4 ms·

The T2 chip for what I understand it's a proprietary CPU that executes proprietary software, how can you consider that secure ? It's not different from the Inte

The T2 chip for what I understand it's a proprietary CPU that executes proprietary software, how can you consider that secure ? It's not different from the Intel ME in that sense, just another secondary processor that have access to all the hardware on the computer and that runs code that the user cannot control. Also for a security prospective it's not good, the main principle of cryptography is that the only secret to decrypt something should reside in the user, not in the obscurity of the algorithm or the hardware, so a perfect encryption is an encryption where when you turn on you laptop you have to insert a 30 character strong password that only you know, like LUKS on Linux, no obscure hardware, no proprietary software. The laptop broke, take out the SSD, put it in another Linux computer, insert you secret password, and recover the data. This system is NOT secure, if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want. We must not consider secure every encryption system that doesn't depend on a secret that only the user knows.

jsjohnst 8y ago
> This system is NOT secure Let me tell you a secret, there is nothing truly secure in the world. Only things which haven’t had a vulnerability found for it. > It's not different from the Intel ME The important sense that matters is Intel ME has been found vulnerable (highly vulnerable in fact). The T2 hasn’t. Should we be skeptical of black boxes, most assuredly! But calling it equivalent to something found to be flawed in serious ways is a bit premature at best, or grossly negligent at worse. > the main principle of cryptography is that the only secret to decrypt something should reside in the user I don’t know about you, but the “main principle of cryptography” is to prevent unauthorized parties from knowing the contents of the data to me. I guess we are allowed to make up any statement that furthers our cause though when that suits us. > if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want Your password is part of the process, the extra stuff done in the T2 is just that, extra. So extracting from the T2 gives you nothing without the user’s password, needed to unlock the secret encryption key for the drive (assuming FileVault is enabled[0], and if you didn’t enable it, then why do you have an expectation of security at all?). [0] https://support.apple.com/en-us/HT208344 https://support.apple.com/en-us/HT208344
- devwastaken 8y ago
  >Let me tell you a secret, there is nothing truly secure in the world. My VCR is pretty secure. CRT monitor, too. Even my headphones are nicely secure. >The important sense that matters is Intel ME has been found vulnerable (highly vulnerable in fact). The T2 hasn’t. There's your fallacy. Just because the T2 hasn't doesn't mean it can't or won't. You even just said it. 'Only things which haven’t had a vulnerability found for it.'. The problem is that proprietary embedded hardware of a dynamic nature leads to irreversible possibilities of exploitation at a hardware level. ME is a very, very good reason to not trust. >I don’t know about you, but the “main principle of cryptography” is to prevent unauthorized parties from knowing the contents of the data to me. Cryptography is not about obfuscation layers on top of cryptography. Cryptographic security is a math, not a logic. Anything further is about hiding intentions making the cost of entry to finding exploitation higher. The cost of entry makes it hard for white hats to find exploits before the market does. >Your password is part of the process, the extra stuff done in the T2 is just that, extra. Or is it? Have you looked at the firmware? you nor I can, so you cannot claim what it's actually doing. But we do know that it's a proprietary chip capable of lots of fun. Also user passwords are trivial to get, and there's always the possibility that the chip is storing the user password itself. Again, can't know, that's up for the black hats now.
  - pwinnski 8y ago
    A long time ago, I was told a story by a Navy Radioman--a specialty which no longer exists. As a demonstration of TEMPEST, someone parked a van at the end of a pier and after a few hours presented to the crew of the ship a log of everything that had been done electronically on the ship. Not just the transmitted traffic, either, but things that they had apparently been able to construct from the CRT displays in use at the time. At a distance. I don't think your VCR, CRT monitor, or headphones are nearly as secure as you think they are. You might not care about their vulnerability to a sufficiently-motivated actor, but someone else might.
    - Someone 8y ago
      https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking: ”In the paper, Van Eck reports that in February 1985 a successful test of this concept was carried out with the cooperation of the BBC. Using a van filled with electronic equipment and equipped with a VHF antenna array, they were able to eavesdrop from a "large distance". There is no evidence that the BBC's TV detector vans actually used this technology, although the BBC will not reveal whether or not they are a hoax. Van Eck phreaking and protecting a CRT display from it was demonstrated on an episode of Tech TV's The Screen Savers on December 18, 2003.”
mattnewton 8y ago
Privacy- not security. In this case they reasserted their commitment to privacy by not giving themselves the key to the encryption, and therefore making themselves unable to give the key to others, either from insider risk, state actors or malicious hackers. I’m not a security expert and I couldn’t possibly tell you whether the T2 is secure even if I was because it’s an opaque blob like you said.
eridius 8y ago
> The T2 chip for what I understand it's a proprietary CPU that executes proprietary software, how can you consider that secure ? It's not different from the Intel ME in that sense, just another secondary processor that have access to all the hardware on the computer and that runs code that the user cannot control. If it ran open-source software that wouldn't make it secure. Proprietary software means it can't be independently audited for security, but whether it can be audited != whether it's actually secure. > Also for a security prospective it's not good, the main principle of cryptography is that the only secret to decrypt something should reside in the user, not in the obscurity of the algorithm or the hardware Your "main principle" is incorrect, but you are correct that obscurity of algorithm is no defense. However the T2 does not rely on obscurity of algorithm. It relies on having a private key that nobody besides the T2 has access to (not the user, not Apple, nobody) and it combines that key with the one derived from your password. This means decrypting any of that data requires two things: 1. The user password, and 2. Cooperation from the T2 chip This is strictly more secure than just relying on the password alone. > This system is NOT secure, if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want. This is incorrect. You still need the user password. If someone manages to extract the key from the T2 then they've reduced the problem back to what you'd have without the T2; namely, you need the user password to decrypt anything.

