3 ms·

Consider Signal, which is open source and not based in Australia. If AU wants to intercept a signal message, then presumably they would need to either force Goo

Consider Signal, which is open source and not based in Australia. If AU wants to intercept a signal message, then presumably they would need to either force Google and/or Apple to push a custom app to a specific user, or take over the entire phone (again, via Google or Apple). In the first case, is the app that comes from the app store somehow verifiable, or do you need to build from source to be sure? Is there anything that can be done about the second case (which I suspect is the general intent of this law)

cyphar 8y ago
I think that, for long-term security, we need to have devices that are resilient to orchestrated sabotage by the vendor. The current approach by Apple is great, until Apple is compromised in one way or another. I have some idea for how this could be done (TPM-resident signing keys on each device, which have to sign all binaries before they can execute). I might end up writing a blog post about the idea.
- gruez 8y ago
  Sounds like applocker in windows
  - cyphar 8y ago
    My experience with AppLocker is that it doesn't really work. As high-school students we would trade ways to break it to play games on our laptops (we were given school laptops which had AppLocker). If high-school students were able to figure out how to break it, I have no doubt there are more serious issues. In addition, I believe you can only whitelist based on: 1. Paths (like AppArmor). 2. Publisher (which I think is a signature, but is a signature of the publisher not the machine itself -- so a compromised publisher could give you a bad update silently). 3. Hash (which is _okay_ but arguably requires more maintenance of the "good hash" list than requiring a specific signature -- though the nice thing with hashes is that you can disallow old ones). On Linux we have IMA, and there is quite a lot of work on being able to use it as a way of requiring signed-binary execution (it's still not there, from what I've heard in recent talks). But even with that we'd need quite a bit of work to create an installer that bootstraps TPM-resident keys and signs all of the system binaries -- as well as requiring all new updates to sign said binaries.
    - askvictor 8y ago
      I often wonder if the cat and mouse game of high school IT restrictions is an under handed way of training the next generation of security professionals.

cyphar 8y ago

I think that, for long-term security, we need to have devices that are resilient to orchestrated sabotage by the vendor. The current approach by Apple is great, until Apple is compromised in one way or another. I have some idea for how this could be done (TPM-resident signing keys on each device, which have to sign all binaries before they can execute). I might end up writing a blog post about the idea.

gruez 8y ago
Sounds like applocker in windows
- cyphar 8y ago
  My experience with AppLocker is that it doesn't really work. As high-school students we would trade ways to break it to play games on our laptops (we were given school laptops which had AppLocker). If high-school students were able to figure out how to break it, I have no doubt there are more serious issues. In addition, I believe you can only whitelist based on: 1. Paths (like AppArmor). 2. Publisher (which I think is a signature, but is a signature of the publisher not the machine itself -- so a compromised publisher could give you a bad update silently). 3. Hash (which is _okay_ but arguably requires more maintenance of the "good hash" list than requiring a specific signature -- though the nice thing with hashes is that you can disallow old ones). On Linux we have IMA, and there is quite a lot of work on being able to use it as a way of requiring signed-binary execution (it's still not there, from what I've heard in recent talks). But even with that we'd need quite a bit of work to create an installer that bootstraps TPM-resident keys and signs all of the system binaries -- as well as requiring all new updates to sign said binaries.
  - askvictor 8y ago
    I often wonder if the cat and mouse game of high school IT restrictions is an under handed way of training the next generation of security professionals.