4 ms·
I don’t get it. The bulb would have to be able to query the enclave, so the attacker can just have it do that and see what the enclave returns. The enclave in d
by baddox 8y ago
I don’t get it. The bulb would have to be able to query the enclave, so the attacker can just have it do that and see what the enclave returns. The enclave in devices like iPhones are effective because they require external input (like a passcode or face/fingerprint scan). A lightbulb conveniently doesn’t require that every time it turns on.
- CharlesColeman 8y agoI edited my comment, but the idea was to increase the amount of foreknowledge required to extract something useful. It won't be perfect, but it's better than just storing the SSID/password in cleartext (or encrypted with an easily-extracted on-device key). The device wouldn't tell the attacker what he needed to know to find the network the password works for if he didn't already know it. Edit: another commenter linked https://wigle.net/ https://wigle.net/, which could make it extremely easy for an attacker to find the network to exploit if the device stores the SSID in cleartext. My idea would help make that a lot harder, especially if the enclave rate-limits requests.
- deleted 8y ago[deleted]
- behringer 8y agoIt should be trivial to make the password write-only to the wifi electronics. For an attacker to get the wifi password, you'd have to remove the controller, and the controller could even be designed to mitigate against that attack too.