4 ms·

How is it that in these discussions, apologists for removing user sovereignty become suddenly ignorant of every existing security solution (such as, in this cas

How is it that in these discussions, apologists for removing user sovereignty become suddenly ignorant of every existing security solution (such as, in this case, even plain old passwords), to claim the only way to secure a device is to hand control to the manufacturer? "How will I keep people from breaking into my cell if the warden doesn't lock it?"

Arnt 4y ago
I think that happens as soon as someone writes "Hope one day the norm is that users can get root". The quote is from upthread. I have a phone on my hand, no proof of purchase, no proof of ownership, no traceable path of transactions back to the manufacturer, should I be able to get root?
- car_analogy 4y ago
  That is a spectacularly, obtusely uncharitable interpretation of that statement. I didn't need proof of purchase, ownership, or a traceable path of transactions to the manufacturer when I got root on the PC I built. Or on my phone, for that matter. Yet somehow, it's now secure, and anyone else that gets their hands on it, won't be able to get root. This is the exact kind of amnesia I was talking about. Are you really unfamiliar with default passwords that one changes at boot, such as every consumer router has?
  - Arnt 4y ago
    Those passwords don't grant root access, they don't even grant access to execute general programs, far less to execute anything as root. Would you be happy if Google granted access to run Google-supplied programs as root, but not programs from anyone else? No?
    - cowtools 4y ago
      You're using an overly specific definition of the word "root access". "root access" in the context of this conversation just means the paramount ability to decide what runs on the computer (ownership secure boot keys, ability to modify OS, ability to change or remove userspace programs).
      - Arnt 4y ago
        In other words, root access does not require being able to run Total Commander as root, or SimpleSSHd? I have a NAS at home, "root access" doesn't mean that I would be able to back up the entire phone to that NAS?
        cowtools 4y ago
        Within this context, "root access" is "root" in the sense that it refers to whatever the highest level of privilege is (the root of the trust chain). It's like a tree where each program/agent can spawn subprograms/subagents with privileges that are a subset of its parents. With root access, you have the ultimate ability to decide what runs on the computer. Including programs that do not have root access or programs that prevent other programs from running with root access. If the highest level of privilege is secure boot (the ability to decide what OS runs on the device), then you can run an OS that lets you read everything off the filesystem, sure. But you can also run an OS that doesn't let you read everything off the filesystem. What matters is that if you have root, you (as a person) are at the top of the trust chain. It doesn't matter if the root permissions trickle down to seated users because you can change that if you're at the top.
- wly_cdgr 4y ago
  Yes
- josephcsible 4y ago
  The requirement to get root on it should be that you know the password to it, which thieves won't.
- hulitu 4y ago
  Yes. When you have physical access all bets are off.
- Arnt 4y ago
  Come to think of it, I think this is another instance of the "cause miracles" thing. No user ever gets root. What gets root is a process. "Grant root access to the owner" while blocking malware means that the OS kernel must distinguish whether a process is acting on behalf of the owner of the device, and has not deceived the owner about what the process will do. If the OS developer (Google in this case) does not do that, clearly the OS developer is evil or horribly incompetent, and anyone who thinks that what the OS currently does is reasonable is an apologist who comes creeping out of the woodwork. https://astralcodexten.substack.com/p/book-review-the-revolt-of-the-public https://astralcodexten.substack.com/p/book-review-the-revolt...
  - josephcsible 4y ago
    If granting me root access is incompatible with blocking malware, then I don't want my phone to block malware.
    - Arnt 4y ago
      Custom Android ROMs exist for you and me. Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. If a smartphone vendor wants to give a wide audience access to apps and the net, then the vendor has to cater to people like that neighbour. And that, in turn, means that it must be very, very, very difficult to social-engineer that neighbour into granting another app access to the data in the banking app. To my mind, protecting most people's savings is much more important than catering to people like you and me. You may disagree.
      - cowtools 4y ago
        >Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users? I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.
htkibar 4y ago
Because at customs etc. you can be forced to unlock your phone for example. Or your government might force you to install root certs etc. (Hi Kazakhstan!) So there is an argument to be made for “should it be possible”. I am saying this even though I would still prefer to be allowed to access everything in the system.
- cowtools 4y ago
  If you have a good enough password, you cannot be made to do unlock anything so long as your keys remain in your head, in contrast to what randall munroe believes https://imgs.xkcd.com/comics/security.png https://imgs.xkcd.com/comics/security.png The alternative is that the manufacturer holds control over your device, and when the government wants to get in, you're none the wiser.
  - htkibar 4y ago
    Can you elaborate on “you cannot be made to unlock anything”? Jail time, denying entry, a gun to your head are all potential ways I can think of. For manufacturer & government; it depends on which government. If we are talking of the US government; you are right. If we are talking about most smaller authoritarian regimes? Not so much.
    - cowtools 4y ago
      >Jail time, denying entry, a gun to your head are all potential ways I can think of. A gun may motivate someone to unlock their hard drive, but if they are are not sufficiently motivated then a gun cannot do anything. You could imagine a spy or a terrorist who prefers to die vs reveal important information, or a journalist who prefer to spend years in jail vs reveal an in-progress investigation that might get them assassinated. Really, rubber hose attacks are a question of motivation, not technical ability. If apple invented a feature that wiped your storage when you are detained by border guards in some tyrannical state, then you would probably just be tortured to death. In that case you would prefer the ability to unlock your device because the purpose of torture is not to reveal secrets, but to "persuade" you into revealing your secrets. It's a completely different mode of attack. If the manufacturer has control over the phone, and the gov. makes the manufacturer unlock it, then you will have no idea that you have been attacked, or how much information the gov has on you. They do not need to confront you at all. When only you have control over the phone, you will know when the government has access to your information, and what information they will have because they will need to torture it out of you. That's why this "crypto-nihilism" that munroe entertains is just stupid. It leads people to believe that cryptography doesn't matter when in reality it's a major hurdle for the government and corporations trying to exert tyrannical control over people. In his comic, Munroe doesn't present the case where the laptop is unencrypted which is often what gets journalists/protesters/spies' data leaked unbeknownst to them, and then their collaborators are killed in a car bomb weeks later. In the smartphone case, this has to do with manufacturers choosing to encourage low-entropy passwords that can be easily cracked (e.g. 4-digit pin), "secure boot" that isn't really secure, and biometrics that are not used for disk encryption. These are all intentional flaws. >For manufacturer & government; it depends on which government. If we are talking of the US government; you are right. If we are talking about most smaller authoritarian regimes? Not so much. North Korea? The government can simply ban phones that aren't backdoored. It's not a question of size, it's a question of technical competence. China, a much larger country than North Korea, is apparently only using user-space malware; you can still buy phones with unlocked bootloaders and run AOSP. And this assumes that you purchase your device from a manufacturer whose supply chain lies only within the jurisdiction of governments friendly to your interests, and also from a manufacturer that is friendly to your interests. I don't think I can name a single manufacturer I trust that much to control my hardware over the wire with no oversight, merely because all organizations can eventually succumb to corruption.

