4 ms·
I don't totally disagree but... What about encrypting your message on a fully offline computer, like what Schneier is now doing if I'm not mistaken? What if bo
by TacticalCoder 13y ago
I don't totally disagree but... What about encrypting your message on a fully offline computer, like what Schneier is now doing if I'm not mistaken?
What if both him and his recipient do the same? Then you need physical access (and unnoticed physical access I'd add) to the offline computer to be able to decrypt right?
And physical access doesn't scale.
- pyre 13y agoDevil's Advocate: What if they swap Scheier's USB key (or drive) with one that will exploit the USB stack on his offline computer (disabling 'auto-mount' won't help you here)? Yes, it's a physical access attack, but physical access to his person might be easier to achieve (while remaining unnoticed) than access to the offline computer.
- chris_mahan 13y agoAnd he's probably high enough in the list of NSA "persons of interest" to warrant a field agent's time.
- MichaelGG 13y agoI think the idea is to use simple physical media, like CDROM, where hiding a malicious payload is far more difficult since there's no embedded electronics on a disc. If that's too cumbersome, one could always implement a simple teletype-like system with a low bitrate. Like an automatic machine that can physically press keys on a keyboard. Then remove every key except letters, numbers, shift and tab. You could use a similar system or OCR to get data off the gapped machine.
- pyre 13y agoOne could, but IIRC Schneier has mentioned using a USB drive (though it could all be a clever ruse to throw off the NSA ;-).
- chris_mahan 13y agoHow would you decrypt the message? The only safe option would be to print out the encoded message, and retype it into the offline computer. I don't think anyone does that. Also, the offline computer can be physically compromised.