12 ms·
How useful are such measures when Intel has backdoored each and everyone of their CPUs with its "Intel Management Engine" [0] (and AMD has a similar mechanism)?
by benevol 9y ago
How useful are such measures when Intel has backdoored each and everyone of their CPUs with its "Intel Management Engine" [0] (and AMD has a similar mechanism)?
If Intel/AMD have a backdoor into every PC and server, then so does the US gov't (NSA, CIA, FBI, etc.) and of course other uninvited hackers from even hostile countries.
And how did Western society just accept all of this anti-democratic craziness?
[0] https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel
- baby 9y agoHSMs are not protections against the gocernment. Simple as that
- vortico 9y agoDoes the recent successes of disabling Intel ME essentially solve this? https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Disabling_the_Intel_Management_Engine https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Di... It's not easy, but for a security firm where the data on each computer is worth millions, it might be worth it.
- eeZah7Ux 9y agoCompletely useless.
- nickik 9y agoIf you make that assumption then you have already lost. However that is no reason not to use good security otherwise. > And how did Western society just accept all of this anti-democratic craziness? Because people buy it voluntary.
- ComputerGuru 9y ago> And how did Western society just accept all of this anti-democratic craziness? Western societies, so as not to upset the guise of freedom and personal rights to privacy, do so in secret but it's not exclusive to them. China publicly mandates government backdoors into their equipment too.
- wyager 9y agoComputer security engineering is a branch of economics. If you try to think of it in all-or-nothing terms, you’re going to come up with silly ideas like “we shouldn’t bother trying to stop malware because the NSA could theoretically spend $1,000,000 and hack my laptop anyway”.
- j_s 9y ago> How useful are such measures when Intel has backdoored each and everyone of their CPUs with its "Intel Management Engine" [0] (and AMD has a similar mechanism)? If you trust this YubiHSM but not Intel CPUs, then it is very useful since encryption/decryption occurs on the YubiHSM, not the connected CPU. Just plug it into a computer with a CPU you do trust first to get the official public key(s) for future verifications! If you don't trust this YubiHSM because of the example of Intel CPUs, then please share at what point you do trust third party hardware, so we can discuss how to get to useful encryption from there. Would you only trust RAM you wire-wrapped yourself? Would you only trust a motherboard you built from 7400 series logic gates, each of which you personally verified using X-rays? The line has to be drawn somewhere, but without knowing where you want to do so your comment serves mostly to hijack discussion (which is fine).
- Cyph0n 9y agoIf an attacker controls your computer, there is always the possibility of a man in the middle, even if you use a Yubikey. The attacker could simply wait for a request to the HSM and intercept the response.
- j_s 9y agoBut they don't have the private key, that's the whole point of the hardware device! They can't MITM the encrypted data without it. plaintext <-> crypto <-> blob <-> *compromised server/anything but quantum computing* <-> blob <-> crypto / YubiHSM Edit: I'm not talking about this: *my compromised PC* <-> plaintext <-> crypto <-> blob <-> crypto / Yubikey In practice, getting anything done involves some CPU doing something useful with plaintext, if that's what you're getting at. As I said, you have to draw the line somewhere. Without sharing where you do this there is little point in talking about it. Personally, I can't see any problem with an Intel CPU (or any other hardware) acquired with cash in person, then never networked and if I wanted to go ultra paranoid: a chain of custody from the time of my acquisition demonstrating continuous physical surveillance. My point is that I could securely "crypto" from my academic-dreamland/whatever secure computer through any transport to a YubiHSM connected to a compromised PC, if I trust Yubico (and the supply chain delivering their hardware) and the YubiHSM's initial/one-time setup.
- criddell 9y agoSo I guess you just use 12345678 as your password everywhere?
- fasquoika 9y agoOr they mailed a letter to a stranger with a wad of cash asking them to post this comment so they can avoid using computers completely