7 ms·

Do you trust your bios? Your usb stack? Your network card firmware? I get the desire to control the entire chain, but nowadays you’re surrounded by cameras and

by gizmo 4y ago

Do you trust your bios? Your usb stack? Your network card firmware? I get the desire to control the entire chain, but nowadays you’re surrounded by cameras and microphones 24/7, every smart device is a surveillance sleeper agent waiting for the magic word. Certificate chains are the least of your worries.

unyttigfjelltol 4y ago
Anything your monitor displays or sound system outputs is subject to ubiquitous surveillance. And, when there's a gap in the surveillance that's also is subject to interpretation. Privacy already is (mostly) lost and the battle now simply is to reliably establish authenticity that can't be impersonated or doubted. That's where encryption remains helpful.
- gizmo 4y ago
  I agree. And moving to e2ee for everything and away from big services like gmail and office 365 is part of the solution.
- CapstanRoller 4y ago
  You don't even have to emit signals. Consumer WiFi equipment can already be used as active radar[0] to track individual movement, and ubiquitous deployment of dense high-frequency cellular networking equipment (5G, 6G) will basically render most house walls transparent (especially if you're living in a USAmerican stick-framed drywall house) potentially allowing for things like face tracking at a distance. [0] https://www.youtube.com/watch?v=HgDdaMy8KNE https://www.youtube.com/watch?v=HgDdaMy8KNE
  - anonym29 4y ago
    The upside of this is that it just created a business opportunity for Faraday paint :)
    - geysersam 4y ago
      Being the one guy in the neighborhood using faraday paint does not sound suspicious at all. ;)
      - raxxorraxor 4y ago
        Not at all unusual, especially for modern buildings. Thermic film on windows are a huge problem for relevant frequencies, wifi or broadband.
      - anonym29 4y ago
        If it's indoors, would anyone outside even know?
        geysersam 4y ago
        Yes if they're trying to monitor you.
        anonym29 4y ago
        If your threat model is people who you already know are trying to monitor you, isn't it implied that they think you're suspicious with or without the paint?
- raxxorraxor 4y ago
  I disagree. It is still quite trivial to reasonably exchange information without anyone being able to eavesdrop on it. Authenticity isn't important if the message content can be verified. It can even pose a danger. People like to attack the messenger, especially if he has a point. Don't know about your devices, but mine do not put me under surveillance. Smartphones are critical, but even those are controllable. If you are in public you won't know, but otherwise you can be reasonably safe.
fsflover 4y ago
> Do you trust your bios? Yes, it's Coreboot with disabled and neutralized Intel ME. > Your usb stack? No, it's isolated in a dedicated, hardware-virtualized VM on Qubes OS. > Your network card firmware? Same as above. And it's FLOSS. > surrounded by cameras and microphones For those, I have hardware kill switches. On the phone, too.
- t0bia_s 4y ago
  Your devices are not only one around you.
- KirillPanov 4y ago
  > disabled and neutralized Intel ME Pinky swear.
  - fsflover 4y ago
    https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/
- anonym29 4y ago
  Not even running a CPU with open source microcode implementing an open source ISA? Pfff, casual! /s
  - intelVISA 4y ago
    Breadboard processor and custom ISA would be wise here.
- pietrushnic 4y ago
  > surrounded by cameras and microphones I'm using https://github.com/qubesos/qubes-video-companion https://github.com/qubesos/qubes-video-companion
KirillPanov 4y ago
> Do you trust your bios? Your usb stack? Your network card firmware? Sure, because I have the complete source code for all three of those things: https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/
- cyc116 4y ago
  But do you inspect all the source code?
  - KirillPanov 4y ago
    "You need to be able to increase the costs of getting caught" -- Edward Snowden Deliberately inserted malware, laying in plain sight in source code, is an existential risk for a company with a reputation like IBM's. Of course, there isn't a 100% guarantee of it being noticed, but a 1% chance of that happening is enough for them to tell the spooks to fuck off. Special Access Programs only work because God-mode coprocessors like the Intel ME ensure zero risk of blowback for the manufacturer. Force them to have skin in the game and they aren't pushovers anymore.

