7 ms·

Good to have if you run a dark net marketplace or a political disident ring from public libraries. An additional refinement is to autolock the device if a cert

by yholio 5y ago

Good to have if you run a dark net marketplace or a political disident ring from public libraries. An additional refinement is to autolock the device if a certain personal key combo (ex. Shit - vol up - vol down) is not pressed every few minutes in response to an audible click. If not unlocked in a minute or so with a complex password, the device halts to a disk encrypted state and unpowered ram, minimizing the window attackers have to recover RAM state.

kingcharles 5y ago
Exactly. You need something not for when your laptop is removed from you, but when you are removed from your laptop. Also, if you are being targeted this hard you need to have something for when you are left in front of your laptop and a gun is put to your head. Or the attackers threaten the welfare of your family.
- somedude895 5y ago
  > You need something not for when your laptop is removed from you, but when you are removed from your laptop. Yeah, this wouldn't have saved the admin of Alphabay, a now defunct darknet market. The FBI staged a car crash outside his house so when he'd come out to see what was going on they could arrest him and likely get to his laptop while it was unlocked. Then again, he really shouldn't have left his computer unlocked.
  - mdrzn 5y ago
    > Alphabay Related video is all I could find about this: https://www.youtube.com/watch?v=HXrXD1M6kXk https://www.youtube.com/watch?v=HXrXD1M6kXk
  - alias_neo 5y ago
    That seems like a great expense to go to for the sake of a possibility the guy might do more than peek out of the window and then go back to what they were doing. Surely there were a bunch of other options to consider before "let's stage a car crash"?
    - somedude895 5y ago
      I heard the story on the Darknet Diaries podcast. This article on Vice[0] seems to confirm it: > Phirippidis told the audience that the bureau managed to corner Cazes and arrest him while he was still logged in as the admin of AlphaBay by ramming a car through the front gate of his home in Thailand. [0] https://www.vice.com/en/article/59wwxx/fbi-airs-alexandre-cazes-alphabay-arrest-video https://www.vice.com/en/article/59wwxx/fbi-airs-alexandre-ca...
      - alias_neo 5y ago
        Thanks for the link, that was an interesting read. The part abour crashing it through his front gate makes it more likely he'll respond which makes more sense.
- matheusmoreira 5y ago
  If someome is pointing a gun at you, it's probably too late to do anything. There should probably be cameras and motion detectors monitoring the perimeter in order to provide early warning.
  - kingcharles 5y ago
    The second part is harder to defend against. I didn't flinch when LEO pointed a loaded gun at me and threatened to shoot me, but as soon as they threatened my wife I told them I would sign whatever fiction they wanted to write, which I did. It just took me close to 8 years of being in jail to get a judge to look at it and tell them off and throw out the document.
    - matheusmoreira 5y ago
      ... Police threatened your wife in order to make you sign a confession? That's extremely fucked up.
      - kingcharles 5y ago
        Yes. Stupid retards did it on video though, otherwise it wouldn't have been seen at all. This was after over an hour of threatening me and refusing my right to silence, not letting me speak to my lawyer, etc.
        at_a_remove 5y ago
        I would like to know more, if you're able. Eight years of false imprisonment sounds like lawsuit city, to me.
        kingcharles 5y ago
        It is. I filed suit for a lot of different claims related to this, the only one that stuck was the coerced statements. I filed in 2015 but it is still working through the federal court.
lmilcin 5y ago
The combo solution is not good enough, especially if you are in public. If you can be observed to use the combo (which you would have to be using regularly) somebody else could be pressing the combo or they could insert USB device that can generate the combo regularly. I would also add that locking your laptop is not safe enough if you are serious about this. There are devices that can exfiltrate information from what I understand almost every operating system through USB.
- marcodiego 5y ago
  > There are devices that can exfiltrate information from what I understand almost every operating system through USB. If that is true, then it is a vulnerability. You should file bug reports.
  - tjader 5y ago
    How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?
    - marcodiego 5y ago
      Keyboard and mouse plugged in after the system boots should only become effective after user permission is given using previously available devices. For more safety: any plugged usb device should lock your screen so that a password is required before it can be used.
    - sildur 5y ago
      With QubesOS. I just tried adding a keyboard and it simply showed me a pop up saying a USB keyboard has been attached. It won’t work until I attach it to a qube.
      - goodpoint 5y ago
        usbguard does that without the need for Qubes.
Jerrrry 5y ago
Instead of a personal key combo, a dongle with an OTP code. Both the dongle and the computer have accelerometer-bump-tilt-oh-fuck-support. A OTP has to be entered every 5 minutes, or a secure screen/dead sequence starts. Sudden accelerated movements or a lack of presence-detection would also start the sequence.
- MayeulC 5y ago
  I once wrote a script to automatically lock my computer if I got too far away from it, back when I was wearing a bluetooth wristband. I guess you could do the same, but shut down the computer instead.
  - vkou 5y ago
    If the feds are pinching you for computer crime in a public space, this is exactly why they'd handcuff you, but keep you within ~10 feet of your laptop.
    - Jerrrry 5y ago
      heartbeat monitor. unless they hit you with the cryo, too.
      - ozfive 5y ago
        Brilliant! Going to go work on this now...
  - nefitty 5y ago
    Unfortunately, iOS-provided location resolution for use in shortcuts makes it worthless for in-home use. Unless you live in a mansion though I guess.
    - MayeulC 5y ago
      You are assuming the signal is strong enough to be read at a distance. I just used the RSSI, and going away a few meters was enough. Moreover, since that was just a nicety in case I forgot to lock my computer during a corridor conversation, I could get away with a longer timeout. A more sophisticated implementation could be done if you can write software on the device. A PineTime would be perfect for this. I am not sure why mention iOS specifically, a phone is easily forgettable. Moreover, you don't really need to rely on any location API provided by the system, even if UWB or Bluetooth Location Services would do wonders for this, a simple RTT latency measurement or RSSI value should be enough.
zionic 5y ago
Wouldn't it make sense to remove the battery on your laptop entirely? With a modified magsafe-like power cord any attempt to grab the machine hard-kills the system and RAM begins degrading immediately. Epoxy over the screw terminals would also delay an attacker long enough to prevent freezing the RAM with compressed air to try and dump RAM via an exploit kit.
- gruez 5y ago
  >Epoxy over the screw terminals would also delay an attacker... Might as well go all in and epoxy the ram sticks/dimm slot assembly.
  - ClumsyPilot 5y ago
    Would it cause overheating?
    - gruez 5y ago
      You don't have to douse the whole thing with expoxy. The dimm assembly looks like this: https://guide-images.cdn.ifixit.com/igi/dpYyM4oeOLPPTdpF.huge https://guide-images.cdn.ifixit.com/igi/dpYyM4oeOLPPTdpF.hug... Putting epoxy around the top and bottom edges (where the retention clips are) and the right edge (where the contacts are) should make it extremely difficult to dislodge, but not impact the thermal performance of the chips (the black rectangles).
  - dotancohen 5y ago
    Aren't they already soldered in place in modern laptops?
    - doubled112 5y ago
      Many laptops but not all laptops. I've noticed many lower end have one soldered and one removable. Drives me crazy because then you end up with more RAM but less performance, so have to choose which hit is worse.
FpUser 5y ago
Tried to find "Shit" key on my keyboard as it would save me a lot of time. No luck.
- yholio 5y ago
  You have to admit, that's a shift joke.
goodpoint 5y ago
> Good to have if you run a dark net marketplace or a political disident ring from public libraries. ...and expose the contents of the screen to any camera with a good zoom? And the passwords you type? Not good. It's just an very overpriced thing that can protect you from a thief and not the FBI.
- generalizations 5y ago
  He's making a reference to dread pirate Roberts. This was the threat model.

