5 ms·

Sure, but let's not kid ourselves. For some people (of both good and bad intentions), they have to be able to resist both covert and overt physical access. We

Sure, but let's not kid ourselves. For some people (of both good and bad intentions), they have to be able to resist both covert and overt physical access. We cannot simply continue to allow it to be "game over."

ktRolster 10y ago
When the military has secure computer needs, they take steps to ensure no physical access. Check out "SCIF"
- greglindahl 10y ago
  ... and they also put hot glue into the usb ports, but I digress.
- wmf 10y ago
  So for those of us not in the military, we should either handcuff our laptops to ourselves or just not use computers? It's so defeatist.
  - AnthonyMouse 10y ago
    Security is risk management. A plumber has a different threat model than a government operative. If you're not interesting then physical security is less necessary because physical attacks are less likely and the consequences are lower. If you are interesting then you need physical security.
    - cm2187 10y ago
      It's a bit of a "if you don't have anything to say you don't need free speech" argument. I'd rather have security for everyone because someone, sometime, will need it.
      - pmontra 10y ago
        Leaving physical access to a PC is bad practice in any case. It makes it easy for thieves to steal it and to anybody to implant any kind of device or sw. Intel increased the surface area for attacks and this can't be good. However security for everyone regardless of the threat model is hard. I make an example with smartphones. Unlock with PIN or with fingerprint? Obviously PIN is safer because we leave fingerprints everywhere. But threat modeling comes into play. I know of a guy who got his iPhone stolen at a party and started receiving email notifications of account changes. Did the thief use NSA grade decryption techniques? No, the phone was protected with a PIN. The thief likely kept an eye on people unlocking phones and stole the one he was able to spot the PIN for. The inferior security method (fingerprint) would have prevented unlocking the phone and maybe made the theft less interesting. It's always a tradeoff and one has to decide who's wanting to protect against.
        KirinDave 10y ago
        > Leaving physical access to a PC is bad practice in any case. Okay, so imagine you're in a country where homosexuality is illegal, but you still are trying to live your life as a human (the majority of which seek companionship). "Oh sorry, not only are you ruined when they kick down your door, but everyone you've ever networked with is at risk now too maybe try not living there ha ha goodbye!" is not a story. What's more, I just want to point out Apple and Google have been trying very hard to make devices which all but the most resourced individuals cannot break. As you implied, some access weaknesses exist to this day, but right now for desktops and laptops this "welp I guess you deserved this because you weren't careful" attitude seems to rule the discourse. It's shortsighted, it's regressive, it's unhelpful. And while I cannot know your motivations, I know many folks who are so paranoid that Intel and AMD might have backdoors in their boot integrity verifiers that they're willing to ignore people desperate to keep secrets on that principle rather than try and make an actual best effort at security.
        pmontra 10y ago
        I'm surprised by what you read in my message. I'm not the "you deserved it" kind of person. People has the right to live how they decide to live and deserve nothing bad happen to them. However prudence calls to plan for security and I just don't believe technology can help us past to a certain point. I lock the door of my house. Most people do. That helps against burglars, which is my threat model. It doesn't help against police with a warrant in some countries, maybe warrantless in others. If somebody wants your data so badly to kick down your door, maybe they are willing to use workarounds even less pleasant than https://xkcd.com/538/ https://xkcd.com/538/ There are techniques against that, compartmentation (is that the right word?) and others. The more farsighted is trying to change how a country works. Long and risky though.
    - drvdevd 10y ago
      Well also, the reason these debugging interfaces are shipped enabled is probably due to a risk/convenience/benefit calculation made by Intel et al, with a view toward making repair or diagnoses cheaper or satisfying OEM factory requirements. So in this case the risk is passed on for any number of reasons, not all of which are to the detriment of consumers. Some perhaps to their benefit. From the corporations' point of view, there are multiple customers to satisfy for each device shipped, not just the end user. My point being that this risk analysis is simply more complex than any single end user's needs.
    - cma 10y ago
      Which kind of plumber? :)
- willstrafach 10y ago
  That is not what a SCIF is used for. A SCIF is for discussing or electronically processing information classified at TS/SCI level (sensitive intelligence-related information). Counterexample: For Unclassified and Unclassified//FOUO websites made available on the public internet by DoD/IC, you can even access them from home using a valid CAC/PKI card (smart card holding a client certificate affirming your identity). This is not just informational websites, it includes your unclassified webmail, Intelink-U (web gateway to some sites), and more. They are far more lax than many private corporations are. Physical security is surely good to have, but your reference to military is not a great one as military and the intelligence community hedge a lot on digital security, not physical security unless the information is highly sensitive (Even then, it is in combination with very strong digital security measures regarding setup of the network, VPN, and all endpoints).
  - compuguy 10y ago
    Even in a SCIF physical security (and auditing) is still very important.
pjlegato 10y ago
I think OP's point was that it's not a question of intentions or will to build a better system -- it's categorically impossible to secure a computing device from someone who has physical access to it, a priori.
- deathanatos 10y ago
  While I agree that it's difficult to secure a computing device against all physical attacks, I think one can consider a USB port a sort of physical "API" to the machine, and one that shouldn't just outright betray me. As a user, I would like physical attacks to at least require some level of disassembly.

