7 ms·

"There is no way for us to defend ourselves: even skilled technologists who administer their own networked services are no match for the bandits. To keep bandit

"There is no way for us to defend ourselves: even skilled technologists who administer their own networked services are no match for the bandits. To keep bandits out, you have to be perfect and perfectly vigilant, and never make a single mistake. For the bandits to get you, they need merely find a single mistake that you’ve made." Ooof. What a boot-to-the-face reminder. Despite my use of a Tor Router, three ubikeys and Google authenticator, password manager, non-GSM voice (GoogleVoice), and several hard tokens from various financial institutions, I still have no idea if I'm doing enough because I don't control any of my three OSes, including Ubuntu 18.04 (we almost missed elliptic key backdoor in OpenSSL, what else is in there?).

gen220 6y ago
You could run your system completely in RAM, to at least limit the duration of exposure. Persistence is overrated! :)
- xaduha 6y ago
  You're joking, but I don't think I will be running Windows without uwfmgr.exe aka Unified Write Filter if I ever decide to use it as my main OS again. More people should be aware of it. It's only for Enterprise editions, but maybe there are similar options out there.
- walterbell 6y ago
  Or a VM with snapshots / non-persistent storage.
  - amelius 6y ago
    How do you apply security updates?
    - walterbell 6y ago
      Immediately after a clean boot, apply security update, reboot to test, then immediately shutdown and allow that snapshot to persist.
      - amelius 6y ago
        Wouldn't it be better to do a reinstall of the OS in the VM (or use a previous image), apply the security updates, and then reinstall any other software that was on the system?
        walterbell 6y ago
        Typically the base, non-persistent image is carefully managed to be pristine, e.g. through a tree of storage snapshots that allows reversion to known-good checkpoints.
- MichaelZuo 6y ago
  To go one step further, have three, or more, identical fire walled systems running and have them vote on every calculation with the votes sent to a hardwired switch, that prevents the system from advancing if there’s a disagreement, and shuts off power to the RAM if there’s too many in a row. The chances of any compromise happening to all the systems within the same nanosecond would be infinitesimal.
  - plasticchris 6y ago
    They shouldn't be identical systems, common mode failures will get you.
- bboylen 6y ago
  For anyone unfamiliar and curious, this is how the Tails OS works. https://tails.boum.org/ https://tails.boum.org/
nyolfen 6y ago
fun reminder that canonical refuses to use tls on their repos
- prutschman 6y ago
  Do you have reason to believe there's a problem with the gpg signatures in their repo?
  - bigiain 6y ago
    The GPG sigs that are also published over MITMable unencrypted http? http://archive.canonical.com/dists/xenial/Release.gpg http://archive.canonical.com/dists/xenial/Release.gpg Yeah, I believe I see a problem there...
    - theamk 6y ago
      Which problem do you see? It's just a signature, they cannot be forged without a corresponding private key.
    - AnthonyMouse 6y ago
      The entire point of signatures is that you don't have to trust the channel that delivers them. The root of trust is the private key that comes with the operating system install ISO, but that you can download over HTTPS or have it delivered as physical media etc.
    - jasonjayr 6y ago
      But the public signing key, that's already installed via presumably verified initial media is already there, so unless their private key is compromised, which would be a bigger deal ....
      - bigiain 6y ago
        > installed via presumably verified initial media This is not a universally correct assumption. How does this chain of trust bootstrap for a first time (or stand alone) user who downloads Ubuntu from a non-Ubuntu system? If I've got MITM, I can change both the ISO (with the totally-not-verified public key) as well as the gpg sig to match using a private key I know (and gave you the public key to).
f430 6y ago
If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. The reason that number stations continue to operate is that it really is the best way to communicate/order under surveillance which almost certainly is happening in every embassy in non-friendly countries. One time pads are truly unbreakable and it's techniques have been refined for the past 80 years since Cold War began. Luckily you don't need a shortwave radio anymore and the CIA I believe utilizes emoticons. Even if you intercept a bunch of smiley faces followed by a wink, how do you figure out the contents of the message when the medium to decode is completely unknowable? It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history.
- ardy42 6y ago
  > If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. I'd say using a dead drop is probably even older and more secure. I don't think it'd attract any extra attention unless you're already being followed. A numbers station is really only useful to a particular use case that seems exclusive to nation-state spies: you don't care who knows you're transmitting, but you need the message and the location of the recipient to be absolutely secure.
  - f430 6y ago
    > dead drop yes but it really needs to be remote because they caught ppl doing it like that American spy in the 80s. I know in South Korea, dead drop is a popular method of peddling drugs but ppl still get busted. I agree number stations are overkill but perhaps some similar methods...like cartels using email drafts to communicate
    - chb 6y ago
      > because they caught ppl doing it like that American spy in the 80s. > Are you referring to Robert Hanssen? https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen
backing 6y ago
"Google" authenticator
Kalium 6y ago
Information security is not a matter of secure or not-secure. Throughout history, it has always been a matter of available resources and risk management. Failing to consider security in terms of resources and risk leads to moments like this. The crushing fear that you're not doing enough, never doing enough, never sure enough... It's a bottomless pit of anxiety. You can always add on more protections, more tools, and more layers. Your anxiety is never really soothed because you can never actually fully banish risk. As long as you conceive of information security as deterministic or binary, you're going to struggle.
pabs3 6y ago
Qubes might be a better choice than Ubuntu, for additional compartmentalisation.

