4 ms·

E2e means next to nothing when using closed source software. Apple could (have) issue(d) an update with code to steal yr anything, without you knowing, so FBI-

by cies 7y ago

E2e means next to nothing when using closed source software. Apple could (have) issue(d) an update with code to steal yr anything, without you knowing, so FBI-or-whatever does not "complain". I currently use one e2e service, BitWarden as keychain, that ticks the boxes (e2e AND open source client).

klodolph 7y ago
This hard line is too facile. If you are paranoid about malicious code updates, then making part of your stack open-source doesn’t matter. I could push an update to your OS that reads the keys out of your BitWarden.
- saghm 7y ago
  Of course, there are open source operating systems out there...
  - somehnguy 7y ago
    Yeah, I always verify the hashes of updated binaries match what I compile myself in parallel. Also that takes too much time so I just never update anything and have a homebrew version of 'Damn Vulnerable Linux'. /s
    - Ajedi32 7y ago
      Long-term, there may eventually come a solution to this problem in the form of [binary transparency](https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency). However, we're obviously a long way away from that being the norm, and there's still the problem of supply-chain attacks on hardware to consider.
      - zaarn 7y ago
        I doubt the hardware supply chain can ever be secured. Even if you were to open-source every single part of manufacturing, there is no reliable way to ensure that the chip you, as a customer, have obtained, hasn't been backdoored. You'd have to delid it and put it under an X-Ray if that even resolves the tiny featuresin modern CPUs.
        streb-lo 7y ago
        In short, there is no equivalent hashing function for hardware.
        Ajedi32 7y ago
        With an open hardware design, periodically de-liding and examining a random sample of available consumer hardware would probably sufficient to protect the general consumer population, and targeted attacks become very difficult if you purchase your hardware from a store rather than order it by mail. Even so I agree that examining all hardware in that manner is impractical. A better approach might be having a small, simpler core of secure open-source hardware managing your root of trust, and trying our best to mitigate the impact of compromises in the more complicated components (like the motherboard, CPU, etc) with approaches such as requiring open source firmware, sandboxing individual components by filtering their external communications through open hardware, and limiting their access to sensitive data like encryption keys. Obviously there's only so far you can go with that, but I don't think it's an entirely hopeless battle either. It's a very interesting problem for sure.
        zaarn 7y ago
        >With an open hardware design, periodically de-liding and examining a random sample of available consumer hardware would probably sufficient to protect the general consumer population, and targeted attacks become very difficult if you purchase your hardware from a store rather than order it by mail. How do you trust the person that verifies the CPU? Can you trust the X-Ray imaging machine? Is the X-Ray Machine verified to be open source and not backdoored to hide backdoors (aka bootstrapping trust).
      - diffeomorphism 7y ago
        Not that long way off: Debian is currently already 94% reproducible https://tests.reproducible-builds.org/debian/reproducible.html https://tests.reproducible-builds.org/debian/reproducible.ht... https://reproducible-builds.org/ https://reproducible-builds.org/
  - rstupek 7y ago
    But is there fully open source hardware with no possibility of a backdoor?
  - fragmede 7y ago
    The seminal "Trusting Trust" paper, by Ken Thompson, in 1984, is remarkable for being as relevant today as ever, and should be required reading. https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
  - m4rtink 7y ago
    Yeah, try to do that on a mainstream Linux distro for example. While I'm not saying maintainers & users are checking all changes in packages, all the work happens in the open & all the source is compiled on distro infrastructure. So once you actually do an atack like this and it is discovered, you can be sure anything done by the maintainer will be combed with a very fine brush & the account disabled. Given that it can take years to build the trust needed to become mainatiner of an important package, only to loose it all once you atack is known, I really can't see this used for anythin else than very targetted high stakes attack omce off attack, definitelly not for any long term dragnet surveilance.
- numpad0 7y ago
  Or you could root target’s Intel ME or AMD PSP if you know what the NSA codename(BYEMAN or ECHELON or the likes) for those are.
- cies 7y ago
  I meant that closed source even gets less safe when allowing auto-updates. When using opens source the auto-updates need to be trusted; yes. Nothing new.

