3 ms·

Even the bit about taking the gear into the bathroom with him? The only threat model that thwarts is somebody physically tampering with it, which seems very par

Even the bit about taking the gear into the bathroom with him? The only threat model that thwarts is somebody physically tampering with it, which seems very paranoid to me.

pixl97 4y ago
> The only threat model that thwarts is somebody physically tampering with it, They way you state 'the only' seems to present a total misunderstanding of the fact that physical access is the number one easiest way to compromise just about any type of computing device that exists. If for example you went to any data center and attempted to get physical access without permission you would quickly find yourself accosted by armed personnel as to prevent the physical tampering you're talking about. In my work I must keep my laptop on my person, or otherwise locked up when I'm not using it to prevent physical access by others. This is in now way unique in the computer security industry.
- OkayPhysicist 4y ago
  For the vast majority of threat models, having someone you have a little bit of rapport with watch your locked computer is perfectly adequate. Realistically the bigger threat is someone stealing the laptop to sell, not as part of some targeted assault on your security. For that not to be adequate, your threat model needs to include field agents establishing a false sense of trust through some relationship, then leveraging that into an attack physical security. At some point you're getting really close to the "It's easier to bribe/blackmail/kidnap you" territory.
  - pixl97 4y ago
    In some businesses the risk of being blackmailed is high, but it also comes at significant risk of the blackmailed working as a double agent. If the affected agent has no idea they've been compromised it is unlikely they will change their behaviors in any manner. https://en.wikipedia.org/wiki/Evil_maid_attack https://en.wikipedia.org/wiki/Evil_maid_attack I mean in the case of desktop hardware, it's exceptionally easy to inline a USB key capture dongle.
- rippercushions 4y ago
  You seem to have a total misunderstanding about the threats this person faces. If your job is running seminars about IT security to random companies, taking the projector with you to the bathroom is ridiculous and your clients will think you're a tin foil hat weirdo to boot. Of course, if you're Snowden or Assange, your threat landscape is quite different and this would not be paranoid at all.
  - vorpalhex 4y ago
    The person does security seminars to major companies and connects his presentation hardware to hundreds of these companies on their internal network? His projector probably runs Android 7 (probably unsigned with who knows what mystery extras!). It would be an excellent attack vector.
    - rippercushions 4y ago
      No, he doesn't connect anything, that's why he has his own projector and cables. And if he did, most companies would be much more concerned about the risk they present to company networks.
  - caddemon 4y ago
    Yeah also anxiety disorders are a thing. It's entirely possible this person thinks/fears they may face threats that they actually don't.
jacquesm 4y ago
You have a poor understanding of what kind of things are possible with hardware under your control for a couple of minutes, say the length of your average bathroom break. I once had to hand in my laptop to some busybeaver borderguard who wanted access to it (impossible: wiped clean Chromebook, only to be re-installed on destination), I told him that if he took it out my sight he might as well keep it because it would be useless to me.

Even the bit about taking the gear into the bathroom with him? The only threat model that thwarts is somebody physically tampering with it, which seems very paranoid to me.

pixl97 4y ago

> The only threat model that thwarts is somebody physically tampering with it, They way you state 'the only' seems to present a total misunderstanding of the fact that physical access is the number one easiest way to compromise just about any type of computing device that exists. If for example you went to any data center and attempted to get physical access without permission you would quickly find yourself accosted by armed personnel as to prevent the physical tampering you're talking about. In my work I must keep my laptop on my person, or otherwise locked up when I'm not using it to prevent physical access by others. This is in now way unique in the computer security industry.

OkayPhysicist 4y ago
For the vast majority of threat models, having someone you have a little bit of rapport with watch your locked computer is perfectly adequate. Realistically the bigger threat is someone stealing the laptop to sell, not as part of some targeted assault on your security. For that not to be adequate, your threat model needs to include field agents establishing a false sense of trust through some relationship, then leveraging that into an attack physical security. At some point you're getting really close to the "It's easier to bribe/blackmail/kidnap you" territory.
- pixl97 4y ago
  In some businesses the risk of being blackmailed is high, but it also comes at significant risk of the blackmailed working as a double agent. If the affected agent has no idea they've been compromised it is unlikely they will change their behaviors in any manner. https://en.wikipedia.org/wiki/Evil_maid_attack https://en.wikipedia.org/wiki/Evil_maid_attack I mean in the case of desktop hardware, it's exceptionally easy to inline a USB key capture dongle.
rippercushions 4y ago
You seem to have a total misunderstanding about the threats this person faces. If your job is running seminars about IT security to random companies, taking the projector with you to the bathroom is ridiculous and your clients will think you're a tin foil hat weirdo to boot. Of course, if you're Snowden or Assange, your threat landscape is quite different and this would not be paranoid at all.
- vorpalhex 4y ago
  The person does security seminars to major companies and connects his presentation hardware to hundreds of these companies on their internal network? His projector probably runs Android 7 (probably unsigned with who knows what mystery extras!). It would be an excellent attack vector.
  - rippercushions 4y ago
    No, he doesn't connect anything, that's why he has his own projector and cables. And if he did, most companies would be much more concerned about the risk they present to company networks.
- caddemon 4y ago
  Yeah also anxiety disorders are a thing. It's entirely possible this person thinks/fears they may face threats that they actually don't.

jacquesm 4y ago

You have a poor understanding of what kind of things are possible with hardware under your control for a couple of minutes, say the length of your average bathroom break. I once had to hand in my laptop to some busybeaver borderguard who wanted access to it (impossible: wiped clean Chromebook, only to be re-installed on destination), I told him that if he took it out my sight he might as well keep it because it would be useless to me.