6 ms·

Incorrect. Choice 2. Empowered user. The end user is free to CHOOSE to delegate the hardware's approved signing solutions to a third party. Possibly even a th

Incorrect. Choice 2. Empowered user. The end user is free to CHOOSE to delegate the hardware's approved signing solutions to a third party. Possibly even a third party that is already included in the base firmware such as Microsoft, Apple, OEM, 'Open Source' (sub menu: List of several reputable distros and a choice which might have a big scary message and involved confirmation process to trust the inserted boot media or the URL the user typed in...) There should also be a reset option, which might involve a jumper or physical key (E.G. clear CMOS) that factory resets any TPM / persistent storage. Yes it'd nuke everything in the enclave but it would release the hardware.

Barbing 1y ago
>big scary message Open question: Any idea on making it so difficult that grandma isn't even able to follow a phisher’s instructions over the phone but yet nearly trivial for anyone who knows what they’re doing?
- XorNot 1y ago
  Fix the phone system so calls must positively identify themselves. There is no reason anyone purporting to be from a business or the government should be able to place a call without cryptographically proving their identity.
  - Barbing 1y ago
    I like that! I’m sure it would take a little bit of time for folks to stop trusting calls from personal numbers where highly-capable social engineers do their best work, but eventually I expect nearly all of us would learn the lesson. And presumably we could set up notifications so our elderly relatives’ phones would alert us to calls from unverified numbers not in their contact list lasting longer than a minute or two.
- immibis 1y ago
  Stop gatekeeping actually useful apps. Nobody should never need to see the message to do anything they actually want to do, otherwise it leads to normalization of deviance. False positives from PC virus scanners are very rare.
  - hobs 1y ago
    What are you on about? The last 10 years of computing the only time windows defender pinged was on false positives.
  - Barbing 1y ago
    Interesting, mind elaborating a bit/clarifying the first couple of sentences there? A point I’d like to understand
- AnthonyMouse 1y ago
  Sure. You ship the device in open mode, and then doing it is easy. The device supports closed mode (i.e. whatever the currently configured package installation sources are, you can no longer add more), and if you put the device in closed mode, getting it back out requires attaching a debugger to the USB port, a big scary message and confirmation on the phone screen itself, and a full device wipe. Then you put grandma's device in closed mode and explicitly tell her never to do the scary thing that takes it back out again and call you immediately if anyone asks her to. Or, for someone who is not competent to follow that simple instruction (e.g. small children or senile adults), you make the factory reset require a password and then don't give it to them.
  - Barbing 1y ago
    Very nice! I’m sure I’m missing a problem with the following approach: shipping in _closed_ mode with a sticker on the front notifying the person they should do a factory reset immediately to make sure they can do everything they want to do. During the reset, include a scary message for those who opt in to get to open mode. Everyone simply goes by defaults so it would only be technical people presumably who would even get into the open mode in the first place. And then require the debugger to leave closed mode like you said. Edit: this comment worries about solo/asocial/“orphaned” members of our society
    - AnthonyMouse 1y ago
      The problem with that is the owner has to choose which package sources they want to allow before the device is in closed mode, because after that adding more requires the scary reset, and the vendor of course has the perverse incentive to ship the device in closed mode with only their own store enabled, which has to be prohibited because it's anti-competitive.
  - alkonaut 1y ago
    Make it an obscure option in the first time setup so all the users that click next next next will end up with the secure mode, while the open mode requires fiddling. This isn’t a gdpr opt out where both alternatives need to be equally easy. We (as a society) absolutely need the devices to default to the current model when purchased.
flomo 1y ago
Keep in mind one of these third parties would almost certainly be Meta (because users want their stuff), and that would almost certainly be a privacy downgrade.
- echelon 1y ago
  Freedom > Privacy > Security Never give up your freedom. If you have to give up your privacy to ensure your freedom, so be it. If you have to give up your security to ensure your privacy, so be it. This goes for governments and phones.
  - judge2020 1y ago
    > This goes for governments and phones. Apple does not have the ability to throw me in prison or take away my freedoms. Only to not grant me extra freedoms subsidized by their R&D budget.
    - echelon 1y ago
      Apple has removed your freedom from day one. Their R&D budget is at the expense of a free market that would have delivered the same or better products. Did you ever see how wild and innovative the Japanese mobile phones were before iPhone monoculture took over? I want crazy stuff like a smartphone that has the form factor of a Raspberry Pi. Or a smartphone with e-Ink. Crazy new categories of devices. Sadly, the Apple/Google monopoly has turned smartphones into one of the shittiest, most locked down device categories. It's a death place for innovation.
      - JSR_FDED 1y ago
        Nobody is forcing you to buy their products, so they haven’t taken away anything from you. If you do decide to buy their products, nothing has changed since the day of your purchase, so they haven’t taken away anything from you. Their “monoculture” didn’t “take hold” - it beat the Japanese offerings through innovation and a better product. They operate in a free market, their R&D budget is made possible by their market success. If things change in the market (e.g. AI) the market will vote the way it always does.