Arnt 4y ago

I think that happens as soon as someone writes "Hope one day the norm is that users can get root". The quote is from upthread. I have a phone on my hand, no proof of purchase, no proof of ownership, no traceable path of transactions back to the manufacturer, should I be able to get root?

car_analogy 4y ago
That is a spectacularly, obtusely uncharitable interpretation of that statement. I didn't need proof of purchase, ownership, or a traceable path of transactions to the manufacturer when I got root on the PC I built. Or on my phone, for that matter. Yet somehow, it's now secure, and anyone else that gets their hands on it, won't be able to get root. This is the exact kind of amnesia I was talking about. Are you really unfamiliar with default passwords that one changes at boot, such as every consumer router has?
- Arnt 4y ago
  Those passwords don't grant root access, they don't even grant access to execute general programs, far less to execute anything as root. Would you be happy if Google granted access to run Google-supplied programs as root, but not programs from anyone else? No?
  - cowtools 4y ago
    You're using an overly specific definition of the word "root access". "root access" in the context of this conversation just means the paramount ability to decide what runs on the computer (ownership secure boot keys, ability to modify OS, ability to change or remove userspace programs).
    - Arnt 4y ago
      In other words, root access does not require being able to run Total Commander as root, or SimpleSSHd? I have a NAS at home, "root access" doesn't mean that I would be able to back up the entire phone to that NAS?
      - cowtools 4y ago
        Within this context, "root access" is "root" in the sense that it refers to whatever the highest level of privilege is (the root of the trust chain). It's like a tree where each program/agent can spawn subprograms/subagents with privileges that are a subset of its parents. With root access, you have the ultimate ability to decide what runs on the computer. Including programs that do not have root access or programs that prevent other programs from running with root access. If the highest level of privilege is secure boot (the ability to decide what OS runs on the device), then you can run an OS that lets you read everything off the filesystem, sure. But you can also run an OS that doesn't let you read everything off the filesystem. What matters is that if you have root, you (as a person) are at the top of the trust chain. It doesn't matter if the root permissions trickle down to seated users because you can change that if you're at the top.
wly_cdgr 4y ago
Yes
josephcsible 4y ago
The requirement to get root on it should be that you know the password to it, which thieves won't.
hulitu 4y ago
Yes. When you have physical access all bets are off.
Arnt 4y ago
Come to think of it, I think this is another instance of the "cause miracles" thing. No user ever gets root. What gets root is a process. "Grant root access to the owner" while blocking malware means that the OS kernel must distinguish whether a process is acting on behalf of the owner of the device, and has not deceived the owner about what the process will do. If the OS developer (Google in this case) does not do that, clearly the OS developer is evil or horribly incompetent, and anyone who thinks that what the OS currently does is reasonable is an apologist who comes creeping out of the woodwork. https://astralcodexten.substack.com/p/book-review-the-revolt-of-the-public https://astralcodexten.substack.com/p/book-review-the-revolt...
- josephcsible 4y ago
  If granting me root access is incompatible with blocking malware, then I don't want my phone to block malware.
  - Arnt 4y ago
    Custom Android ROMs exist for you and me. Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. If a smartphone vendor wants to give a wide audience access to apps and the net, then the vendor has to cater to people like that neighbour. And that, in turn, means that it must be very, very, very difficult to social-engineer that neighbour into granting another app access to the data in the banking app. To my mind, protecting most people's savings is much more important than catering to people like you and me. You may disagree.
    - cowtools 4y ago
      >Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users? I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.