ktRolster 10y ago

When the military has secure computer needs, they take steps to ensure no physical access. Check out "SCIF"

greglindahl 10y ago
... and they also put hot glue into the usb ports, but I digress.
wmf 10y ago
So for those of us not in the military, we should either handcuff our laptops to ourselves or just not use computers? It's so defeatist.
- AnthonyMouse 10y ago
  Security is risk management. A plumber has a different threat model than a government operative. If you're not interesting then physical security is less necessary because physical attacks are less likely and the consequences are lower. If you are interesting then you need physical security.
  - cm2187 10y ago
    It's a bit of a "if you don't have anything to say you don't need free speech" argument. I'd rather have security for everyone because someone, sometime, will need it.
    - pmontra 10y ago
      Leaving physical access to a PC is bad practice in any case. It makes it easy for thieves to steal it and to anybody to implant any kind of device or sw. Intel increased the surface area for attacks and this can't be good. However security for everyone regardless of the threat model is hard. I make an example with smartphones. Unlock with PIN or with fingerprint? Obviously PIN is safer because we leave fingerprints everywhere. But threat modeling comes into play. I know of a guy who got his iPhone stolen at a party and started receiving email notifications of account changes. Did the thief use NSA grade decryption techniques? No, the phone was protected with a PIN. The thief likely kept an eye on people unlocking phones and stole the one he was able to spot the PIN for. The inferior security method (fingerprint) would have prevented unlocking the phone and maybe made the theft less interesting. It's always a tradeoff and one has to decide who's wanting to protect against.
      - KirinDave 10y ago
        > Leaving physical access to a PC is bad practice in any case. Okay, so imagine you're in a country where homosexuality is illegal, but you still are trying to live your life as a human (the majority of which seek companionship). "Oh sorry, not only are you ruined when they kick down your door, but everyone you've ever networked with is at risk now too maybe try not living there ha ha goodbye!" is not a story. What's more, I just want to point out Apple and Google have been trying very hard to make devices which all but the most resourced individuals cannot break. As you implied, some access weaknesses exist to this day, but right now for desktops and laptops this "welp I guess you deserved this because you weren't careful" attitude seems to rule the discourse. It's shortsighted, it's regressive, it's unhelpful. And while I cannot know your motivations, I know many folks who are so paranoid that Intel and AMD might have backdoors in their boot integrity verifiers that they're willing to ignore people desperate to keep secrets on that principle rather than try and make an actual best effort at security.
        pmontra 10y ago
        I'm surprised by what you read in my message. I'm not the "you deserved it" kind of person. People has the right to live how they decide to live and deserve nothing bad happen to them. However prudence calls to plan for security and I just don't believe technology can help us past to a certain point. I lock the door of my house. Most people do. That helps against burglars, which is my threat model. It doesn't help against police with a warrant in some countries, maybe warrantless in others. If somebody wants your data so badly to kick down your door, maybe they are willing to use workarounds even less pleasant than https://xkcd.com/538/ https://xkcd.com/538/ There are techniques against that, compartmentation (is that the right word?) and others. The more farsighted is trying to change how a country works. Long and risky though.
  - drvdevd 10y ago
    Well also, the reason these debugging interfaces are shipped enabled is probably due to a risk/convenience/benefit calculation made by Intel et al, with a view toward making repair or diagnoses cheaper or satisfying OEM factory requirements. So in this case the risk is passed on for any number of reasons, not all of which are to the detriment of consumers. Some perhaps to their benefit. From the corporations' point of view, there are multiple customers to satisfy for each device shipped, not just the end user. My point being that this risk analysis is simply more complex than any single end user's needs.
  - cma 10y ago
    Which kind of plumber? :)
willstrafach 10y ago
That is not what a SCIF is used for. A SCIF is for discussing or electronically processing information classified at TS/SCI level (sensitive intelligence-related information). Counterexample: For Unclassified and Unclassified//FOUO websites made available on the public internet by DoD/IC, you can even access them from home using a valid CAC/PKI card (smart card holding a client certificate affirming your identity). This is not just informational websites, it includes your unclassified webmail, Intelink-U (web gateway to some sites), and more. They are far more lax than many private corporations are. Physical security is surely good to have, but your reference to military is not a great one as military and the intelligence community hedge a lot on digital security, not physical security unless the information is highly sensitive (Even then, it is in combination with very strong digital security measures regarding setup of the network, VPN, and all endpoints).
- compuguy 10y ago
  Even in a SCIF physical security (and auditing) is still very important.

pjlegato 10y ago

I think OP's point was that it's not a question of intentions or will to build a better system -- it's categorically impossible to secure a computing device from someone who has physical access to it, a priori.

deathanatos 10y ago
While I agree that it's difficult to secure a computing device against all physical attacks, I think one can consider a USB port a sort of physical "API" to the machine, and one that shouldn't just outright betray me. As a user, I would like physical attacks to at least require some level of disassembly.