judge2020 1y ago
Consider the possibility of an evil maid type attack before a device is setup for the first time, e.g. running near identical iOS or macOS but with spyware preloaded, or even just adware.
- shakna 1y ago
  We already have that today. And locked down systems don't prevent it, because you can always exploit some part of the supply chain. A determined actor will always find a path.
  - judge2020 1y ago
    Right now you'd need a zero-day bootrom exploit to do something like this - still a possibility for the average high-level intelligence operative, but not the average white collar citizen. The proposal is making such a thing a feature.
    - shakna 1y ago
      Stuxnet did not require a bootrom zero day. Just people's propensity to plug in USB devices out of curiosity. You don't need the NSA to target someone and replace their device with a malware driven one. Just a porch pirate and your own delivery - two to three years and you're almost guaranteed an attack window.
- cyberax 1y ago
  This can be fixed by adding some user-controlled "fuse". For example, with a TPM you will lose access to stored keys if the boot sequence is modified.
- TheDong 1y ago
  It's possible to make this detectable, and chromebooks already do. On a chromebook, if you toggle to developer mode you get a nag screen on early-boot telling you it's in developer mode every time, and if you're not in developer mode you can only boot signed code. Basically, just bake into device's firmware that "if any non-apple keys have been added, forcibly display 'bootloader not signed by Apple, signed by X'", and if someone sees that on a "new" device, they'll know to run.
echelon 1y ago
This. We need a mobile bill of rights for this stuff. - The devices all of society has standardized upon should not be owned by companies after purchase. - The devices all of society has standardized upon should not have transactions be taxed by the companies that make them, nor have their activities monitored by the companies that make them. (Gaming consoles are very different than devices we use to do banking and read menus at restaurants.) - The devices all of society has standardized upon should not enforce rules for downstream software apart from heuristic scanning for viruses/abuse and strong security/permissions sandboxing that the user themselves controls. - The devices all of society has standardized upon should be strictly regulated by governments all around the world to ensure citizens and businesses cannot be strong-armed. - The devices all of society has standardized upon should be a burden for the limited few companies that gate keep them.
maxwelljxyz 1y ago
I like the way Chromebooks do things, initially locking down the hardware but allowing you to do whatever if you intentionally know what you're doing (after wiping the device for security reasons). It's a pity that there's all the Google tracking in them that's near impossible to delete (unless you remove Chrome OS).
- Krssst 1y ago
  I wonder if full device wipe would be the solution to "annoying enough that regular users don't do it even when asked by a scam, but power users can and will definitely use it".
  - dvdkon 1y ago
    That's how bootloader unlocking has worked on Android phones for ages, and I've never heard of it being abused, so I think it's a good model.
    - Krssst 1y ago
      If that comes to pass I hope that one would be able to install a regular firmware with full DRM support / banking app support which only differs by allowing one to install apps freely. I don't think that's the case currently with firmwares that allow root. The security implications are somewhat different (root is more permissive) but I guess that the kind of person that wants to run arbitrary apps also prefer root access (maybe not at the cost of access to everyday apps with bullshit protections however).
      - dvdkon 1y ago
        I agree, if Google's going to disallow "normal users" from installing apps from unknown sources, I'd like there to be some escape hatch other than the (increasingly blocked) nuclear option of rooting/bootloader unlock.
- inetknght 1y ago
  > I like the way Chromebooks do things, initially locking down the hardware but allowing you to do whatever if you intentionally know what you're doing Did you hear? Google's not allowing "sideloading" (whitewashing the meaning of installing) third party apps by unknown developers. > after wiping the device for security reasons Think of the ~~children~~ data!
moi2388 1y ago
Incorrect. For us as tech people this is an option. My older family members will definitely install malware and send all their data to China. Please don’t let me go back to the early days of the internet where my mother had 50 toolbars and malware installed
- pjerem 1y ago
  > Please don’t let me go back to the early days of the internet where my mother had 50 toolbars and malware installed I removed hundreds of toolbars from my mother/grandmother/anyone computer. I still prefer that to techno-fascism where it's ok for companies to brick my hardware remotely, to lock me out of all my hardware because I have a picture of my kid in a bath, to read all my messages for whatever reason, to extract value from my personal files, pictures, musical tastes, to not allow me to install an app I bought because it have been removed from the store, to not allow me to install an app my friend created, to not allow me to create an app and sell it myself, to not allow me to not do the action ever but just "Later this week", and so on and so on. This toolbar thing is a wrong excuse. And it was 90% because Windows was shitty. Most mothers would have easily downloaded and installed crapware embedded with whatever they downloaded, but most mothers aren't doing to go to "Settings > About > Tap 10 times on OS version > Bootloader > Disable Bootloader protection > "Are you sure because your phone will become insecure ?" > Yes > Fucking yes. And if they still do it to purposefully install malware, I'm sorry to say they are just stupid and I cannot care less about the toolbars.
  - moi2388 1y ago
    Yes. So both options should be allowed to exist. One of them shouldn’t be banned because you don’t like it.

