4 ms·
IT should be able to revoke any access the machine has, so the only compromise would be what was already on the machine; which would be the case regardless of s
by gizmo686 6y ago
IT should be able to revoke any access the machine has, so the only compromise would be what was already on the machine; which would be the case regardless of security policy, as they could just access the harddrive directly regardless of OS security policy.
In practice, it wouldn't suprise me if that computer was locally storing passwords that were not specific to that machine, which might mean needing to revoke a bunch of passwords
- kenniskrag 6y ago> as they could just access the harddrive directly regardless of OS security policy. I think that's wrong if you consider disk encryption.
- fphhotchips 6y agoFrom what I've read, full disk encryption was optional in the House until very recently. If this was a shared machine it's almost certainly not encrypted.
- kenniskrag 6y agofull disk encryption is also possible with a shared computer. TPM and PBA are some keywords
- fragmede 6y agoPossible? Very. Likelihood of the computer's login password and thus hard drive decryption key attached to the computer's screen with a post-it note thus obviating the protection gained from full disk encryption? On a shared computer, high.
- kenniskrag 6y agoFor a computer most will use the back of the keyboard :) reminds me of this xkcd: https://xkcd.com/538/ https://xkcd.com/538/
- shawnz 6y agoThe user doesn't need to enter a password if they are using a TPM.
- freeone3000 6y agoIf they stole the laptop, they also stole the TPM inside the laptop, so having the key stored there doesn't help.
- shawnz 6y agoTrue. I was thinking they'd be using their centralized accounts once they reach the OS logon screen, thus no post-it necessary, but maybe that's not the case.
- fphhotchips 6y agoAbsolutely it's possible, but as it was a shared computer, it's also likely to be one of the oldest in the fleet. It's also likely to be one that no one bothers to ask for specific attention to. As a result, it's likely that no full disk encryption was ever applied.
- deleted 6y ago[deleted]
- ConcernedCoder 6y ago1st time that laptop reaches out to the internet should be the last time, if security is worth it's own salt.
- AuthorizedCust 6y agoThat assumes it can talk to IT's systems, and it's done before the computer is "inspected". For a corporate laptop, that can easily be unlikely.
- gizmo686 6y agoI'm not talking about telling the laptop that it's access is revoked; I'm talking about just revoking it's access, so if it every tries to connect to the House's intranet, it would have no more permissions than any other laptop. If IT wanted to wipe the drive, then they would need the laptop to phone home in some way.
- colejohnson66 6y agoThat assumes files weren’t downloaded. Even if access is revoked, saved copies still are accessible.
- WindyLakeReturn 6y ago>which might mean needing to revoke a bunch of passwords That doesn't help much because many people use patterns to their passwords and use the same passwords elsewhere. Seeing the expired passwords of many important people would have a very high chance of having a few which would be of use in breaking into accounts even if they were already expired.