4 ms·
Air-gapping really does seem like the only option for true security. It also makes it quite difficult to do anything of use with the machine. Since you can't
by aeternum 5y ago
Air-gapping really does seem like the only option for true security. It also makes it quite difficult to do anything of use with the machine. Since you can't control the supply-chain you should assume that the air-gapped machine is malicious/compromised and the only protection you have is the air-gap.
Thus any USB used to transfer data/software to the air-gapped machine should be destroyed immediately afterwards and you should probably use something like pen & paper as your only allowed output method.
- hanniabu 5y ago> use something like pen & paper Stainless steel and stamp/engraver
- hedora 5y agoAir gapping doesn't really work these days. It could make noises (even with capacitors) to transmit data, or cause voltage fluctuations that something else could read. I can imagine bootstrapping a system with trusted hardware (assuming you could get it) by typing in a bootloader + SHA implementation by hand, then using a narrow hardware interface to copy a trustworthy, audited operating system kernel (assuming that also existed) from some other host. The bootloader could check the SHA of that, and then bootstrap the system.
- aeternum 5y agoYou can't trust the compiler so you would have to type it in to assembly, and even that is questionable since huge amounts of the hardware's microcode is now reprogrammable. I still think air-gapping works it's just that you need a pretty large airgap. Turn on the shower, fire up the microwave, move around, and hit some incorrect keys with lots of deleting when entering passwords.