by yholio 5y ago

kingcharles 5y ago

Exactly. You need something not for when your laptop is removed from you, but when you are removed from your laptop. Also, if you are being targeted this hard you need to have something for when you are left in front of your laptop and a gun is put to your head. Or the attackers threaten the welfare of your family.

somedude895 5y ago
> You need something not for when your laptop is removed from you, but when you are removed from your laptop. Yeah, this wouldn't have saved the admin of Alphabay, a now defunct darknet market. The FBI staged a car crash outside his house so when he'd come out to see what was going on they could arrest him and likely get to his laptop while it was unlocked. Then again, he really shouldn't have left his computer unlocked.
- mdrzn 5y ago
  > Alphabay Related video is all I could find about this: https://www.youtube.com/watch?v=HXrXD1M6kXk https://www.youtube.com/watch?v=HXrXD1M6kXk
- alias_neo 5y ago
  That seems like a great expense to go to for the sake of a possibility the guy might do more than peek out of the window and then go back to what they were doing. Surely there were a bunch of other options to consider before "let's stage a car crash"?
  - somedude895 5y ago
    I heard the story on the Darknet Diaries podcast. This article on Vice[0] seems to confirm it: > Phirippidis told the audience that the bureau managed to corner Cazes and arrest him while he was still logged in as the admin of AlphaBay by ramming a car through the front gate of his home in Thailand. [0] https://www.vice.com/en/article/59wwxx/fbi-airs-alexandre-cazes-alphabay-arrest-video https://www.vice.com/en/article/59wwxx/fbi-airs-alexandre-ca...
    - alias_neo 5y ago
      Thanks for the link, that was an interesting read. The part abour crashing it through his front gate makes it more likely he'll respond which makes more sense.
matheusmoreira 5y ago
If someome is pointing a gun at you, it's probably too late to do anything. There should probably be cameras and motion detectors monitoring the perimeter in order to provide early warning.
- kingcharles 5y ago
  The second part is harder to defend against. I didn't flinch when LEO pointed a loaded gun at me and threatened to shoot me, but as soon as they threatened my wife I told them I would sign whatever fiction they wanted to write, which I did. It just took me close to 8 years of being in jail to get a judge to look at it and tell them off and throw out the document.
  - matheusmoreira 5y ago
    ... Police threatened your wife in order to make you sign a confession? That's extremely fucked up.
    - kingcharles 5y ago
      Yes. Stupid retards did it on video though, otherwise it wouldn't have been seen at all. This was after over an hour of threatening me and refusing my right to silence, not letting me speak to my lawyer, etc.
      - at_a_remove 5y ago
        I would like to know more, if you're able. Eight years of false imprisonment sounds like lawsuit city, to me.
        kingcharles 5y ago
        It is. I filed suit for a lot of different claims related to this, the only one that stuck was the coerced statements. I filed in 2015 but it is still working through the federal court.

