Live data from Hacker News

Creating a bespoke data diode for air‑gapped networks

nelop.com

81–86 of 86 posts

Re: Creating a bespoke data diode for air‑gapped networks

#81
post #11

Earlier quoted context omitted.

For that matter, why the optocoupler at all? You only need it if the systems are at different electrical potentials, and even then they are galvanically isolated on the Pis by the magnetics in the Ethernet. But I guess it's not the same as being asked "where's the air gap" pointing at the optocoupler, and saying "there it is"

There are lots of ways to solve this problem. In the past I have worked in defence, for highly sensitive stuff they wouldn't even allow a common ground between two networks. That's why I chose an option iolsator, it ensures the two devices are electrically isolated. It's overkill for this application, but I wanted to set something up right, and if I ever have another project like this that needs to be more secure, it…

> In the past I have worked in defence, for highly sensitive stuff they wouldn't even allow a common ground between two networks.

I actually agree very much with this. If you're looking for strong assurance that there is no possible back-channel, devices like optocouplers help significantly. It's not hard for me to think of a way to surreptitiously send data backwards through a common ground, or normal silicon diode, or a magnetic coupler like an Ethernet transformer, but optoisolators make it significantly more challenging.

Re: Creating a bespoke data diode for air‑gapped networks

#82
post #48

Earlier quoted context omitted.

That has to be abysmal bandwidth, right? How much data can you practically transfer that way?

Shannon-Hartley says the theoretical maximum data rate for a channel with AWGN is proportional to bandwidth and the log of signal-to-noise ratio. For an off-the-shelf microphone/speaker pair, I think 16 kHz and 80 dB are probably decent guesses. That would give a theoretical maximum data rate of about 425 kb/s. The practical limit is probably much lower. It may be possible to increase the bandwidth by increasing the…

Honestly better rate than I expected. If they are just looking to export a steady stream of telemetry, that would be sufficient.

Re: Creating a bespoke data diode for air‑gapped networks

#83

Earlier quoted context omitted.

Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.

If I gave away a PC with perfect RF isolation and a rock solid supply chain it wouldn’t improve most user’s overall security because their operational security is so poor. There is no need for any organization to snoop your RF when you’re leaking everything they care about in your metadata.

Intercepting metadata requires a different type of surveillance which may not be possible. The metadata is not at all equivalent to what can be sniffed via RF, which can include your actual keystrokes and the pixels on your screen.

Re: Creating a bespoke data diode for air‑gapped networks

#84
post #68

Earlier quoted context omitted.

The point is you don't need the opto isolator at all.

That's a separate point. Are you agreeing that if an air gap was needed an optoisolator would be suitable?

> Are you agreeing ...

No. "An air-gapped computer or network is one that has no network interfaces, either wired or wireless, connected to outside networks" https://en.wikipedia.org/wiki/Air_gap_(networking)#Use_in_cl...

Re: Creating a bespoke data diode for air‑gapped networks

#85
post #68

Earlier quoted context omitted.

That's a separate point. Are you agreeing that if an air gap was needed an optoisolator would be suitable?

> Are you agreeing ... No. "An air-gapped computer or network is one that has no network interfaces, either wired or wireless, connected to outside networks" https://en.wikipedia.org/wiki/Air_gap_(networking)#Use_in_cl...

"For this reason, some new hardware technologies are also available like unidirectional data diodes or bidirectional diodes (also called electronic airgaps), which physically separate the network and transportation layers and copy and filter the application data. "
Post reply on HN