4 ms·
Lol. Even if it's with the QR code, it will not be safe. If you can read a bit, you can read a file. Security is a mote, and the hacker is a catapult. Any suffi
by seeknotfind 2y ago
Lol. Even if it's with the QR code, it will not be safe. If you can read a bit, you can read a file. Security is a mote, and the hacker is a catapult. Any sufficiently complex system, any metric of security will be incomplete or ignoring that Turning complete and uncomputable. Security is about intelligence in all layers of the stack, from the electron to the application and even the front door. A USB exploit attacks a driver or the OS. A QR code attacks the application. There are other ways to exploit besides breaking and entering. Sometimes it's about influence. In the age of AI, the entire internet and all knowledge could be shifted to reframe a single organization to make an exploit possible. Pandora's box is wide open. It's pouring out. Even a machine on the internet can be secure, but an air gap is only the transport layer. It's a false sense of security. You need to be worried about the full stack because that's the only way to be safe, to never be safe, the eternal guard and gaze. The vigilance. Security in layers. Security in depth.
- iforgotpassword 2y agoArguably the qr-code based approach would be much safer, as it would be much simpler to implement and audit. Moving a USB key between two windows machines sounds as bad of an idea as it can get for airgapped data exchange.
- ben_w 2y agoOnly if it's done right; when I first made this image, the scanners built into phones straight up executed the JavaScript: https://benwheatley.github.io/blog/2017/04/2017-04-10-11-15-23.jpg https://benwheatley.github.io/blog/2017/04/2017-04-10-11-15-...
- mistercheph 2y agoSure, but if you have resources to spend validating the security of a tool, would you rather validate the QR parser or the USB stack?
- XorNot 2y agoThere are forensic USB write blockers which sit between the USB device and prevent host-writeback to the device.