by cies 7y ago

klodolph 7y ago

This hard line is too facile. If you are paranoid about malicious code updates, then making part of your stack open-source doesn’t matter. I could push an update to your OS that reads the keys out of your BitWarden.

saghm 7y ago
Of course, there are open source operating systems out there...
- somehnguy 7y ago
  Yeah, I always verify the hashes of updated binaries match what I compile myself in parallel. Also that takes too much time so I just never update anything and have a homebrew version of 'Damn Vulnerable Linux'. /s
  - Ajedi32 7y ago
    Long-term, there may eventually come a solution to this problem in the form of [binary transparency](https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency). However, we're obviously a long way away from that being the norm, and there's still the problem of supply-chain attacks on hardware to consider.
    - zaarn 7y ago
      I doubt the hardware supply chain can ever be secured. Even if you were to open-source every single part of manufacturing, there is no reliable way to ensure that the chip you, as a customer, have obtained, hasn't been backdoored. You'd have to delid it and put it under an X-Ray if that even resolves the tiny featuresin modern CPUs.
      - streb-lo 7y ago
        In short, there is no equivalent hashing function for hardware.
      - Ajedi32 7y ago
        With an open hardware design, periodically de-liding and examining a random sample of available consumer hardware would probably sufficient to protect the general consumer population, and targeted attacks become very difficult if you purchase your hardware from a store rather than order it by mail. Even so I agree that examining all hardware in that manner is impractical. A better approach might be having a small, simpler core of secure open-source hardware managing your root of trust, and trying our best to mitigate the impact of compromises in the more complicated components (like the motherboard, CPU, etc) with approaches such as requiring open source firmware, sandboxing individual components by filtering their external communications through open hardware, and limiting their access to sensitive data like encryption keys. Obviously there's only so far you can go with that, but I don't think it's an entirely hopeless battle either. It's a very interesting problem for sure.
        zaarn 7y ago
        >With an open hardware design, periodically de-liding and examining a random sample of available consumer hardware would probably sufficient to protect the general consumer population, and targeted attacks become very difficult if you purchase your hardware from a store rather than order it by mail. How do you trust the person that verifies the CPU? Can you trust the X-Ray imaging machine? Is the X-Ray Machine verified to be open source and not backdoored to hide backdoors (aka bootstrapping trust).
    - diffeomorphism 7y ago
      Not that long way off: Debian is currently already 94% reproducible https://tests.reproducible-builds.org/debian/reproducible.html https://tests.reproducible-builds.org/debian/reproducible.ht... https://reproducible-builds.org/ https://reproducible-builds.org/
- rstupek 7y ago
  But is there fully open source hardware with no possibility of a backdoor?
- fragmede 7y ago
  The seminal "Trusting Trust" paper, by Ken Thompson, in 1984, is remarkable for being as relevant today as ever, and should be required reading. https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- m4rtink 7y ago
  Yeah, try to do that on a mainstream Linux distro for example. While I'm not saying maintainers & users are checking all changes in packages, all the work happens in the open & all the source is compiled on distro infrastructure. So once you actually do an atack like this and it is discovered, you can be sure anything done by the maintainer will be combed with a very fine brush & the account disabled. Given that it can take years to build the trust needed to become mainatiner of an important package, only to loose it all once you atack is known, I really can't see this used for anythin else than very targetted high stakes attack omce off attack, definitelly not for any long term dragnet surveilance.
numpad0 7y ago
Or you could root target’s Intel ME or AMD PSP if you know what the NSA codename(BYEMAN or ECHELON or the likes) for those are.
cies 7y ago
I meant that closed source even gets less safe when allowing auto-updates. When using opens source the auto-updates need to be trusted; yes. Nothing new.