jsjohnst 8y ago

> This system is NOT secure Let me tell you a secret, there is nothing truly secure in the world. Only things which haven’t had a vulnerability found for it. > It's not different from the Intel ME The important sense that matters is Intel ME has been found vulnerable (highly vulnerable in fact). The T2 hasn’t. Should we be skeptical of black boxes, most assuredly! But calling it equivalent to something found to be flawed in serious ways is a bit premature at best, or grossly negligent at worse. > the main principle of cryptography is that the only secret to decrypt something should reside in the user I don’t know about you, but the “main principle of cryptography” is to prevent unauthorized parties from knowing the contents of the data to me. I guess we are allowed to make up any statement that furthers our cause though when that suits us. > if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want Your password is part of the process, the extra stuff done in the T2 is just that, extra. So extracting from the T2 gives you nothing without the user’s password, needed to unlock the secret encryption key for the drive (assuming FileVault is enabled[0], and if you didn’t enable it, then why do you have an expectation of security at all?). [0] https://support.apple.com/en-us/HT208344 https://support.apple.com/en-us/HT208344

devwastaken 8y ago
>Let me tell you a secret, there is nothing truly secure in the world. My VCR is pretty secure. CRT monitor, too. Even my headphones are nicely secure. >The important sense that matters is Intel ME has been found vulnerable (highly vulnerable in fact). The T2 hasn’t. There's your fallacy. Just because the T2 hasn't doesn't mean it can't or won't. You even just said it. 'Only things which haven’t had a vulnerability found for it.'. The problem is that proprietary embedded hardware of a dynamic nature leads to irreversible possibilities of exploitation at a hardware level. ME is a very, very good reason to not trust. >I don’t know about you, but the “main principle of cryptography” is to prevent unauthorized parties from knowing the contents of the data to me. Cryptography is not about obfuscation layers on top of cryptography. Cryptographic security is a math, not a logic. Anything further is about hiding intentions making the cost of entry to finding exploitation higher. The cost of entry makes it hard for white hats to find exploits before the market does. >Your password is part of the process, the extra stuff done in the T2 is just that, extra. Or is it? Have you looked at the firmware? you nor I can, so you cannot claim what it's actually doing. But we do know that it's a proprietary chip capable of lots of fun. Also user passwords are trivial to get, and there's always the possibility that the chip is storing the user password itself. Again, can't know, that's up for the black hats now.
- pwinnski 8y ago
  A long time ago, I was told a story by a Navy Radioman--a specialty which no longer exists. As a demonstration of TEMPEST, someone parked a van at the end of a pier and after a few hours presented to the crew of the ship a log of everything that had been done electronically on the ship. Not just the transmitted traffic, either, but things that they had apparently been able to construct from the CRT displays in use at the time. At a distance. I don't think your VCR, CRT monitor, or headphones are nearly as secure as you think they are. You might not care about their vulnerability to a sufficiently-motivated actor, but someone else might.
  - Someone 8y ago
    https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking: ”In the paper, Van Eck reports that in February 1985 a successful test of this concept was carried out with the cooperation of the BBC. Using a van filled with electronic equipment and equipped with a VHF antenna array, they were able to eavesdrop from a "large distance". There is no evidence that the BBC's TV detector vans actually used this technology, although the BBC will not reveal whether or not they are a hoax. Van Eck phreaking and protecting a CRT display from it was demonstrated on an episode of Tech TV's The Screen Savers on December 18, 2003.”

mattnewton 8y ago

Privacy- not security. In this case they reasserted their commitment to privacy by not giving themselves the key to the encryption, and therefore making themselves unable to give the key to others, either from insider risk, state actors or malicious hackers. I’m not a security expert and I couldn’t possibly tell you whether the T2 is secure even if I was because it’s an opaque blob like you said.

eridius 8y ago

> The T2 chip for what I understand it's a proprietary CPU that executes proprietary software, how can you consider that secure ? It's not different from the Intel ME in that sense, just another secondary processor that have access to all the hardware on the computer and that runs code that the user cannot control. If it ran open-source software that wouldn't make it secure. Proprietary software means it can't be independently audited for security, but whether it can be audited != whether it's actually secure. > Also for a security prospective it's not good, the main principle of cryptography is that the only secret to decrypt something should reside in the user, not in the obscurity of the algorithm or the hardware Your "main principle" is incorrect, but you are correct that obscurity of algorithm is no defense. However the T2 does not rely on obscurity of algorithm. It relies on having a private key that nobody besides the T2 has access to (not the user, not Apple, nobody) and it combines that key with the one derived from your password. This means decrypting any of that data requires two things: 1. The user password, and 2. Cooperation from the T2 chip This is strictly more secure than just relying on the password alone. > This system is NOT secure, if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want. This is incorrect. You still need the user password. If someone manages to extract the key from the T2 then they've reduced the problem back to what you'd have without the T2; namely, you need the user password to decrypt anything.