Barbing 1y ago

>big scary message Open question: Any idea on making it so difficult that grandma isn't even able to follow a phisher’s instructions over the phone but yet nearly trivial for anyone who knows what they’re doing?

XorNot 1y ago
Fix the phone system so calls must positively identify themselves. There is no reason anyone purporting to be from a business or the government should be able to place a call without cryptographically proving their identity.
- Barbing 1y ago
  I like that! I’m sure it would take a little bit of time for folks to stop trusting calls from personal numbers where highly-capable social engineers do their best work, but eventually I expect nearly all of us would learn the lesson. And presumably we could set up notifications so our elderly relatives’ phones would alert us to calls from unverified numbers not in their contact list lasting longer than a minute or two.
immibis 1y ago
Stop gatekeeping actually useful apps. Nobody should never need to see the message to do anything they actually want to do, otherwise it leads to normalization of deviance. False positives from PC virus scanners are very rare.
- hobs 1y ago
  What are you on about? The last 10 years of computing the only time windows defender pinged was on false positives.
- Barbing 1y ago
  Interesting, mind elaborating a bit/clarifying the first couple of sentences there? A point I’d like to understand
AnthonyMouse 1y ago
Sure. You ship the device in open mode, and then doing it is easy. The device supports closed mode (i.e. whatever the currently configured package installation sources are, you can no longer add more), and if you put the device in closed mode, getting it back out requires attaching a debugger to the USB port, a big scary message and confirmation on the phone screen itself, and a full device wipe. Then you put grandma's device in closed mode and explicitly tell her never to do the scary thing that takes it back out again and call you immediately if anyone asks her to. Or, for someone who is not competent to follow that simple instruction (e.g. small children or senile adults), you make the factory reset require a password and then don't give it to them.
- Barbing 1y ago
  Very nice! I’m sure I’m missing a problem with the following approach: shipping in _closed_ mode with a sticker on the front notifying the person they should do a factory reset immediately to make sure they can do everything they want to do. During the reset, include a scary message for those who opt in to get to open mode. Everyone simply goes by defaults so it would only be technical people presumably who would even get into the open mode in the first place. And then require the debugger to leave closed mode like you said. Edit: this comment worries about solo/asocial/“orphaned” members of our society
  - AnthonyMouse 1y ago
    The problem with that is the owner has to choose which package sources they want to allow before the device is in closed mode, because after that adding more requires the scary reset, and the vendor of course has the perverse incentive to ship the device in closed mode with only their own store enabled, which has to be prohibited because it's anti-competitive.
- alkonaut 1y ago
  Make it an obscure option in the first time setup so all the users that click next next next will end up with the secure mode, while the open mode requires fiddling. This isn’t a gdpr opt out where both alternatives need to be equally easy. We (as a society) absolutely need the devices to default to the current model when purchased.

