3 ms·

Or - better firmware attestation. You don’t need open source implementations, and in fact that wouldn’t help you if anyone can replace the firmware. You need cr

Or - better firmware attestation. You don’t need open source implementations, and in fact that wouldn’t help you if anyone can replace the firmware. You need cryptographically signed firmware that cannot be changed without a root of trust signing it.

fsflover 2y ago
I trust the community verification of a signed firmware distributed over the Internet much more than a sealed box that nobody can change. Who knows if it's compromised? Truly independent parties may not be able to access the later for attestation.
- Kirby64 2y ago
  Who verifies the firmware? Consumers can't be expected to do this. But, having a centralized firmware verification that is checked is necessary to prevent modification. Private keys for signing must, necessarily, be closed source otherwise anyone could just sign firmware that can do... who knows what.
  - fsflover 2y ago
    I never said that consumers would verify the firmware. They can however freely choose a third party only in case of FLOSS.
    - Kirby64 2y ago
      Permission to freely choose a third party or allow firmware from any third party permits unauthorized firmware, fundamentally. Unless you only allow third party firmware via some difficult to enable setting, then a malicious actor can just load third party firmware and nobody would be any safer.
      - fsflover 2y ago
        > permits unauthorized firmware And everyone has a possibility to replace it with a trusted one, unlike with a black box.
        Kirby64 2y ago
        This is worthless, though. If you can replace it, so can a malicious actor. And they can do it without you knowing. Nobody outside of the most extremely paranoid are going to reflash every single piece of firmware on their devices when they receive them, or periodically. If you physically cannot change the firmware since you don’t possess the keys to actually sign the firmware, then a malicious actor is prevented from modifying it. That’s what you want to prevent. The only other possibility is a one time cryptographic key that you add, that all firmware is signed with… but that means it’s worthless for the average user who won’t do that. Ultimately, the most safe is putting the root of trust in a company (Samsung, Apple, etc) since they can properly guarantee signed firmware. The only potential flaw is a nation state actor that compromises them and their keys (hopefully stored in an HSM). Which is likely easier to harden against than a nation state actor compromising you specifically.

fsflover 2y ago

I trust the community verification of a signed firmware distributed over the Internet much more than a sealed box that nobody can change. Who knows if it's compromised? Truly independent parties may not be able to access the later for attestation.

Kirby64 2y ago
Who verifies the firmware? Consumers can't be expected to do this. But, having a centralized firmware verification that is checked is necessary to prevent modification. Private keys for signing must, necessarily, be closed source otherwise anyone could just sign firmware that can do... who knows what.
- fsflover 2y ago
  I never said that consumers would verify the firmware. They can however freely choose a third party only in case of FLOSS.
  - Kirby64 2y ago
    Permission to freely choose a third party or allow firmware from any third party permits unauthorized firmware, fundamentally. Unless you only allow third party firmware via some difficult to enable setting, then a malicious actor can just load third party firmware and nobody would be any safer.
    - fsflover 2y ago
      > permits unauthorized firmware And everyone has a possibility to replace it with a trusted one, unlike with a black box.
      - Kirby64 2y ago
        This is worthless, though. If you can replace it, so can a malicious actor. And they can do it without you knowing. Nobody outside of the most extremely paranoid are going to reflash every single piece of firmware on their devices when they receive them, or periodically. If you physically cannot change the firmware since you don’t possess the keys to actually sign the firmware, then a malicious actor is prevented from modifying it. That’s what you want to prevent. The only other possibility is a one time cryptographic key that you add, that all firmware is signed with… but that means it’s worthless for the average user who won’t do that. Ultimately, the most safe is putting the root of trust in a company (Samsung, Apple, etc) since they can properly guarantee signed firmware. The only potential flaw is a nation state actor that compromises them and their keys (hopefully stored in an HSM). Which is likely easier to harden against than a nation state actor compromising you specifically.