4 ms·

A "diode" is not an air gap. If there is any flow in either direction, you don't have an air gap. This isn't hard to understand.

Havoc 9mo ago
Unless the mossad is after you one way light based coms may as well be
stronglikedan 9mo ago
Last I checked, light does indeed cross gaps of air, so "air gapped" is at least more appropriate than your comment.
- hackstack 9mo ago
  By that logic, an open wifi router would be considered air gapped, n’est pas?
Alex2037 9mo ago
yes, but if your adversary is capable of exploiting a one-way diode to RCE, you might as well just give up.
- magicalhippo 9mo ago
  Prepare to give up I'd say[1][2]. [1]: https://arxiv.org/abs/1503.07919 https://arxiv.org/abs/1503.07919 [2]: https://arxiv.org/abs/2012.06884 https://arxiv.org/abs/2012.06884
  - Alex2037 9mo ago
    both of these require the isolated machine to be heavily compromised to begin with. there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,
    - wakawaka28 9mo ago
      Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.
      - tripletao 9mo ago
        In many industrial applications, the concern is mostly control of the isolated side, like because that could physically destroy stuff. Exfiltration is a smaller or nonexistent concern, since you're already sending most data out deliberately. So there's still an attack surface, but it's a lot smaller. Any side channel exploit would need to work (at least in some initial form) without changes to the software on the isolated side, since you otherwise can't bootstrap your way to installing it.
      - elevation 9mo ago
        If I gave away a PC with perfect RF isolation and a rock solid supply chain it wouldn’t improve most user’s overall security because their operational security is so poor. There is no need for any organization to snoop your RF when you’re leaking everything they care about in your metadata.
        wakawaka28 9mo ago
        Intercepting metadata requires a different type of surveillance which may not be possible. The metadata is not at all equivalent to what can be sniffed via RF, which can include your actual keystrokes and the pixels on your screen.
- UltraSane 9mo ago
  Yes, this is about as secure as any network connection can be made.
locusofself 9mo ago
Whether you want to define it as a true air gap or not, this is effectively how most "air gapped" clouds work, with diodes.
bigfatkitten 9mo ago
I don’t see what diving into pointless semantics adds to the discussion here.
- Y_Y 9mo ago
  Good thing it's only important semantics that are being dived into then
- MisterTea 9mo ago
  Because a company advertising security solutions who misunderstands basic terminology is highly suspect.
wakawaka28 9mo ago
There's only a couple of cases where this can go wrong. Either the contents of what is being sent out could be wrong, or the hardware itself could be tampered with to extract extra information on another optical or radio channel. Both of these require extensive software tampering. In the simple case where you trust the software on both sides, and the hardware, this can be practically as good as it gets (with the requirement that the inside be monitored automatically somehow).

Havoc 9mo ago

Unless the mossad is after you one way light based coms may as well be

stronglikedan 9mo ago

Last I checked, light does indeed cross gaps of air, so "air gapped" is at least more appropriate than your comment.

hackstack 9mo ago
By that logic, an open wifi router would be considered air gapped, n’est pas?

Alex2037 9mo ago

yes, but if your adversary is capable of exploiting a one-way diode to RCE, you might as well just give up.

magicalhippo 9mo ago
Prepare to give up I'd say[1][2]. [1]: https://arxiv.org/abs/1503.07919 https://arxiv.org/abs/1503.07919 [2]: https://arxiv.org/abs/2012.06884 https://arxiv.org/abs/2012.06884
- Alex2037 9mo ago
  both of these require the isolated machine to be heavily compromised to begin with. there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,
  - wakawaka28 9mo ago
    Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.
    - tripletao 9mo ago
      In many industrial applications, the concern is mostly control of the isolated side, like because that could physically destroy stuff. Exfiltration is a smaller or nonexistent concern, since you're already sending most data out deliberately. So there's still an attack surface, but it's a lot smaller. Any side channel exploit would need to work (at least in some initial form) without changes to the software on the isolated side, since you otherwise can't bootstrap your way to installing it.
    - elevation 9mo ago
      If I gave away a PC with perfect RF isolation and a rock solid supply chain it wouldn’t improve most user’s overall security because their operational security is so poor. There is no need for any organization to snoop your RF when you’re leaking everything they care about in your metadata.
      - wakawaka28 9mo ago
        Intercepting metadata requires a different type of surveillance which may not be possible. The metadata is not at all equivalent to what can be sniffed via RF, which can include your actual keystrokes and the pixels on your screen.
UltraSane 9mo ago
Yes, this is about as secure as any network connection can be made.

locusofself 9mo ago

Whether you want to define it as a true air gap or not, this is effectively how most "air gapped" clouds work, with diodes.

bigfatkitten 9mo ago

I don’t see what diving into pointless semantics adds to the discussion here.

Y_Y 9mo ago
Good thing it's only important semantics that are being dived into then
MisterTea 9mo ago
Because a company advertising security solutions who misunderstands basic terminology is highly suspect.

wakawaka28 9mo ago

There's only a couple of cases where this can go wrong. Either the contents of what is being sent out could be wrong, or the hardware itself could be tampered with to extract extra information on another optical or radio channel. Both of these require extensive software tampering. In the simple case where you trust the software on both sides, and the hardware, this can be practically as good as it gets (with the requirement that the inside be monitored automatically somehow).