3 ms·
Then how are you addressing 1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in v
by maqp 6y ago
Then how are you addressing
1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in via the share transmission media (QR-code, thumbdrive, whatnot). What if your Huawei, iPhone and device N are compromised via network because they're all connected to network at all times. The adversary can then just steal all necessary shares and they don't even need to access your magic wand, they can just XOR the shares from the three receiving endpoints and recover the message.
2) Airgap exfiltration security. Let's say the iPhone is secure enough and the adversary can't hack it. But how are you ensuring the QR-code scanner app of the Magic Wand can not be exploited with a carefully crafted QR-code? If the Magic Wand is compromised, it can leak plaintext messages the next time you scan the QR-codes of outgoing shares.
- lucb1e 6y agoTo be fair about #2, I have rarely seen vulns in QR code scanners that were actually related to the scanning of QR codes. The only issues I heard about were things like auto-opening a URL or logic issues when handling the scanned data. Of course this doesn't immediately lead to perfect and provable security, but there are bigger issues with the concept than this.
- maqp 6y agoIt's still one of the cheapest attacks after #1 is plugged with public key encryption or initial off-band (sneakernet) key delivery.