4 ms·

What's wrong with using Windows for this? If the machine is air-gapped, you could run as antiquated or insecure system as you like. Windows seems perfectly prac

What's wrong with using Windows for this? If the machine is air-gapped, you could run as antiquated or insecure system as you like. Windows seems perfectly practical and it's easy to obtain a DVD install for it. The critical thing is to ensure you don't ever transfer nasty stuff to the machine. For the true paranoid, this means you are facing potential NSA zero-day vulnerabilities and such, so you could have the most patched version of Linux or Windows and still be at risk. Now, it still makes sense to start with a good system, but the weakness here, whatever your OS, is the trustworthiness of the data you transfer to it on USB.

sneak 13y ago
An air gap is just one layer of security. Not knowing if there are code exec backdoors, intentional or otherwise, in your kernel: a whole different ballgame. Schneier should know better.
- anologwintermut 13y ago
  or he knows that NSA can own both Windows and Linux. Which is probably true. At which point, he needs to 1) know his system is not yet owned and 2) that the encryption system he uses works and isn't backdoored. So about his only plausibly concern is if Truecrypt uses the Window's entropy pool switched to use say EC_DAUL_DRBG. That is a concern, but it's one with Truecrypt and can be checked. This is assuming that even for the NSA, having Window's identify and modify the truecrypt binary is impossible. Realistically, if you are worrying about that, you should worry about Intel chips doing the same thing. At which point, you're screwed no matter what OS you use.
  - larrys 13y ago
    Would add to this that he is in a sense a high value target by the fact that he is well known and has an agenda which others may not approve of. What might not be practical or possible with "anyone" becomes "possible" with a high value target. [1] I'm remembering back to OJ Simpson case back in the early 90's. The police did things to try to pin the crime on him (searching trashdumps) that they simply don't do or don't have the resources to do in ordinary cases. (They found nothing but they tried and went to an extraordinary effort to try and find some evidence against OJ.) [1] I'm wondering for example where physically the air gapped computer is kept and the physical security and/or alarms around that computer.
    - anologwintermut 13y ago
      Physical security is the least of his problems. You can mount a lot of tempest[0]/ attacks from across the street. http://en.wikipedia.org/wiki/Tempest_(codename) http://en.wikipedia.org/wiki/Tempest_(codename)
- ateeqs 13y ago
  And -you- would know that your open source OS does not have backdoors and zero-day vulnerabilities and such? Don't be silly.
  - Sami_Lehtinen 13y ago
    So what if they can't access those?
    - ateeqs 13y ago
      Who is "they" and what are "those"? Is "those" referring to zero-day vulnerabilities? You realize that a zero-day vulnerability means "they" accessed "those," right?
joe_the_user 13y ago
For one thing, Windows has all these standard "auto-run" systems that enable infection through simply inserting media.

sneak 13y ago

An air gap is just one layer of security. Not knowing if there are code exec backdoors, intentional or otherwise, in your kernel: a whole different ballgame. Schneier should know better.

anologwintermut 13y ago
or he knows that NSA can own both Windows and Linux. Which is probably true. At which point, he needs to 1) know his system is not yet owned and 2) that the encryption system he uses works and isn't backdoored. So about his only plausibly concern is if Truecrypt uses the Window's entropy pool switched to use say EC_DAUL_DRBG. That is a concern, but it's one with Truecrypt and can be checked. This is assuming that even for the NSA, having Window's identify and modify the truecrypt binary is impossible. Realistically, if you are worrying about that, you should worry about Intel chips doing the same thing. At which point, you're screwed no matter what OS you use.
- larrys 13y ago
  Would add to this that he is in a sense a high value target by the fact that he is well known and has an agenda which others may not approve of. What might not be practical or possible with "anyone" becomes "possible" with a high value target. [1] I'm remembering back to OJ Simpson case back in the early 90's. The police did things to try to pin the crime on him (searching trashdumps) that they simply don't do or don't have the resources to do in ordinary cases. (They found nothing but they tried and went to an extraordinary effort to try and find some evidence against OJ.) [1] I'm wondering for example where physically the air gapped computer is kept and the physical security and/or alarms around that computer.
  - anologwintermut 13y ago
    Physical security is the least of his problems. You can mount a lot of tempest[0]/ attacks from across the street. http://en.wikipedia.org/wiki/Tempest_(codename) http://en.wikipedia.org/wiki/Tempest_(codename)
ateeqs 13y ago
And -you- would know that your open source OS does not have backdoors and zero-day vulnerabilities and such? Don't be silly.
- Sami_Lehtinen 13y ago
  So what if they can't access those?
  - ateeqs 13y ago
    Who is "they" and what are "those"? Is "those" referring to zero-day vulnerabilities? You realize that a zero-day vulnerability means "they" accessed "those," right?

joe_the_user 13y ago

For one thing, Windows has all these standard "auto-run" systems that enable infection through simply inserting media.