gen220 6y ago

You could run your system completely in RAM, to at least limit the duration of exposure. Persistence is overrated! :)

xaduha 6y ago
You're joking, but I don't think I will be running Windows without uwfmgr.exe aka Unified Write Filter if I ever decide to use it as my main OS again. More people should be aware of it. It's only for Enterprise editions, but maybe there are similar options out there.
walterbell 6y ago
Or a VM with snapshots / non-persistent storage.
- amelius 6y ago
  How do you apply security updates?
  - walterbell 6y ago
    Immediately after a clean boot, apply security update, reboot to test, then immediately shutdown and allow that snapshot to persist.
    - amelius 6y ago
      Wouldn't it be better to do a reinstall of the OS in the VM (or use a previous image), apply the security updates, and then reinstall any other software that was on the system?
      - walterbell 6y ago
        Typically the base, non-persistent image is carefully managed to be pristine, e.g. through a tree of storage snapshots that allows reversion to known-good checkpoints.
MichaelZuo 6y ago
To go one step further, have three, or more, identical fire walled systems running and have them vote on every calculation with the votes sent to a hardwired switch, that prevents the system from advancing if there’s a disagreement, and shuts off power to the RAM if there’s too many in a row. The chances of any compromise happening to all the systems within the same nanosecond would be infinitesimal.
- plasticchris 6y ago
  They shouldn't be identical systems, common mode failures will get you.
bboylen 6y ago
For anyone unfamiliar and curious, this is how the Tails OS works. https://tails.boum.org/ https://tails.boum.org/

nyolfen 6y ago

fun reminder that canonical refuses to use tls on their repos

prutschman 6y ago
Do you have reason to believe there's a problem with the gpg signatures in their repo?
- bigiain 6y ago
  The GPG sigs that are also published over MITMable unencrypted http? http://archive.canonical.com/dists/xenial/Release.gpg http://archive.canonical.com/dists/xenial/Release.gpg Yeah, I believe I see a problem there...
  - theamk 6y ago
    Which problem do you see? It's just a signature, they cannot be forged without a corresponding private key.
  - AnthonyMouse 6y ago
    The entire point of signatures is that you don't have to trust the channel that delivers them. The root of trust is the private key that comes with the operating system install ISO, but that you can download over HTTPS or have it delivered as physical media etc.
  - jasonjayr 6y ago
    But the public signing key, that's already installed via presumably verified initial media is already there, so unless their private key is compromised, which would be a bigger deal ....
    - bigiain 6y ago
      > installed via presumably verified initial media This is not a universally correct assumption. How does this chain of trust bootstrap for a first time (or stand alone) user who downloads Ubuntu from a non-Ubuntu system? If I've got MITM, I can change both the ISO (with the totally-not-verified public key) as well as the gpg sig to match using a private key I know (and gave you the public key to).

f430 6y ago

If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. The reason that number stations continue to operate is that it really is the best way to communicate/order under surveillance which almost certainly is happening in every embassy in non-friendly countries. One time pads are truly unbreakable and it's techniques have been refined for the past 80 years since Cold War began. Luckily you don't need a shortwave radio anymore and the CIA I believe utilizes emoticons. Even if you intercept a bunch of smiley faces followed by a wink, how do you figure out the contents of the message when the medium to decode is completely unknowable? It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history.

ardy42 6y ago
> If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. I'd say using a dead drop is probably even older and more secure. I don't think it'd attract any extra attention unless you're already being followed. A numbers station is really only useful to a particular use case that seems exclusive to nation-state spies: you don't care who knows you're transmitting, but you need the message and the location of the recipient to be absolutely secure.
- f430 6y ago
  > dead drop yes but it really needs to be remote because they caught ppl doing it like that American spy in the 80s. I know in South Korea, dead drop is a popular method of peddling drugs but ppl still get busted. I agree number stations are overkill but perhaps some similar methods...like cartels using email drafts to communicate
  - chb 6y ago
    > because they caught ppl doing it like that American spy in the 80s. > Are you referring to Robert Hanssen? https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen

backing 6y ago

"Google" authenticator

Kalium 6y ago

Information security is not a matter of secure or not-secure. Throughout history, it has always been a matter of available resources and risk management. Failing to consider security in terms of resources and risk leads to moments like this. The crushing fear that you're not doing enough, never doing enough, never sure enough... It's a bottomless pit of anxiety. You can always add on more protections, more tools, and more layers. Your anxiety is never really soothed because you can never actually fully banish risk. As long as you conceive of information security as deterministic or binary, you're going to struggle.

pabs3 6y ago

Qubes might be a better choice than Ubuntu, for additional compartmentalisation.