4 ms·

Please explain to me why an OS level signed and encrypted database isn’t secure

by cududa 2y ago

pjmlp 2y ago
The same reason banks get occasionally robbed, despite all security cameras, delayed openings, biometrics, armed security, and everything else put in place. When there is a will, there is eventually a way, for anyone with enough resources.
plonk 2y ago
Researchers on Twitter are saying that it’s just a plaintext SQLite.
page_fault 2y ago
Because it needs to be decrypted at some point?
verdverm 2y ago
When has windows ever been a safe or secure OS environment? Seems to me, many an exploit has been installed by the user while trying to get device drivers working
soraminazuki 2y ago
Why is a padlock with the key stuck right into it secure? The encrypted data and the decryption key is on the same physical device. Sure, memory isolation techniques may serve as a deterrent with extreme care. But if Microsoft increases the attack surface by sloppily integrating that feature everywhere in Windows, the yet-to-be-implemented-if-at-all encryption is going to be ineffective. And that’s going to happen more likely than not.
- plonk 2y ago
  Maybe the learning and inference can happen in a VM and the apps can only have access to a query API. (Take the equivalents if it's not all ML.)
  - plonk 2y ago
    Also, Windows Store apps seem to have an identity and limited permissions, so you can probably have some kind of smartphone OS-like isolation.
  - soraminazuki 2y ago
    That's exactly the kind of thing I was referring to when I wrote "memory isolation techniques." Even if you gate access with an API, you can still retrieve data from it and that's the problem. Also, it should be clear by now that government agencies are going to demand access to this data once this becomes widespread. VMs aren't going to protect against further assault on our civil liberties.
    - k8svet 2y ago
      How does that work? Can authorities compell Microsoft to surreptitiously have only my computer randomly unencrypt and submit stuff? If so, couldn't the authorities just tell MS to activate a tool like recall anyway?
      - soraminazuki 2y ago
        Authorities compel tech companies to hand over data and place backdoors. They typically abuse secrecy laws to avoid public backlash, but their public demands have gotten bolder since the Snowden disclosures. https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/ https://www.reuters.com/technology/cybersecurity/governments... https://www.techdirt.com/2016/02/16/no-judge-did-not-just-order-apple-to-break-encryption-san-bernardino-shooters-iphone-to-create-new-backdoor/ https://www.techdirt.com/2016/02/16/no-judge-did-not-just-or... https://www.bloomberg.com/news/features/2021-09-02/juniper-mystery-attacks-traced-to-pentagon-role-and-chinese-hackers https://www.bloomberg.com/news/features/2021-09-02/juniper-m... https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... https://www.reuters.com/article/idUSKCN1241YV/ https://www.reuters.com/article/idUSKCN1241YV/ http://www.techdirt.com/articles/20130614/02110223467/microsoft-said-to-give-zero-day-exploits-to-us-government-before-it-patches-them.shtml http://www.techdirt.com/articles/20130614/02110223467/micros... https://hn.algolia.com/?q=encryption%20ban https://hn.algolia.com/?q=encryption%20ban They even also do it without the companies' knowledge too. https://archive.is/2023.10.31-203648/https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://archive.is/2023.10.31-203648/https://www.washingtonp... https://www.eff.org/deeplinks/2015/11/its-no-secret-government-uses-zero-days-offense https://www.eff.org/deeplinks/2015/11/its-no-secret-governme... Have you been living under a rock this past decade?
bravetraveler 2y ago
People made it, people will break it Please explain to me how anything achieved infallible nature. Consider the natural vacuum is space.

Please explain to me why an OS level signed and encrypted database isn’t secure

by cududa 2y ago

Please explain to me why an OS level signed and encrypted database isn’t secure

The same reason banks get occasionally robbed, despite all security cameras, delayed openings, biometrics, armed security, and everything else put in place. When there is a will, there is eventually a way, for anyone with enough resources.

plonk 2y ago

Researchers on Twitter are saying that it’s just a plaintext SQLite.

page_fault 2y ago

Because it needs to be decrypted at some point?

verdverm 2y ago

When has windows ever been a safe or secure OS environment? Seems to me, many an exploit has been installed by the user while trying to get device drivers working

soraminazuki 2y ago

Why is a padlock with the key stuck right into it secure? The encrypted data and the decryption key is on the same physical device. Sure, memory isolation techniques may serve as a deterrent with extreme care. But if Microsoft increases the attack surface by sloppily integrating that feature everywhere in Windows, the yet-to-be-implemented-if-at-all encryption is going to be ineffective. And that’s going to happen more likely than not.

plonk 2y ago
Maybe the learning and inference can happen in a VM and the apps can only have access to a query API. (Take the equivalents if it's not all ML.)
- plonk 2y ago
  Also, Windows Store apps seem to have an identity and limited permissions, so you can probably have some kind of smartphone OS-like isolation.
- soraminazuki 2y ago
  That's exactly the kind of thing I was referring to when I wrote "memory isolation techniques." Even if you gate access with an API, you can still retrieve data from it and that's the problem. Also, it should be clear by now that government agencies are going to demand access to this data once this becomes widespread. VMs aren't going to protect against further assault on our civil liberties.
  - k8svet 2y ago
    How does that work? Can authorities compell Microsoft to surreptitiously have only my computer randomly unencrypt and submit stuff? If so, couldn't the authorities just tell MS to activate a tool like recall anyway?
    - soraminazuki 2y ago
      Authorities compel tech companies to hand over data and place backdoors. They typically abuse secrecy laws to avoid public backlash, but their public demands have gotten bolder since the Snowden disclosures. https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/ https://www.reuters.com/technology/cybersecurity/governments... https://www.techdirt.com/2016/02/16/no-judge-did-not-just-order-apple-to-break-encryption-san-bernardino-shooters-iphone-to-create-new-backdoor/ https://www.techdirt.com/2016/02/16/no-judge-did-not-just-or... https://www.bloomberg.com/news/features/2021-09-02/juniper-mystery-attacks-traced-to-pentagon-role-and-chinese-hackers https://www.bloomberg.com/news/features/2021-09-02/juniper-m... https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... https://www.reuters.com/article/idUSKCN1241YV/ https://www.reuters.com/article/idUSKCN1241YV/ http://www.techdirt.com/articles/20130614/02110223467/microsoft-said-to-give-zero-day-exploits-to-us-government-before-it-patches-them.shtml http://www.techdirt.com/articles/20130614/02110223467/micros... https://hn.algolia.com/?q=encryption%20ban https://hn.algolia.com/?q=encryption%20ban They even also do it without the companies' knowledge too. https://archive.is/2023.10.31-203648/https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://archive.is/2023.10.31-203648/https://www.washingtonp... https://www.eff.org/deeplinks/2015/11/its-no-secret-government-uses-zero-days-offense https://www.eff.org/deeplinks/2015/11/its-no-secret-governme... Have you been living under a rock this past decade?

bravetraveler 2y ago

People made it, people will break it Please explain to me how anything achieved infallible nature. Consider the natural vacuum is space.