4 ms·
The fatal problem with this plan is that all end user devices are by now hopelessly compromised. Take a look at the Snowden documents, which are now years behin
by pjlegato 11y ago
The fatal problem with this plan is that all end user devices are by now hopelessly compromised. Take a look at the Snowden documents, which are now years behind the state of the art.
It doesn't matter if your crypto is both bulletproof and easy to use. They'll just break into your phone or your laptop through a side channel and read the key. And you won't even notice.
- deleted 11y ago[deleted]
- cpach 11y agoHave it ocurred to you that different people have different threat models? Yes, if a powerful state actor really is after you, they will most probably find a way sooner or later. Crypto is still useful for lots of use cases. E.g. protecting data from competitors, stalkers or identity thiefs.
- pjlegato 11y agoThis sort of thing may have been limited to powerful state actors a few years ago, but now Pandora's Box has been opened. Many other actors are now actively exploiting the holes deliberately created in the entire stack of computer security infrastructure over the past 20 years by those state actors. It's far more likely that you'll run into someone trying to steal your credit card than an intelligence agency, but they'll be using the same exploit to get into your phone.
- cpach 11y agoSo the only resort then I guess is to abandon computers and only use cash and pen and paper.
- kajecounterhack 11y agoNobody's saying that. I think what's being said here is just that we need to fix what's broken. Acknowledging that your physical devices have side channels is important.
- jsprogrammer 11y agoHas it occurred to you that if your device is full of side channels, anyone can use those side channels? How can you create a legitimate-government-only side channel? You could do it by basing all encryption off a master key that only the legitimate government controls. However, there's no way for a legitimate government to force everyone to only communicate with the master key. Any other side channel is going to be exploitable by non-legitimate-government's in some way.
- cpach 11y agoI have never endorsed ”legitimate-government-only side channels”. I’m trying to nuance the discussion by asserting that not every attacker is equal in their skills and resources.
- jMyles 11y ago> all end user devices are by now hopelessly compromised This is news to me. Are there known side channel vulnerabilities for an arbitrary ubuntu desktop?
- daveloyall 11y agoI'd like to know the answer to that question. But also, this one: s/an arbitrary/each/
- kajecounterhack 11y agoAgreed. Cool EM side-channel attack published March this year: http://eprint.iacr.org/2015/170.pdf http://eprint.iacr.org/2015/170.pdf
- cpach 11y agoThat stuff is spooky. But I don’t think it’s usage is widespread.
- kajecounterhack 11y agoYeah, this is true. But the OP still has a point, if we want true privacy there need to be changes at the hardware level.
- cpach 11y agoAgreed.