3 ms·

Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.

by tlb 7y ago

julianlam 7y ago
Are you referring to network-enabled printers phoning home? My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.
snailmailman 7y ago
I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock. Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.
alexhutcheson 7y ago
What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.
- UncleMeat 7y ago
  The huge majority of people don’t have nation state threat models. If you are worried about that then using a desktop computer in the first place is a bad idea.
ocdtrekkie 7y ago
I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.

Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.

by tlb 7y ago

Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.

julianlam 7y ago

Are you referring to network-enabled printers phoning home? My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.

snailmailman 7y ago

I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock. Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.

alexhutcheson 7y ago

What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.

UncleMeat 7y ago
The huge majority of people don’t have nation state threat models. If you are worried about that then using a desktop computer in the first place is a bad idea.

ocdtrekkie 7y ago

I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.