3 ms·

No. That's not a general rule. Many universities have computer labs. The computers are in a locked cabinet, with a keyboard, mouse, and monitor exposed. For th

No. That's not a general rule. Many universities have computer labs. The computers are in a locked cabinet, with a keyboard, mouse, and monitor exposed. For that matter, many shopping malls have information kiosks, retail stores have demo laptops, banks have ATM machines, airlines have automatic check-ins, etc. If you're typing away, no one will care. If you're opening up the device with a crowbar, or even screw driver, you'd better have a nice orange high-viz uniform, lanyard, and clipboard. Without those, security will drag you awat.

exabrial 6y ago
I'm not sure if you were trying to prove his point, but you did
- woofie11 6y ago
  I'm pretty sure I know what constitutes a proof, and that wasn't it. The core reason this did not constitute a proof is because physical security people misapply lessons from that domain to digital, and software engineers misapply lessons from digital to physical. In the virtual world, I'm open to 7 billion potential attackers. In the physical world, I'm open to a few. That leads to very different security practices. If I leave my front door unlocked for a week, the security risk is minimal where I live. Casual security is good enough. If I leave my computer with even a pretty obscure vulnerability connected to the internet for 5 minutes, odds are pretty good it will be compromised. Clipboards+lanyard+high viz vest is imperfect security (and I chose the example deliberately to illustrate that), but it is good enough security to practically prevent physical compromises in most instances. I won't run a military base that way, or a HIPAA-compliant data system, but it's good enough for 95% of uses, including, for example, a university physics department's research data system. Even a military base doesn't have perfect security; a well-resourced attacker can compromise it. In contrast, in the virtual world, I want cryptographic protocols where I can prove perfect security, at least given a relatively small set of assumptions.
nexuist 6y ago
As we all know, high-viz uniforms, lanyards, and clipboards have historically been extremely hard to procure and outside the reach of the average person
jlgaddis 6y ago
> > ... if you have physical access to the machine ... > The computers are in a locked cabinet, ... Or, in other words, no physical access?
- woofie11 6y ago
  No. In other words, controlled or monitored physical access. If I have access to a keyboard connected to CPU, that's a form of "physical access." IO devices are part of the computer.

exabrial 6y ago

I'm not sure if you were trying to prove his point, but you did

woofie11 6y ago
I'm pretty sure I know what constitutes a proof, and that wasn't it. The core reason this did not constitute a proof is because physical security people misapply lessons from that domain to digital, and software engineers misapply lessons from digital to physical. In the virtual world, I'm open to 7 billion potential attackers. In the physical world, I'm open to a few. That leads to very different security practices. If I leave my front door unlocked for a week, the security risk is minimal where I live. Casual security is good enough. If I leave my computer with even a pretty obscure vulnerability connected to the internet for 5 minutes, odds are pretty good it will be compromised. Clipboards+lanyard+high viz vest is imperfect security (and I chose the example deliberately to illustrate that), but it is good enough security to practically prevent physical compromises in most instances. I won't run a military base that way, or a HIPAA-compliant data system, but it's good enough for 95% of uses, including, for example, a university physics department's research data system. Even a military base doesn't have perfect security; a well-resourced attacker can compromise it. In contrast, in the virtual world, I want cryptographic protocols where I can prove perfect security, at least given a relatively small set of assumptions.

nexuist 6y ago

As we all know, high-viz uniforms, lanyards, and clipboards have historically been extremely hard to procure and outside the reach of the average person

jlgaddis 6y ago

> > ... if you have physical access to the machine ... > The computers are in a locked cabinet, ... Or, in other words, no physical access?

woofie11 6y ago
No. In other words, controlled or monitored physical access. If I have access to a keyboard connected to CPU, that's a form of "physical access." IO devices are part of the computer.