by gizmo 4y ago

unyttigfjelltol 4y ago

Anything your monitor displays or sound system outputs is subject to ubiquitous surveillance. And, when there's a gap in the surveillance that's also is subject to interpretation. Privacy already is (mostly) lost and the battle now simply is to reliably establish authenticity that can't be impersonated or doubted. That's where encryption remains helpful.

gizmo 4y ago
I agree. And moving to e2ee for everything and away from big services like gmail and office 365 is part of the solution.
CapstanRoller 4y ago
You don't even have to emit signals. Consumer WiFi equipment can already be used as active radar[0] to track individual movement, and ubiquitous deployment of dense high-frequency cellular networking equipment (5G, 6G) will basically render most house walls transparent (especially if you're living in a USAmerican stick-framed drywall house) potentially allowing for things like face tracking at a distance. [0] https://www.youtube.com/watch?v=HgDdaMy8KNE https://www.youtube.com/watch?v=HgDdaMy8KNE
- anonym29 4y ago
  The upside of this is that it just created a business opportunity for Faraday paint :)
  - geysersam 4y ago
    Being the one guy in the neighborhood using faraday paint does not sound suspicious at all. ;)
    - raxxorraxor 4y ago
      Not at all unusual, especially for modern buildings. Thermic film on windows are a huge problem for relevant frequencies, wifi or broadband.
    - anonym29 4y ago
      If it's indoors, would anyone outside even know?
      - geysersam 4y ago
        Yes if they're trying to monitor you.
        anonym29 4y ago
        If your threat model is people who you already know are trying to monitor you, isn't it implied that they think you're suspicious with or without the paint?
raxxorraxor 4y ago
I disagree. It is still quite trivial to reasonably exchange information without anyone being able to eavesdrop on it. Authenticity isn't important if the message content can be verified. It can even pose a danger. People like to attack the messenger, especially if he has a point. Don't know about your devices, but mine do not put me under surveillance. Smartphones are critical, but even those are controllable. If you are in public you won't know, but otherwise you can be reasonably safe.

fsflover 4y ago

> Do you trust your bios? Yes, it's Coreboot with disabled and neutralized Intel ME. > Your usb stack? No, it's isolated in a dedicated, hardware-virtualized VM on Qubes OS. > Your network card firmware? Same as above. And it's FLOSS. > surrounded by cameras and microphones For those, I have hardware kill switches. On the phone, too.

t0bia_s 4y ago
Your devices are not only one around you.
KirillPanov 4y ago
> disabled and neutralized Intel ME Pinky swear.
- fsflover 4y ago
  https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/
anonym29 4y ago
Not even running a CPU with open source microcode implementing an open source ISA? Pfff, casual! /s
- intelVISA 4y ago
  Breadboard processor and custom ISA would be wise here.
pietrushnic 4y ago
> surrounded by cameras and microphones I'm using https://github.com/qubesos/qubes-video-companion https://github.com/qubesos/qubes-video-companion

KirillPanov 4y ago

> Do you trust your bios? Your usb stack? Your network card firmware? Sure, because I have the complete source code for all three of those things: https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/

cyc116 4y ago
But do you inspect all the source code?
- KirillPanov 4y ago
  "You need to be able to increase the costs of getting caught" -- Edward Snowden Deliberately inserted malware, laying in plain sight in source code, is an existential risk for a company with a reputation like IBM's. Of course, there isn't a 100% guarantee of it being noticed, but a 1% chance of that happening is enough for them to tell the spooks to fuck off. Special Access Programs only work because God-mode coprocessors like the Intel ME ensure zero risk of blowback for the manufacturer. Force them to have skin in the game and they aren't pushovers anymore.