5 ms·

It might be air gapped, but knowing the quality of electronics in those days, I would guess a C64 is not immune to data exfiltration via EM radiation through th

It might be air gapped, but knowing the quality of electronics in those days, I would guess a C64 is not immune to data exfiltration via EM radiation through the air or through the power supply or via the keyboard. :-)

snvzz 4y ago
I remember tuning in to C64's channel from a different room's TV. The RF encoder + cable acted as a transmitter.
- bobleeswagger 4y ago
  Back in my day, wireless was a bug, not a feature!
  - userbinator 4y ago
    Indeed, a bug in the other sense too.
  - Eleison23 4y ago
    Once in the early 90s, I was attached to a consulting firm whose primary goal was helping businesses get onto the Information Superhighway all the CEOs were buzzing about. We were granted a guided tour one night of a facility at the top of a skyscraper in San Diego. It was shrouded in mystery and government TLA programs. My boss was explaining parts of it to me. He said this is a TEMPEST secure facility. I'd never heard the term but when he described the principle to me it made a lot of sense. My father is a radio buff and raised me to learn all about electromagnetic stuff. The facility had conditioned power lines and shielded walls and partitions that could block EMR effectively to keep computing information safe from prying eyes. There were other fascinating Top Secret features of the facility that were explained to me that night. Of course the facility was not in operation and unmanned at the time of our unclassified tour. I was gobsmacked at the depth of real bona fide security measures and countermeasures, even in those primitive times.
CodeMage 4y ago
Van Eck phreaking FTW! :)
layer8 4y ago
It should be possible just from the monitor: https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking
- Sunspark 4y ago
  Yes, I remember when I was a child flipping through the UHF channels on my black and white tv, visible in the snow and static on one of the channels I could see the shapes in motion of my next door neighbour playing on his Atari 2600.
  - RustLove 4y ago
    That most likely was caused by an overpowered "RF Modulator" transmitting a strong enough signal for you to pick up. One popular model used UHF Channel 33 https://en.wikipedia.org/wiki/Sup%27R%27Mod https://en.wikipedia.org/wiki/Sup%27R%27Mod This is unrelated to "Van Eck Phreaking"
  - askiiart 4y ago
    Somewhat related: [(Theoretical) long range wireless NES video](https://youtu.be/8sQF_K9MqpA https://youtu.be/8sQF_K9MqpA)
ranger_danger 4y ago
Anyone who actually needs to be wary of this wouldn't be using a C64 anyways. Why do people feel the need to protect against such theoretical boogeymen that literally don't care about them?
- russelg 4y ago
  Did you miss the :-) at the end of their comment?
lrvick 4y ago
TOTP has far worse problems, like phishing. TOTP should only ever be implemented for low risk novelty use cases and any website that still supports it should be ashamed of themselves.
- Aaron2222 4y ago
  Sure, it may not be as secure as FIDO/WebAuthn, but it's a lot better than SMS/Email 2FA.
  - lrvick 4y ago
    Arguing SMS is better than TOTP is like arguing IE7 is better than IE6. Sure, but both are so far from being anywhere near a reasonable solution today I cannot understand why people make an argument like this seriously. Everyone has a webauthn capable device, if not multiple, right now. The only reason phishing is still a thing is because people keep implementing and defending phishable 2FA methods.
    - Aaron2222 4y ago
      iPhones have only just gotten support for acting as Bluetooth authenticators, and from what I can tell, Android devices have only had it for a year or so. So we only now seem to be at the point where most people would have a device they could use as a WebAuthn authenticator across multiple devices, making it only now a viable replacement for TOTP for most people (without buying a hardware authenticator). I don't see anything shameful about still supporting what was until recently the best option for most people. (Personally, I'll be waiting until 1Password gets WebAuthn support before moving to it from TOTP.)
      - lrvick 4y ago
        People can also use software browser-plugin authenticators, or software solutions provided by their operating systems. Even software anchored webauthn still stops far more threats than TOTP or SMS. That said few would need that fallback as TouchID or Chromebook authenticators or Windows Hello all work great too. 1Password is a centralized and proprietary database system that leaks all secrets to system memory every time you use one. Why would you want that to manage webauthn secrets for you? You just tap your webauthn device when prompted. No third party control required.