htkibar 4y ago

Because at customs etc. you can be forced to unlock your phone for example. Or your government might force you to install root certs etc. (Hi Kazakhstan!) So there is an argument to be made for “should it be possible”. I am saying this even though I would still prefer to be allowed to access everything in the system.

cowtools 4y ago
If you have a good enough password, you cannot be made to do unlock anything so long as your keys remain in your head, in contrast to what randall munroe believes https://imgs.xkcd.com/comics/security.png https://imgs.xkcd.com/comics/security.png The alternative is that the manufacturer holds control over your device, and when the government wants to get in, you're none the wiser.
- htkibar 4y ago
  Can you elaborate on “you cannot be made to unlock anything”? Jail time, denying entry, a gun to your head are all potential ways I can think of. For manufacturer & government; it depends on which government. If we are talking of the US government; you are right. If we are talking about most smaller authoritarian regimes? Not so much.
  - cowtools 4y ago
    >Jail time, denying entry, a gun to your head are all potential ways I can think of. A gun may motivate someone to unlock their hard drive, but if they are are not sufficiently motivated then a gun cannot do anything. You could imagine a spy or a terrorist who prefers to die vs reveal important information, or a journalist who prefer to spend years in jail vs reveal an in-progress investigation that might get them assassinated. Really, rubber hose attacks are a question of motivation, not technical ability. If apple invented a feature that wiped your storage when you are detained by border guards in some tyrannical state, then you would probably just be tortured to death. In that case you would prefer the ability to unlock your device because the purpose of torture is not to reveal secrets, but to "persuade" you into revealing your secrets. It's a completely different mode of attack. If the manufacturer has control over the phone, and the gov. makes the manufacturer unlock it, then you will have no idea that you have been attacked, or how much information the gov has on you. They do not need to confront you at all. When only you have control over the phone, you will know when the government has access to your information, and what information they will have because they will need to torture it out of you. That's why this "crypto-nihilism" that munroe entertains is just stupid. It leads people to believe that cryptography doesn't matter when in reality it's a major hurdle for the government and corporations trying to exert tyrannical control over people. In his comic, Munroe doesn't present the case where the laptop is unencrypted which is often what gets journalists/protesters/spies' data leaked unbeknownst to them, and then their collaborators are killed in a car bomb weeks later. In the smartphone case, this has to do with manufacturers choosing to encourage low-entropy passwords that can be easily cracked (e.g. 4-digit pin), "secure boot" that isn't really secure, and biometrics that are not used for disk encryption. These are all intentional flaws. >For manufacturer & government; it depends on which government. If we are talking of the US government; you are right. If we are talking about most smaller authoritarian regimes? Not so much. North Korea? The government can simply ban phones that aren't backdoored. It's not a question of size, it's a question of technical competence. China, a much larger country than North Korea, is apparently only using user-space malware; you can still buy phones with unlocked bootloaders and run AOSP. And this assumes that you purchase your device from a manufacturer whose supply chain lies only within the jurisdiction of governments friendly to your interests, and also from a manufacturer that is friendly to your interests. I don't think I can name a single manufacturer I trust that much to control my hardware over the wire with no oversight, merely because all organizations can eventually succumb to corruption.