4 ms·

Ask HN: How can there be cybersecurity in the long run if a screen renders text?

From the perspective of any payload reaching a user, isn't all cybersecurity open to attack vector once anything is rendered on the screen? Then that means a sufficiently advanced attacker can compromise all information by reading electromagnetic signals within the physical boundary of where the user _physically_ is and or additionally with any injection at the software or comms level. Is this a problem that can be solved? Any radical ideas that have been suggested?

retrac 5y ago
As described, it seems to be essentially the same attack as someone physically in a vault with secret papers. Buy a good lock and hire some guards?
- pyinstallwoes 5y ago
  But you don't have to be physically somewhere to read the electromagnetic signals. You just have to parse the signal. This can be done remotely.
  - retrac 5y ago
    You could always use EM shielding. Faraday cages are a thing and are used for this purpose in real-world high security installations as I understand it. But if the attacker can see in a line-of-sight way the same screen the intended recipient can, yes, there's really no defence.
  - dragonwriter 5y ago
    > But you don't have to be physically somewhere to read the electromagnetic signals. Your sensors has to be somewhere, and the further from the target, the more opportunity for (intentional or coincidental) shielding, jamming/noise, or just the inverse square law (or a combination) to make the signal unreadable.
rolph 5y ago
https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)
- pyinstallwoes 5y ago
  Exactly. Thank you. So ultimately, so security is an illusion unless everyone uses a unique language which is orthogonal to encryption but not exactly. The weakness of encryption is trusting the math behind it and it's general use vs non-general use of a unique language per person. Interesting stuff.
wmf 5y ago
No, reading stuff off a screen is not a problem; it won't let you bypass authentication or achieve remote code execution.
- pyinstallwoes 5y ago
  But if you know someone with access to the text then any screen they use is bypassing authentication if a signal can be remotely parsed identifying / spying on their screen. This is known to be done pretty easily...
dragonwriter 5y ago
> Then that means a sufficiently advanced attacker can compromise all information by reading electromagnetic signals within the physical boundary of where the user _physically_ is If an attacker can comprehensively monitor all EM signals where the target is, that pretty much eliminates all information (not jist cyber) security. Sure, it means they can read your screen, but it also means they can read the paper on your desk, too. Real attackers tend not to have omnidirectional high resolution full-EM-spectrum imagers in the target location. Realistic threats mostly have countermeasures; identifying the actual threat model faces, risks associated with your data, and which countermeasures are appropriate and worthwhile is...what the security profession does, and its a continuous arms race with attackers. If your standard for security is a 100% guarantee against unauthorized egress or insertion of data, no, nothing can guarantee that (but your biggest threats are probably still authorized users, not exotic external attacks, even if you are a high-value, government target.)

retrac 5y ago

As described, it seems to be essentially the same attack as someone physically in a vault with secret papers. Buy a good lock and hire some guards?

pyinstallwoes 5y ago
But you don't have to be physically somewhere to read the electromagnetic signals. You just have to parse the signal. This can be done remotely.
- retrac 5y ago
  You could always use EM shielding. Faraday cages are a thing and are used for this purpose in real-world high security installations as I understand it. But if the attacker can see in a line-of-sight way the same screen the intended recipient can, yes, there's really no defence.
- dragonwriter 5y ago
  > But you don't have to be physically somewhere to read the electromagnetic signals. Your sensors has to be somewhere, and the further from the target, the more opportunity for (intentional or coincidental) shielding, jamming/noise, or just the inverse square law (or a combination) to make the signal unreadable.

rolph 5y ago

https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)

pyinstallwoes 5y ago
Exactly. Thank you. So ultimately, so security is an illusion unless everyone uses a unique language which is orthogonal to encryption but not exactly. The weakness of encryption is trusting the math behind it and it's general use vs non-general use of a unique language per person. Interesting stuff.

wmf 5y ago

No, reading stuff off a screen is not a problem; it won't let you bypass authentication or achieve remote code execution.

pyinstallwoes 5y ago
But if you know someone with access to the text then any screen they use is bypassing authentication if a signal can be remotely parsed identifying / spying on their screen. This is known to be done pretty easily...

dragonwriter 5y ago

> Then that means a sufficiently advanced attacker can compromise all information by reading electromagnetic signals within the physical boundary of where the user _physically_ is If an attacker can comprehensively monitor all EM signals where the target is, that pretty much eliminates all information (not jist cyber) security. Sure, it means they can read your screen, but it also means they can read the paper on your desk, too. Real attackers tend not to have omnidirectional high resolution full-EM-spectrum imagers in the target location. Realistic threats mostly have countermeasures; identifying the actual threat model faces, risks associated with your data, and which countermeasures are appropriate and worthwhile is...what the security profession does, and its a continuous arms race with attackers. If your standard for security is a 100% guarantee against unauthorized egress or insertion of data, no, nothing can guarantee that (but your biggest threats are probably still authorized users, not exotic external attacks, even if you are a high-value, government target.)