3 ms·
Security chips shouldn't be black boxes in the first place.
by grishka 6y ago
Security chips shouldn't be black boxes in the first place.
- henryackerman 6y agoAgreed, what's going on should be completely transparent. The security of the system must only depend on the private keys and implementation correctness.
- Cthulhu_ 6y agoWhile security by obscurity is not ideal, it is an additional hurdle. Apple knows that security flaws in their stuff is very valuable for both nefarious and state hackers, so the chances of someone finding an issue and reporting it to them to resolve it are kinda low.
- TimTheTinker 6y agoNot if the bounty is high enough and payable to an anonymous recipient (perhaps vis cryptocurrency).
- vulcan01 6y agoI don't think state-affiliated hackers really care about money.
- TimTheTinker 6y agoGood point, though I imagine a large bounty payable to an anonymous bitcoin address could encourage individuals within such an organization to divulge vuln info.
- madeofpalk 6y agoIt being a black box seems to be a seperate unrelated issue?
- EricE 6y agoNot really since it generated the requirement that is the topic of the article in the first place. For example, if it wasn't a black box it could be re-configured with alternative firmware negating this requirement. Not that I'm interested in such a thing, but I can see how it would have value to a non-trivial group of users.
- madeofpalk 6y agoI guess it depends how we're defining "black box". T2 and its firmware could be completely open source - arguably its no longer a "black box" because its completely transparent now - but unless you have the keys you still can't reprogram it.
- grishka 6y agoAnd you should have all the keys for a device you bought. It should be a legal requirement.
- jhanschoo 6y agoThat isn't related to the issue at all. On Linux, you can have a TPM + Secure Boot + Full-Disk Encryption setup with the TPM schematics all open and you will have your SSD bound to your system similarly, which is good security practice.