% effective to add value. The more hoops we make scammers jump through, the fewer people will end up getting scammed.

I know angle grinders exist. I still lock up my bike.

Re: We should have the ability to run any code we want on hardware we own

#389

Post by extraisland »

tonyhart7 wrote: post #351
extraisland wrote: post #284

Earlier quoted context omitted.

Everything in life is about trade-offs. Certain trade-offs people aren't going to make. - If you want to run an alternative operating system, you got to learn how it works. That is a trade off not even many tech savvy people want to make. - There is a trade-off with a desktop OS. I actually like the fact that it isn't super sand-boxed and locked down. I am willing to trade security & safety for control. > Personally…

exactly, people want all the benefit without the consequences like if there are OS utopia exist that has all the advantage without the downside then everybody would use that but people complaining don't live in reality

A lot of it already exists in one form or another and the trade-off for sand-boxing is usability a lot of the time.

It isn't even a freedom vs security. It is usability vs security.

Re: We should have the ability to run any code we want on hardware we own

#390

Post by _Algernon_ »

nuker wrote: post #281
quaintdev wrote: post #279

Earlier quoted context omitted.

Why not give people the freedom to choose what they want

It will be exploited. Key word above - not tech savvy. The only reason we have convenient banking, gov and streaming apps today is because of guaranteed and enforced mobile security by big boys Apple and Google. (Google being Ad company is another matter, not relevant here).

We've literally had convenient online banking for two decades at this point without any DRM.

Don't rewrite history.

Post reply on HN