4 ms·

Changing the root of trust doesn't mean applications can suddenly take over other applications. It also requires granting the malicious app sufficiently elevate

Changing the root of trust doesn't mean applications can suddenly take over other applications. It also requires granting the malicious app sufficiently elevated permissions for that takeover. The user made several choices along the way. If your argument is that there's the possibility that they could make the wrong choice then this is in my opinion security theater because it posits that a thing can only be secured by taking away choice and no other way.

pjmlp 5y ago
On this kind of devices the security chain of trust needs to take into consideration the same kind of users that fill their Internet Explorer with random toolbars from website popups. Not the user with a CS degree that knows what they are doing.
- the8472 5y ago
  Those kinds of users are unlikely to replace the root of trust, simply due to the process being onerous. And even if everyone were to install malware. There are other ways to secure banking. E.g. by providing an external token with a display. This is how hardware crypto wallets and some PIN generators for in-browser banking work. Or they could ask the owner to upload the attestation pubkey to their website, then the bank could still check if it's really their app that's running (as confirmed by the boot trust chain). I'm not sure how fingerprint scanners are tied into secure boot, maybe they could be used to verify user intent too.
  - wizzwizz4 5y ago
    Okay, so the app's running. Except the app is remote-controlled by a malicious “display driver” that waits for the user to do all this authentication set-up, transfers the money away, “are you sure”s it, then prevents the user from seeing any of the on-phone scam warnings until it's too late to reverse the transaction.
    - the8472 5y ago
      Display driver is part of the kernel, which is part of the trust chain.
      - wizzwizz4 5y ago
        Substitute “display driver” for a draw over other apps, “tap this dot” game, then.
        the8472 5y ago
        That's a standard feature and not related to unlocking the bootloader. Handling that properly wrt. sensitive apps has to be done anyway.
- fouric 5y ago
  "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." - C.S. Lewis Freedom to do what you want with the device you purchased is a right that is not to be infringed upon, especially not for the reason "the users might hurt themselves". Setting up a technically nontrivial flow to unlock the bootloader (e.g. connect the device to a machine with an SSH client, approve SSH connection request with scary message, SSH to the phone, execute a shell script that tells you that you shouldn't unlock this unless you know what you're doing, and after confirmation the script unlocks the bootloader) is more than enough of a deterrent for the vast majority of non-technical users. The remainder are acceptable casualties - people who refuse to read warning labels are going to have other bad things happen to them anyway (drinking poisons, injuring themselves while working with power-tools) as a result of their foolishness, and the solution to that is not to take away the power-tools from the whole population, but to train them to read and follow warning labels in the first place. Those technically skilled users who want to unlock their bootloaders (and, you know, do what they want with the devices they paid for) should not have to pay for the stupidity of a small minority of foolish people who refuse to read warning messages.
  - pjmlp 5y ago
    As it is a right for a manufactures to sell their devices configured as whatever they feel like. The consumer has the right to buy from companies that sell products that actually fit their purposes, like I don't know, a computer, instead of trying to replace the firmware in a toaster.
    - atq2119 5y ago
      As a society we have already decided that manufacturers can't just configure the devices they sell however they feel like. One of the most obvious restrictions is on how they configure any radios. fouric is merely arguing that there should be another, and you're not responding to their points. As such, your comments in this discussion, and this one in particular, do not appear to be in good faith.
      - 5y ago

pjmlp 5y ago

On this kind of devices the security chain of trust needs to take into consideration the same kind of users that fill their Internet Explorer with random toolbars from website popups. Not the user with a CS degree that knows what they are doing.

the8472 5y ago
Those kinds of users are unlikely to replace the root of trust, simply due to the process being onerous. And even if everyone were to install malware. There are other ways to secure banking. E.g. by providing an external token with a display. This is how hardware crypto wallets and some PIN generators for in-browser banking work. Or they could ask the owner to upload the attestation pubkey to their website, then the bank could still check if it's really their app that's running (as confirmed by the boot trust chain). I'm not sure how fingerprint scanners are tied into secure boot, maybe they could be used to verify user intent too.
- wizzwizz4 5y ago
  Okay, so the app's running. Except the app is remote-controlled by a malicious “display driver” that waits for the user to do all this authentication set-up, transfers the money away, “are you sure”s it, then prevents the user from seeing any of the on-phone scam warnings until it's too late to reverse the transaction.
  - the8472 5y ago
    Display driver is part of the kernel, which is part of the trust chain.
    - wizzwizz4 5y ago
      Substitute “display driver” for a draw over other apps, “tap this dot” game, then.
      - the8472 5y ago
        That's a standard feature and not related to unlocking the bootloader. Handling that properly wrt. sensitive apps has to be done anyway.
fouric 5y ago
"Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." - C.S. Lewis Freedom to do what you want with the device you purchased is a right that is not to be infringed upon, especially not for the reason "the users might hurt themselves". Setting up a technically nontrivial flow to unlock the bootloader (e.g. connect the device to a machine with an SSH client, approve SSH connection request with scary message, SSH to the phone, execute a shell script that tells you that you shouldn't unlock this unless you know what you're doing, and after confirmation the script unlocks the bootloader) is more than enough of a deterrent for the vast majority of non-technical users. The remainder are acceptable casualties - people who refuse to read warning labels are going to have other bad things happen to them anyway (drinking poisons, injuring themselves while working with power-tools) as a result of their foolishness, and the solution to that is not to take away the power-tools from the whole population, but to train them to read and follow warning labels in the first place. Those technically skilled users who want to unlock their bootloaders (and, you know, do what they want with the devices they paid for) should not have to pay for the stupidity of a small minority of foolish people who refuse to read warning messages.
- pjmlp 5y ago
  As it is a right for a manufactures to sell their devices configured as whatever they feel like. The consumer has the right to buy from companies that sell products that actually fit their purposes, like I don't know, a computer, instead of trying to replace the firmware in a toaster.
  - atq2119 5y ago
    As a society we have already decided that manufacturers can't just configure the devices they sell however they feel like. One of the most obvious restrictions is on how they configure any radios. fouric is merely arguing that there should be another, and you're not responding to their points. As such, your comments in this discussion, and this one in particular, do not appear to be in good faith.
    - 5y ago