flomo 1y ago

Keep in mind one of these third parties would almost certainly be Meta (because users want their stuff), and that would almost certainly be a privacy downgrade.

echelon 1y ago
Freedom > Privacy > Security Never give up your freedom. If you have to give up your privacy to ensure your freedom, so be it. If you have to give up your security to ensure your privacy, so be it. This goes for governments and phones.
- judge2020 1y ago
  > This goes for governments and phones. Apple does not have the ability to throw me in prison or take away my freedoms. Only to not grant me extra freedoms subsidized by their R&D budget.
  - echelon 1y ago
    Apple has removed your freedom from day one. Their R&D budget is at the expense of a free market that would have delivered the same or better products. Did you ever see how wild and innovative the Japanese mobile phones were before iPhone monoculture took over? I want crazy stuff like a smartphone that has the form factor of a Raspberry Pi. Or a smartphone with e-Ink. Crazy new categories of devices. Sadly, the Apple/Google monopoly has turned smartphones into one of the shittiest, most locked down device categories. It's a death place for innovation.
    - JSR_FDED 1y ago
      Nobody is forcing you to buy their products, so they haven’t taken away anything from you. If you do decide to buy their products, nothing has changed since the day of your purchase, so they haven’t taken away anything from you. Their “monoculture” didn’t “take hold” - it beat the Japanese offerings through innovation and a better product. They operate in a free market, their R&D budget is made possible by their market success. If things change in the market (e.g. AI) the market will vote the way it always does.

judge2020 1y ago

Consider the possibility of an evil maid type attack before a device is setup for the first time, e.g. running near identical iOS or macOS but with spyware preloaded, or even just adware.

shakna 1y ago
We already have that today. And locked down systems don't prevent it, because you can always exploit some part of the supply chain. A determined actor will always find a path.
- judge2020 1y ago
  Right now you'd need a zero-day bootrom exploit to do something like this - still a possibility for the average high-level intelligence operative, but not the average white collar citizen. The proposal is making such a thing a feature.
  - shakna 1y ago
    Stuxnet did not require a bootrom zero day. Just people's propensity to plug in USB devices out of curiosity. You don't need the NSA to target someone and replace their device with a malware driven one. Just a porch pirate and your own delivery - two to three years and you're almost guaranteed an attack window.
cyberax 1y ago
This can be fixed by adding some user-controlled "fuse". For example, with a TPM you will lose access to stored keys if the boot sequence is modified.
TheDong 1y ago
It's possible to make this detectable, and chromebooks already do. On a chromebook, if you toggle to developer mode you get a nag screen on early-boot telling you it's in developer mode every time, and if you're not in developer mode you can only boot signed code. Basically, just bake into device's firmware that "if any non-apple keys have been added, forcibly display 'bootloader not signed by Apple, signed by X'", and if someone sees that on a "new" device, they'll know to run.

