3 ms·

If you’re worried about package interception I’d recommend just trying to buy your electronics at a local retailer. Decide which one you’re going to right as y

by varenc 4y ago

If you’re worried about package interception I’d recommend just trying to buy your electronics at a local retailer. Decide which one you’re going to right as you walk out the door so there’s no reasonable way someone can even predict where you’re going. Though if that’s a legitimate part of your threat model, you’re in a very difficult situation.

walterbell 4y ago
WFH has likely expanded the number of developers subject to such threats, e.g. those whose enterprise device access-from-home can be leveraged to compromise software supply chains.
lawl 4y ago
> Though if that’s a legitimate part of your threat model, you’re in a very difficult situation. Its probably (close to) impossible to establish a trust anchor in that situation. That trust anchor being the untampered image. How do you secure that? Yes you can send it to trusted friends, but at that point that just means they're now fair game too. Its definitely not safe on your phone because 0days now definitely are part of your threat model too. I think maybe if you make it your full time job, you might have a slim chance. But realistically you'd probably only manage that for a limited time.
- QuadmasterXLII 4y ago
  polaroid?
  - lawl 4y ago
    Sleep? This may sound overly paranoid, but if they can intercept your deliveries they'll be able to snap a picture of your house key and have covert entry. You'd probably need to barricade yourself in your bed room so that they cant get in without waking you up. Probably move the bed against the door so it can't be opened. At some point this just degenerates into requiring unreasonable paranoia and opsec. And unless you have a specific goal to achieve, it may just not be worth it. Plus airgaps against 0days. It's just purely very not fun I would assume.
    - walterbell 4y ago
      While many door locks can indeed be bypassed, it's straightforward for an occupant to keep an inward-opening door closed, by using a $25 door reinforcer, e.g. https://www.homedepot.com/p/Prime-Line-Door-Reinforcement-Lock-3-in-Stop-Aluminum-Construction-Satin-Nickel-Anodized-Finish-U-10827/202258432 https://www.homedepot.com/p/Prime-Line-Door-Reinforcement-Lo.... Bypassing that will involve time and noise. Enterprises hire professionals to provide physical and digital security. In time, they will extend those protections to harden the perimeter of their WFH employees, when needed to protect valuable corporate IP and privileged access. This includes tamper-detection on shipments of corporate equipment to WFH employees.

by varenc 4y ago

walterbell 4y ago

WFH has likely expanded the number of developers subject to such threats, e.g. those whose enterprise device access-from-home can be leveraged to compromise software supply chains.

lawl 4y ago

> Though if that’s a legitimate part of your threat model, you’re in a very difficult situation. Its probably (close to) impossible to establish a trust anchor in that situation. That trust anchor being the untampered image. How do you secure that? Yes you can send it to trusted friends, but at that point that just means they're now fair game too. Its definitely not safe on your phone because 0days now definitely are part of your threat model too. I think maybe if you make it your full time job, you might have a slim chance. But realistically you'd probably only manage that for a limited time.

QuadmasterXLII 4y ago
polaroid?
- lawl 4y ago
  Sleep? This may sound overly paranoid, but if they can intercept your deliveries they'll be able to snap a picture of your house key and have covert entry. You'd probably need to barricade yourself in your bed room so that they cant get in without waking you up. Probably move the bed against the door so it can't be opened. At some point this just degenerates into requiring unreasonable paranoia and opsec. And unless you have a specific goal to achieve, it may just not be worth it. Plus airgaps against 0days. It's just purely very not fun I would assume.
  - walterbell 4y ago
    While many door locks can indeed be bypassed, it's straightforward for an occupant to keep an inward-opening door closed, by using a $25 door reinforcer, e.g. https://www.homedepot.com/p/Prime-Line-Door-Reinforcement-Lock-3-in-Stop-Aluminum-Construction-Satin-Nickel-Anodized-Finish-U-10827/202258432 https://www.homedepot.com/p/Prime-Line-Door-Reinforcement-Lo.... Bypassing that will involve time and noise. Enterprises hire professionals to provide physical and digital security. In time, they will extend those protections to harden the perimeter of their WFH employees, when needed to protect valuable corporate IP and privileged access. This includes tamper-detection on shipments of corporate equipment to WFH employees.