6 ms·

EDIT: Holy smokes. I wasn't trying to be inflammatory. Sorry. I was only saying not to trust that this is an absolute guarantee that your laptop hasn't been

EDIT: Holy smokes. I wasn't trying to be inflammatory. Sorry. I was only saying not to trust that this is an absolute guarantee that your laptop hasn't been tampered with. Even the top comment is misleading -- "this doesn't prevent tampering, it just makes it obvious to you, as the laptop owner, that your machine has been tampered with. Still useful, but then what are you supposed to do about it?" This method provides no guarantee of detecting tampering. It provides a guarantee that if an adversary is dumb and unaware of this method, then they may break the seal and get themselves caught. But it's a bad idea to be confident that the seal itself is evidence you haven't been tampered with. Would anyone please explain which ideas are mistaken and why?

neohaven 13y ago
Did you read the article? It provides an idea for a tamper-evident seal. Nothing more.
- sillysaurus2 13y ago
  People are going to apply this tamper-evident seal and believe they are secure when it hasn't been tampered with. That's dangerous, because it assumes an adversary has no way of bypassing the seal. That's quite an assumption. And if you're not getting security guarantees, then what kind of security are you getting?
  - runjake 13y ago
    1.) This is just a particular method to detect tampering. It's pretty clever in a lot of ways. As mentioned elsewhere, try reading the article. 2.) The presenters specifically mention that this isn't the "be all/end all" of detecting tampering and the sort of people who would believe that probably have no interest in watching this presentation. Relax.
  - prawn 13y ago
    No one is actually going to do this, just talk about it. Further, those interested would be well aware of the limitations.
runjake 13y ago
You've went ahead and since heavily edited your comment after all the downvoting, but your initial comment was asinine and demonstrated that you had little understanding of the contents of the article (eg. probably didn't read the article). That's why you're seeing all of the downvotes.
- sillysaurus2 13y ago
  I read the article. It makes no mention of the fact that this isn't any guarantee your laptop hasn't been tampered with. Was it asinine to call this "another false sense of security" and "humans have invented ways around every lock in existence"? It felt very much like people were going out of their way to misread me, so I replaced my comment with one that was absolutely clear that I was saying "this provides no guaranteed way of detecting tampering." Which is true, no? I recently promised the mods that I'd try hard to be less inflammatory, and I was legitimately shocked to see my comment downvoted to oblivion when it seemed to contain no mistaken ideas. I'm doing my best to learn from this experience, but no one is providing anything for me to learn from. All I've learned is not to warn people about invalid security assumptions...
  - pessimizer 13y ago
    When somebody gives you tips on getting free food from restaurants, or saving money on your taxes, detecting whether someone has tampered with your computer, or X - arguing that you can't "trust that this is an absolute guarantee" of X is always going to be a strawman argument. You should save those arguments for people who actually claim that you can trust that their method Y is an absolute guarantee of X. Hint: the words "absolute" and "guarantee" will be in the post. edit: the only occurrence of "absolute" in the article: >Short of keeping a machine with you 24/7, there is little you can do to be absolutely sure these things don’t happen[....]
    - sillysaurus2 13y ago
      Ah. Makes sense, thank you. I'm sorry if I set up a strawman, and it's worrisome to think I'm doing this without realizing it. In order to not do that anymore, I'll need to figure out how my argument was a strawman. It seems like the only reason people are interested in this is because they're believing it provides some sort of security; else it wouldn't be interesting by definition. So it seemed reasonable in turn to point out that this method isn't reliable. I suppose that's literally the definition of a strawman (they never claimed it was absolutely reliable) but I'm trying to understand why it was bad to infer people would see this as a protection mechanism rather than a detection mechanism. I'll be careful about this sort of thing in the future though.
dredmorbius 13y ago
First off, there's a whole school and practice of security measures which is aimed more at revealing breaches than in preventing them, per se. Audits, tamper-evident seals, tell-tales placed in maps, watermarks in documents or images, and very large swaths of system monitoring, reporting, and alerting. Much of military electronic security "Orange Book" procedures have much more to do with auditing than they do securing data. Sometimes the goal is to determine what was taken or breached, sometimes who violated confidentiality (especially via watermarks or telltales), or how. In some cases, the goal may be to ensure/assess planted information was actually accessed. One counterintelligence mission, Operation Mincemeat from WWII involved landing a dead body (a deceased criminal if memory serves) with bogus military plans, and a pretty elaborate back-story, to mislead German intelligence into thinking an Allied attack would occur in Greece rather than Sicily. Part of the assessment of the plan involved determining whether or not the Germans had in fact examined the documents, and forensics showed that the corners of the papers indicated that they had been secured in a manner consistent with being photographed. https://en.wikipedia.org/wiki/Operation_Mincemeat https://en.wikipedia.org/wiki/Operation_Mincemeat Another case might be, say, a journalist who wanted to be able to positively demonstrate that electronics were accessed without authorization by officials (whether in a border crossing or some other means). The glitter polish trick would make for a useful and highly embarrassing bit of evidence which could be shown to the public in the form of before-after photographs. No, it doesn't prevent access (and the title is misleading), but it does identify access.
- sillysaurus2 13y ago
  I just wanted to thank you for this fantastic comment. Security history is fascinating, and this provides a ton of new material for me to osmose. Do you have any more reading recommendations? I've been wanting to research the WW2 period up through the end of the cold war in particular.
  - fazzone 13y ago
    If you are interested in that sort of thing, I highly recommend the novel Cryptonomicon by Neal Stephenson - it is partly about the activities of a joint British/American counterintelligence unit whose mission is to make sure the Axis does not figure out that the Allies have broken their codes. It's also a great read in general.
femto 13y ago
> "..., but then what are you supposed to do about it?" Maybe run the laptop off a bootable USB 3.0 stick, which you keep in your pocket? The file system actually on the laptop could serve as a honeypot.

