7 ms·
the way Bruce Schneier is now using GPG Which way is that? Also, from your Tinfoil Hat Linux link, this idea is hilariously awesome: Keystroke monitoring — T
by sillysaurus2 13y ago
the way Bruce Schneier is now using GPG
Which way is that?
Also, from your Tinfoil Hat Linux link, this idea is hilariously awesome:
Keystroke monitoring — THL has gpggrid, a wrapper for GPG that lets you use a video game style character entry system instead of typing in your passphrase. Keystroke loggers get a set of grid points, not your passphrase.
I wonder if it might be possible to implement that idea into other operating systems?
- MacsHeadroom 13y ago>Which way is that? https://www.schneier.com/contact.html https://www.schneier.com/contact.html All default settings, except the 4096-bit key length. See: https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp_a.html https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp...
- jlgreco 13y agoAir gapped with new hardware: "Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good." http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema... Air gapping is certainly not unprecedented, but individuals using it have traditionally been considered pretty "tinfoil-y". edit: "I wonder if it might be possible to implement that idea into other operating systems?" gpggrid itself could probably just be built on any other Linux install. Certainly it could be recreated. One of the neat features of TFL that I really like is the idea of blinking LEDs on the users keyboard instead of displaying things on screen. Effective? Who knows... but certainly amusing.
- Amadou 13y agoIF he was serious he would be burning CDs/DVDs instead of using a read-write USB stick. It is tedious, but blank media is cheap and there is precedent (that I'm sure Bruce is aware of): The DoD's own (classified) SIPRNet was infiltrated via a flash-drive based virus back in 2008. http://www.washingtonpost.com/wp-dyn/content/article/2010/08/24/AR2010082406154.html http://www.washingtonpost.com/wp-dyn/content/article/2010/08...
- 205guy 13y agoI kinda thought the same thing about flash-drive viruses, and why Bruce wasn't using CDs/DVDs instead. Then I realized if he was really serious, he wouldn't say what he's really using, and he'd have a USB honeypot plugged into his network-facing computer.
- Groxx 13y agoNamed "Iocane Powder" of course.
- officialjunk 13y ago"i'd bet my life on it..."
- jasomill 13y agoNote that he didn't say what software he's running on the new air-gapped computer. The difference between locking down one air-gapped PC running only software required for encryption and locking down the entire network of PCs running the wide variety of software required to do everything everyone needs to do on the SIPRnet is huge.
- enneff 13y agoAnother approach might be to set up an old-fashioned serial link between the machines. It's easy enough to observe and audit all the traffic that passes through a serial cable.
- darkarmani 13y agoSD cards have a physical switch you can flip for read-only.
- ohWhatever 13y agoYeah and my old Intel 486 Gateway 2000 had a Turbo button. What's your point?
- 13y ago
- rdtsc 13y agoSome agencies and contractors handling classified materials use air gaping sometimes as well.
- aheilbut 13y agoI hope he's using one of those USB condoms with his memory stick.
- singlow 13y agoWhen the battery gets low?
- Dylan16807 13y agoIt's a joke.
- tptacek 13y agoHe's not doing that because of concerns about PGP, just to be clear, but because his host computer isn't secure (none of ours are); he's doing basically the same thing as the people who run their browsers in a VM, or the same thing that security professionals tell business owners to do when they want to access their online banking.
- zdam 13y agoWhat do you tell business owners to do when accessing their online banking?
- tptacek 13y agoUse a machine that is used for absolutely nothing else.
- bashinator 13y agoHow many of them actually do?
- Tomte 13y agoGermany's best-selling PC magazine c't periodically distributes "Bankix" on their CD. It's a Linux live system (with permanent storage on a USB stick) geared specifically towards online banking. I believe that quite a few people actually use it. Of course the hardware is the same, but you get a clean single purpose software system.
- telephonetemp 13y ago> Germany's best-selling PC magazine c't periodically distributes "Bankix" on their CD. >I believe that quite a few people actually use it. That sounds like a great attack vector. How secure are factories where discs are pressed? Even without access to the factory you could buy a bunch of magazines and repackage them with compromised CDs.
- ohWhatever 13y agoGiven what we know about USB sticks, especially their use in Iran, you would have to be ABSOLUTELY FUCKING RETARDED to trust them. Oh so he encrypted his files, and walked them between his stand alone and his internet machines. Yeah, okay this established the file's integrity, and that's just fantastic. But what assurance does he have that the USB stick isn't getting infected on the internet machine, and then deploying stealth hacksaw services onto the standalone, to buffer and relay data and commands each time it jacks in? I mean, that's exactly what Stuxnet was designed to fucking do.
- sillysaurus2 13y agoI wish you'd made your point more gracefully, because then it would've been taken seriously. I had the exact same concern about him using USB sticks.
- rdl 13y agoIt's different if you own your own USB stick and only use that stick, and have the hosts configured correctly. Arbitrary USB devices picked up off the ground or provided by malicious people do terrify me, mainly because they can be keyboards or whatever in usb-stick physical packaging.
- jacquesm 13y agoEven USB sticks that are your own USB sticks could be keyboards or whatever. Unless you've verified it isn't a store bought USB stick is just as risky as one that you picked up from the street or that someone gave you, in both cases you have no idea 'where it's been' before it got into your possession.
- rdl 13y agoNo, the vast majority of USB sticks in the world are not pwned. If you randomly go out to purchase one in a large market, it's pretty likely to be safe. Things like the Bagram PX were concentrations of high value targets with only one source of supply. The general USB stick marketplace is a lot safer. In China they're often fake and thus unreliable (smaller than advertised), but in the US, I'd be pretty comfortable driving to a Best Buy 50 miles away and picking up a random USB token. A USB key someone hands you is much more likely to be a targeted attack. A USB key randomly lying on the ground outside a target is also much more likely to be an attack.
- WalterSear 13y agoI see a new product. The air gap - a micro computer that takes simple commands, like mail, ftp and get, to serve as a simple go between layer for people who want this kind of privacy. IMHO, the hard part would be creating the interface on the on the pc.
- frank_boyd 13y agoThe new product I see is 100% open hardware (in addition to open-source software). All the way down to the chip. This should be the new market: Companies inviting the whole world to inspect their hardware (in addition to firmware, software).
- onezeno 13y agoStuxnet jumped an air gap.
- raverbashing 13y agoWell, to be fair, this was in an OS that reads whatever is in a media you plug. KDE/Gnome do the same thing, and there are possible attacks there.
- w_t_payne 13y agoAir-gapping is really the only way to stay secure. Plus, I would worry about cameras, microphones and vibration monitors, so I would want to put the air-gapped machine in a room that is away from any other electronics. Ideally in some sort of faraday cage, or at least located a reasonable distance away from walls - to bring it up to TEMPEST (or similar) standards. Unfortunately, most of us do not have the space in our homes to do it properly, so we have to resign ourselves to losing control of our machines and our data.
- quantumpotato_ 13y agoJulian Assange worked on projects relating to maze navigation, theorizing that people could memorize the muscle sequences but not be able to tell them under pressure, or fail under pressure. Randomizing the position of landmarks eg. go to A, B, E, C, F, then showing a map could let the user enter a different sequence of keystrokes to get the same result.