lmilcin 5y ago

The combo solution is not good enough, especially if you are in public. If you can be observed to use the combo (which you would have to be using regularly) somebody else could be pressing the combo or they could insert USB device that can generate the combo regularly. I would also add that locking your laptop is not safe enough if you are serious about this. There are devices that can exfiltrate information from what I understand almost every operating system through USB.

marcodiego 5y ago
> There are devices that can exfiltrate information from what I understand almost every operating system through USB. If that is true, then it is a vulnerability. You should file bug reports.
- tjader 5y ago
  How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?
  - marcodiego 5y ago
    Keyboard and mouse plugged in after the system boots should only become effective after user permission is given using previously available devices. For more safety: any plugged usb device should lock your screen so that a password is required before it can be used.
  - sildur 5y ago
    With QubesOS. I just tried adding a keyboard and it simply showed me a pop up saying a USB keyboard has been attached. It won’t work until I attach it to a qube.
    - goodpoint 5y ago
      usbguard does that without the need for Qubes.

Jerrrry 5y ago

Instead of a personal key combo, a dongle with an OTP code. Both the dongle and the computer have accelerometer-bump-tilt-oh-fuck-support. A OTP has to be entered every 5 minutes, or a secure screen/dead sequence starts. Sudden accelerated movements or a lack of presence-detection would also start the sequence.

MayeulC 5y ago
I once wrote a script to automatically lock my computer if I got too far away from it, back when I was wearing a bluetooth wristband. I guess you could do the same, but shut down the computer instead.
- vkou 5y ago
  If the feds are pinching you for computer crime in a public space, this is exactly why they'd handcuff you, but keep you within ~10 feet of your laptop.
  - Jerrrry 5y ago
    heartbeat monitor. unless they hit you with the cryo, too.
    - ozfive 5y ago
      Brilliant! Going to go work on this now...
- nefitty 5y ago
  Unfortunately, iOS-provided location resolution for use in shortcuts makes it worthless for in-home use. Unless you live in a mansion though I guess.
  - MayeulC 5y ago
    You are assuming the signal is strong enough to be read at a distance. I just used the RSSI, and going away a few meters was enough. Moreover, since that was just a nicety in case I forgot to lock my computer during a corridor conversation, I could get away with a longer timeout. A more sophisticated implementation could be done if you can write software on the device. A PineTime would be perfect for this. I am not sure why mention iOS specifically, a phone is easily forgettable. Moreover, you don't really need to rely on any location API provided by the system, even if UWB or Bluetooth Location Services would do wonders for this, a simple RTT latency measurement or RSSI value should be enough.

zionic 5y ago

Wouldn't it make sense to remove the battery on your laptop entirely? With a modified magsafe-like power cord any attempt to grab the machine hard-kills the system and RAM begins degrading immediately. Epoxy over the screw terminals would also delay an attacker long enough to prevent freezing the RAM with compressed air to try and dump RAM via an exploit kit.

gruez 5y ago
>Epoxy over the screw terminals would also delay an attacker... Might as well go all in and epoxy the ram sticks/dimm slot assembly.
- ClumsyPilot 5y ago
  Would it cause overheating?
  - gruez 5y ago
    You don't have to douse the whole thing with expoxy. The dimm assembly looks like this: https://guide-images.cdn.ifixit.com/igi/dpYyM4oeOLPPTdpF.huge https://guide-images.cdn.ifixit.com/igi/dpYyM4oeOLPPTdpF.hug... Putting epoxy around the top and bottom edges (where the retention clips are) and the right edge (where the contacts are) should make it extremely difficult to dislodge, but not impact the thermal performance of the chips (the black rectangles).
- dotancohen 5y ago
  Aren't they already soldered in place in modern laptops?
  - doubled112 5y ago
    Many laptops but not all laptops. I've noticed many lower end have one soldered and one removable. Drives me crazy because then you end up with more RAM but less performance, so have to choose which hit is worse.

FpUser 5y ago

Tried to find "Shit" key on my keyboard as it would save me a lot of time. No luck.

yholio 5y ago
You have to admit, that's a shift joke.

goodpoint 5y ago

> Good to have if you run a dark net marketplace or a political disident ring from public libraries. ...and expose the contents of the screen to any camera with a good zoom? And the passwords you type? Not good. It's just an very overpriced thing that can protect you from a thief and not the FBI.

generalizations 5y ago
He's making a reference to dread pirate Roberts. This was the threat model.