snvzz 4y ago

I remember tuning in to C64's channel from a different room's TV. The RF encoder + cable acted as a transmitter.

bobleeswagger 4y ago
Back in my day, wireless was a bug, not a feature!
- userbinator 4y ago
  Indeed, a bug in the other sense too.
- Eleison23 4y ago
  Once in the early 90s, I was attached to a consulting firm whose primary goal was helping businesses get onto the Information Superhighway all the CEOs were buzzing about. We were granted a guided tour one night of a facility at the top of a skyscraper in San Diego. It was shrouded in mystery and government TLA programs. My boss was explaining parts of it to me. He said this is a TEMPEST secure facility. I'd never heard the term but when he described the principle to me it made a lot of sense. My father is a radio buff and raised me to learn all about electromagnetic stuff. The facility had conditioned power lines and shielded walls and partitions that could block EMR effectively to keep computing information safe from prying eyes. There were other fascinating Top Secret features of the facility that were explained to me that night. Of course the facility was not in operation and unmanned at the time of our unclassified tour. I was gobsmacked at the depth of real bona fide security measures and countermeasures, even in those primitive times.

CodeMage 4y ago

Van Eck phreaking FTW! :)

layer8 4y ago

It should be possible just from the monitor: https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking

Sunspark 4y ago
Yes, I remember when I was a child flipping through the UHF channels on my black and white tv, visible in the snow and static on one of the channels I could see the shapes in motion of my next door neighbour playing on his Atari 2600.
- RustLove 4y ago
  That most likely was caused by an overpowered "RF Modulator" transmitting a strong enough signal for you to pick up. One popular model used UHF Channel 33 https://en.wikipedia.org/wiki/Sup%27R%27Mod https://en.wikipedia.org/wiki/Sup%27R%27Mod This is unrelated to "Van Eck Phreaking"
- askiiart 4y ago
  Somewhat related: [(Theoretical) long range wireless NES video](https://youtu.be/8sQF_K9MqpA https://youtu.be/8sQF_K9MqpA)

ranger_danger 4y ago

Anyone who actually needs to be wary of this wouldn't be using a C64 anyways. Why do people feel the need to protect against such theoretical boogeymen that literally don't care about them?

russelg 4y ago
Did you miss the :-) at the end of their comment?

lrvick 4y ago

TOTP has far worse problems, like phishing. TOTP should only ever be implemented for low risk novelty use cases and any website that still supports it should be ashamed of themselves.

Aaron2222 4y ago
Sure, it may not be as secure as FIDO/WebAuthn, but it's a lot better than SMS/Email 2FA.
- lrvick 4y ago
  Arguing SMS is better than TOTP is like arguing IE7 is better than IE6. Sure, but both are so far from being anywhere near a reasonable solution today I cannot understand why people make an argument like this seriously. Everyone has a webauthn capable device, if not multiple, right now. The only reason phishing is still a thing is because people keep implementing and defending phishable 2FA methods.
  - Aaron2222 4y ago
    iPhones have only just gotten support for acting as Bluetooth authenticators, and from what I can tell, Android devices have only had it for a year or so. So we only now seem to be at the point where most people would have a device they could use as a WebAuthn authenticator across multiple devices, making it only now a viable replacement for TOTP for most people (without buying a hardware authenticator). I don't see anything shameful about still supporting what was until recently the best option for most people. (Personally, I'll be waiting until 1Password gets WebAuthn support before moving to it from TOTP.)
    - lrvick 4y ago
      People can also use software browser-plugin authenticators, or software solutions provided by their operating systems. Even software anchored webauthn still stops far more threats than TOTP or SMS. That said few would need that fallback as TouchID or Chromebook authenticators or Windows Hello all work great too. 1Password is a centralized and proprietary database system that leaks all secrets to system memory every time you use one. Why would you want that to manage webauthn secrets for you? You just tap your webauthn device when prompted. No third party control required.