echelon 1y ago

This. We need a mobile bill of rights for this stuff. - The devices all of society has standardized upon should not be owned by companies after purchase. - The devices all of society has standardized upon should not have transactions be taxed by the companies that make them, nor have their activities monitored by the companies that make them. (Gaming consoles are very different than devices we use to do banking and read menus at restaurants.) - The devices all of society has standardized upon should not enforce rules for downstream software apart from heuristic scanning for viruses/abuse and strong security/permissions sandboxing that the user themselves controls. - The devices all of society has standardized upon should be strictly regulated by governments all around the world to ensure citizens and businesses cannot be strong-armed. - The devices all of society has standardized upon should be a burden for the limited few companies that gate keep them.

maxwelljxyz 1y ago

I like the way Chromebooks do things, initially locking down the hardware but allowing you to do whatever if you intentionally know what you're doing (after wiping the device for security reasons). It's a pity that there's all the Google tracking in them that's near impossible to delete (unless you remove Chrome OS).

Krssst 1y ago
I wonder if full device wipe would be the solution to "annoying enough that regular users don't do it even when asked by a scam, but power users can and will definitely use it".
- dvdkon 1y ago
  That's how bootloader unlocking has worked on Android phones for ages, and I've never heard of it being abused, so I think it's a good model.
  - Krssst 1y ago
    If that comes to pass I hope that one would be able to install a regular firmware with full DRM support / banking app support which only differs by allowing one to install apps freely. I don't think that's the case currently with firmwares that allow root. The security implications are somewhat different (root is more permissive) but I guess that the kind of person that wants to run arbitrary apps also prefer root access (maybe not at the cost of access to everyday apps with bullshit protections however).
    - dvdkon 1y ago
      I agree, if Google's going to disallow "normal users" from installing apps from unknown sources, I'd like there to be some escape hatch other than the (increasingly blocked) nuclear option of rooting/bootloader unlock.
inetknght 1y ago
> I like the way Chromebooks do things, initially locking down the hardware but allowing you to do whatever if you intentionally know what you're doing Did you hear? Google's not allowing "sideloading" (whitewashing the meaning of installing) third party apps by unknown developers. > after wiping the device for security reasons Think of the ~~children~~ data!

moi2388 1y ago

Incorrect. For us as tech people this is an option. My older family members will definitely install malware and send all their data to China. Please don’t let me go back to the early days of the internet where my mother had 50 toolbars and malware installed

pjerem 1y ago
> Please don’t let me go back to the early days of the internet where my mother had 50 toolbars and malware installed I removed hundreds of toolbars from my mother/grandmother/anyone computer. I still prefer that to techno-fascism where it's ok for companies to brick my hardware remotely, to lock me out of all my hardware because I have a picture of my kid in a bath, to read all my messages for whatever reason, to extract value from my personal files, pictures, musical tastes, to not allow me to install an app I bought because it have been removed from the store, to not allow me to install an app my friend created, to not allow me to create an app and sell it myself, to not allow me to not do the action ever but just "Later this week", and so on and so on. This toolbar thing is a wrong excuse. And it was 90% because Windows was shitty. Most mothers would have easily downloaded and installed crapware embedded with whatever they downloaded, but most mothers aren't doing to go to "Settings > About > Tap 10 times on OS version > Bootloader > Disable Bootloader protection > "Are you sure because your phone will become insecure ?" > Yes > Fucking yes. And if they still do it to purposefully install malware, I'm sorry to say they are just stupid and I cannot care less about the toolbars.
- moi2388 1y ago
  Yes. So both options should be allowed to exist. One of them shouldn’t be banned because you don’t like it.