5 ms·

Give me a break. The same three letter agency that convinced Intel to do this will convince Apple to do the same. I'm guessing you're basing your faith in Apple

by oroup 9y ago

Give me a break. The same three letter agency that convinced Intel to do this will convince Apple to do the same. I'm guessing you're basing your faith in Apple based on their refusal to cooperate in the San Bernadino case[1] and the so-called "cop button" in iOS 11[2]. (And some generic "we value privacy" rhetoric that I won't bother linking.) That stuff is great but doesn't mean much. Just because they're blocking border agents from trivially imaging phones at the border doesn't mean that they won't cooperate at a higher level with some undocumented baseband features. Just as Defense in Depth is a concept in security, we've already seen a corollary "Offense in Depth" from the intelligence community. Is the best attack in the random number generator[3] or undocumented silicon[4] or intercepting your boxes on the way to your data center[5] or tapping your fiber[6] or stealing your certs[7] or paying your employees to go rogue[8]? Why choose when you can just do them all. Apple hardware is vertically integrated and utterly undocumented. The AMT chip has been present on motherboards since 2006[9]. The Snowden Introspection Engine found that the Wifi Chipset remains powered up even when Wifi is turned off.[10] I find it hard to believe that the same government who went to all these lengths to compromise our infrastructure would really let Apple get away with refusing. How did that turn out for Joseph Nacchio?[11] [1] https://www.washingtonpost.com/world/national-security/us-wants-apple-to-help-unlock-iphone-used-by-san-bernardino-shooter/2016/02/16/69b903ee-d4d9-11e5-9823-02b905009f99_story.html?utm_term=.28bb85453e0a https://www.washingtonpost.com/world/national-security/us-wa... [2] https://www.cultofmac.com/498052/ios-11-lets-quickly-disable-touch-id-prevent-forced-unlocks/ https://www.cultofmac.com/498052/ios-11-lets-quickly-disable... [3] https://en.wikipedia.org/wiki/Random_number_generator_attack#Possible_Backdoor_in_Elliptical_Curve_DRBG https://en.wikipedia.org/wiki/Random_number_generator_attack... [4] https://en.wikipedia.org/wiki/Hardware_backdoor#Examples https://en.wikipedia.org/wiki/Hardware_backdoor#Examples [5] https://www.extremetech.com/computing/173721-the-nsa-regularly-intercepts-laptop-shipments-to-implant-malware-report-says https://www.extremetech.com/computing/173721-the-nsa-regular... [6] https://arstechnica.com/tech-policy/2013/10/new-docs-show-nsa-taps-google-yahoo-data-center-links/ https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns... [7] https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ https://nakedsecurity.sophos.com/2013/12/09/serious-security... [8] http://www.ocweekly.com/news/fbi-used-best-buys-geek-squad-to-increase-secret-public-surveillance-7950030 http://www.ocweekly.com/news/fbi-used-best-buys-geek-squad-t... [9] https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel [10] https://www.documentcloud.org/documents/2996800-AgainstTheLaw.html#document/p2 https://www.documentcloud.org/documents/2996800-AgainstTheLa... [11] https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio

KGIII 9y ago
You're asserting that a 'three letter agency' convinced Intel to do this, and asserting it as factual. I'm not convinced that it is, and think market focus is more probable than nefarious agencies. Though, to be sure, those types of agencies would probably be willing to take advantage of this. No, it seems more probable that they did this because their largest customers want centralized management at a low level. They want to be able to track and control assets, and to prevent asset loss. They, being the largest customers, control the features that Intel offers. It then makes no sense, financially, to make two versions of the CPU. Unfortunately, the market for people who care is vanishingly small. Most people don't much care about privacy or security, other than to pay it lip service - if even that much. Prevalent is the idea that they've nothing to hide and, thus, nothing to fear. So, without evidence that this was inspired by a three letter agency, I'm going to assume it is a financial decision. That seems much more reasonable and probable. Do you have any evidence to prove three letter agency coercion? I'd expect it to be quite the news event, if you did.
- amigoingtodie 9y ago
  If what you say is true, why has vPro not seen wider adoption? It has been around long enough. Anybody work for an MSP or enterprise that actually uses this in the field?
  - KGIII 9y ago
    I can't say, really. My contention was largely around the idea that it was asserted as fact that it was at the behest of a three letter agency and the remainder of the comment presented based on that. It has not been established that it was at the behest of a three letter agency and presenting arguments based on that is like building a house on the sand. It hasn't anything to do with quality specifics, nor of alternatives. Without factual evidence to support the three letter agency theory, the rest of the argument is invalid. Don't get me wrong, I think it's a horrible idea. I've just seen no reasons to assert that it was done because of a three letter agency being the directors. As near as I can tell, and I've followed this fairly closely, no such evidence exists. At best, it's speculation. At worst, it's conspiracy theory. Either way, presenting it as fact and then basing an argument on that is illogical. We can do better than that. There are lots of valid complaints that don't need speculation, disinformation, or hyperbole. IME is a horrible idea, at least it is so long as you can't disable it as the end user. This very thread is a fine example of one of the reasons that it is horrible. It's a security nightmare and should be user controlled. No three letter agency needed to point this out. Wild, unsubstantiated, accusations may make people take the complaints less seriously. That seems less than helpful.

by oroup 9y ago

KGIII 9y ago

You're asserting that a 'three letter agency' convinced Intel to do this, and asserting it as factual. I'm not convinced that it is, and think market focus is more probable than nefarious agencies. Though, to be sure, those types of agencies would probably be willing to take advantage of this. No, it seems more probable that they did this because their largest customers want centralized management at a low level. They want to be able to track and control assets, and to prevent asset loss. They, being the largest customers, control the features that Intel offers. It then makes no sense, financially, to make two versions of the CPU. Unfortunately, the market for people who care is vanishingly small. Most people don't much care about privacy or security, other than to pay it lip service - if even that much. Prevalent is the idea that they've nothing to hide and, thus, nothing to fear. So, without evidence that this was inspired by a three letter agency, I'm going to assume it is a financial decision. That seems much more reasonable and probable. Do you have any evidence to prove three letter agency coercion? I'd expect it to be quite the news event, if you did.

amigoingtodie 9y ago
If what you say is true, why has vPro not seen wider adoption? It has been around long enough. Anybody work for an MSP or enterprise that actually uses this in the field?
- KGIII 9y ago
  I can't say, really. My contention was largely around the idea that it was asserted as fact that it was at the behest of a three letter agency and the remainder of the comment presented based on that. It has not been established that it was at the behest of a three letter agency and presenting arguments based on that is like building a house on the sand. It hasn't anything to do with quality specifics, nor of alternatives. Without factual evidence to support the three letter agency theory, the rest of the argument is invalid. Don't get me wrong, I think it's a horrible idea. I've just seen no reasons to assert that it was done because of a three letter agency being the directors. As near as I can tell, and I've followed this fairly closely, no such evidence exists. At best, it's speculation. At worst, it's conspiracy theory. Either way, presenting it as fact and then basing an argument on that is illogical. We can do better than that. There are lots of valid complaints that don't need speculation, disinformation, or hyperbole. IME is a horrible idea, at least it is so long as you can't disable it as the end user. This very thread is a fine example of one of the reasons that it is horrible. It's a security nightmare and should be user controlled. No three letter agency needed to point this out. Wild, unsubstantiated, accusations may make people take the complaints less seriously. That seems less than helpful.