neohaven 13y ago

Did you read the article? It provides an idea for a tamper-evident seal. Nothing more.

sillysaurus2 13y ago
People are going to apply this tamper-evident seal and believe they are secure when it hasn't been tampered with. That's dangerous, because it assumes an adversary has no way of bypassing the seal. That's quite an assumption. And if you're not getting security guarantees, then what kind of security are you getting?
- runjake 13y ago
  1.) This is just a particular method to detect tampering. It's pretty clever in a lot of ways. As mentioned elsewhere, try reading the article. 2.) The presenters specifically mention that this isn't the "be all/end all" of detecting tampering and the sort of people who would believe that probably have no interest in watching this presentation. Relax.
- prawn 13y ago
  No one is actually going to do this, just talk about it. Further, those interested would be well aware of the limitations.

runjake 13y ago

You've went ahead and since heavily edited your comment after all the downvoting, but your initial comment was asinine and demonstrated that you had little understanding of the contents of the article (eg. probably didn't read the article). That's why you're seeing all of the downvotes.

sillysaurus2 13y ago
I read the article. It makes no mention of the fact that this isn't any guarantee your laptop hasn't been tampered with. Was it asinine to call this "another false sense of security" and "humans have invented ways around every lock in existence"? It felt very much like people were going out of their way to misread me, so I replaced my comment with one that was absolutely clear that I was saying "this provides no guaranteed way of detecting tampering." Which is true, no? I recently promised the mods that I'd try hard to be less inflammatory, and I was legitimately shocked to see my comment downvoted to oblivion when it seemed to contain no mistaken ideas. I'm doing my best to learn from this experience, but no one is providing anything for me to learn from. All I've learned is not to warn people about invalid security assumptions...
- pessimizer 13y ago
  When somebody gives you tips on getting free food from restaurants, or saving money on your taxes, detecting whether someone has tampered with your computer, or X - arguing that you can't "trust that this is an absolute guarantee" of X is always going to be a strawman argument. You should save those arguments for people who actually claim that you can trust that their method Y is an absolute guarantee of X. Hint: the words "absolute" and "guarantee" will be in the post. edit: the only occurrence of "absolute" in the article: >Short of keeping a machine with you 24/7, there is little you can do to be absolutely sure these things don’t happen[....]
  - sillysaurus2 13y ago
    Ah. Makes sense, thank you. I'm sorry if I set up a strawman, and it's worrisome to think I'm doing this without realizing it. In order to not do that anymore, I'll need to figure out how my argument was a strawman. It seems like the only reason people are interested in this is because they're believing it provides some sort of security; else it wouldn't be interesting by definition. So it seemed reasonable in turn to point out that this method isn't reliable. I suppose that's literally the definition of a strawman (they never claimed it was absolutely reliable) but I'm trying to understand why it was bad to infer people would see this as a protection mechanism rather than a detection mechanism. I'll be careful about this sort of thing in the future though.

dredmorbius 13y ago

First off, there's a whole school and practice of security measures which is aimed more at revealing breaches than in preventing them, per se. Audits, tamper-evident seals, tell-tales placed in maps, watermarks in documents or images, and very large swaths of system monitoring, reporting, and alerting. Much of military electronic security "Orange Book" procedures have much more to do with auditing than they do securing data. Sometimes the goal is to determine what was taken or breached, sometimes who violated confidentiality (especially via watermarks or telltales), or how. In some cases, the goal may be to ensure/assess planted information was actually accessed. One counterintelligence mission, Operation Mincemeat from WWII involved landing a dead body (a deceased criminal if memory serves) with bogus military plans, and a pretty elaborate back-story, to mislead German intelligence into thinking an Allied attack would occur in Greece rather than Sicily. Part of the assessment of the plan involved determining whether or not the Germans had in fact examined the documents, and forensics showed that the corners of the papers indicated that they had been secured in a manner consistent with being photographed. https://en.wikipedia.org/wiki/Operation_Mincemeat https://en.wikipedia.org/wiki/Operation_Mincemeat Another case might be, say, a journalist who wanted to be able to positively demonstrate that electronics were accessed without authorization by officials (whether in a border crossing or some other means). The glitter polish trick would make for a useful and highly embarrassing bit of evidence which could be shown to the public in the form of before-after photographs. No, it doesn't prevent access (and the title is misleading), but it does identify access.

sillysaurus2 13y ago
I just wanted to thank you for this fantastic comment. Security history is fascinating, and this provides a ton of new material for me to osmose. Do you have any more reading recommendations? I've been wanting to research the WW2 period up through the end of the cold war in particular.
- fazzone 13y ago
  If you are interested in that sort of thing, I highly recommend the novel Cryptonomicon by Neal Stephenson - it is partly about the activities of a joint British/American counterintelligence unit whose mission is to make sure the Axis does not figure out that the Allies have broken their codes. It's also a great read in general.

femto 13y ago

> "..., but then what are you supposed to do about it?" Maybe run the laptop off a bootable USB 3.0 stick, which you keep in your pocket? The file system actually on the laptop could serve as a honeypot.