3 ms·

Spectre attacks have so far only been observed at the nation-state level in the wild. If you're truly paranoid about being in the first wave of victims, disable

Spectre attacks have so far only been observed at the nation-state level in the wild. If you're truly paranoid about being in the first wave of victims, disable Javascript and other active content on non-white listed pages. At some point processors are going to have to drop into a non-speculative security mode when dealing with vulnerable data like passwords and handshakes, and pop back out of it when they're done.

throwaway2048 8y ago
This is bad advice, attacks never get worse.
- coldtea 8y ago
  >attacks never get worse Huh? When a known vulnerability is packaged in a script-kiddie/shady marketeer friendly manner, they do get orders of magnitude worse...
  - throwaway2048 8y ago
    "worse" in the sense of less effective
    - coldtea 8y ago
      Aha!
phkahler 8y ago
That's not enough. You have to disable speculative execution on untrusted code, not on sensitive data. There is no solution on shared infrastructure because the untrusted code is another VMs trusted code.
- akvadrako 8y ago
  He was talking about desktop computing. For server side, of course you need dedicated machines in your own locations. You basically have no security against targeted attacks in shared hosting because you don't even have access to cameras or the ability to vet the personal with access to your hardware.
beached_whale 8y ago
use a second process and IPC to communicate, done
hannob 8y ago
> Spectre attacks have so far only been observed at the nation-state level in the wild. Citation needed. I'm not aware of any Spectre attacks in the wild that have been documented. (Of course it's possible they happened, but if they have at least nobody talked about it.)
basementcat 8y ago
> At some point processors are going to have to drop into a non-speculative security mode when dealing with vulnerable data like passwords and handshakes, and pop back out of it when they're done. Would the act of switching to a noticeably lower performance state when operating on sensitive data reveal information to other threads?

throwaway2048 8y ago

This is bad advice, attacks never get worse.

coldtea 8y ago
>attacks never get worse Huh? When a known vulnerability is packaged in a script-kiddie/shady marketeer friendly manner, they do get orders of magnitude worse...
- throwaway2048 8y ago
  "worse" in the sense of less effective
  - coldtea 8y ago
    Aha!

phkahler 8y ago

That's not enough. You have to disable speculative execution on untrusted code, not on sensitive data. There is no solution on shared infrastructure because the untrusted code is another VMs trusted code.

akvadrako 8y ago
He was talking about desktop computing. For server side, of course you need dedicated machines in your own locations. You basically have no security against targeted attacks in shared hosting because you don't even have access to cameras or the ability to vet the personal with access to your hardware.

beached_whale 8y ago

use a second process and IPC to communicate, done

hannob 8y ago

> Spectre attacks have so far only been observed at the nation-state level in the wild. Citation needed. I'm not aware of any Spectre attacks in the wild that have been documented. (Of course it's possible they happened, but if they have at least nobody talked about it.)

basementcat 8y ago

> At some point processors are going to have to drop into a non-speculative security mode when dealing with vulnerable data like passwords and handshakes, and pop back out of it when they're done. Would the act of switching to a noticeably lower performance state when operating on sensitive data reveal information to other threads?