Re:Ask HN: How do you trust that your personal machine is no...
by treebeard901 on Sunday January 15, 2023 @07:40AM
(#34388966)
You should assume all devices are compromised
[ Parent
| on HN ]
Re:Ask HN: How do you trust that your personal machine is no...
by baobabKoodaa on Sunday January 15, 2023 @07:43AM
(#34388977)
Not helpful
Re:Ask HN: How do you trust that your personal machine is no...
by twaw on Sunday January 15, 2023 @08:09AM
(#34389129)
Why not? It still possible to communicate securely using compromised devices and networks.
Re:Ask HN: How do you trust that your personal machine is no...
by sweetjuly on Sunday January 15, 2023 @08:34AM
(#34389266)
Could you expand on this? How would I securely communicate from a device that, say, has a kernel level implant? This is one of those cases where SGX/TrustZone would be immensely helpful but nobody has built a messenger that actually somehow fully lives in an enclave.
If you assume every device you use is compromised, how can you possibly use any encryption?
Re:Ask HN: How do you trust that your personal machine is no...
by numpad0 on Sunday January 15, 2023 @09:27AM
(#34389616)
Truths has to be helpful.
Re:Ask HN: How do you trust that your personal machine is no...
by wadayano on Sunday January 15, 2023 @07:48AM
(#34389003)
*compromisable
Re:Ask HN: How do you trust that your personal machine is no...
by tete on Sunday January 15, 2023 @09:58AM
(#34389873)
I don't think so. While I am not sure about what "devices" means it's common practice for example to assume your root password is always compromised. The consequence here is that you don't allow remote, password-authenticated root.
On a similar note services and networks should be treated as compromised as well, meaning you must use encryption, authentication and in general make sure to limit attack surface.
And all of that boils down that you should make sure you should not rely on services, users, etc. don't for example access personal information they are not supposed to access.
After all the problem with things like Ransomware is exactly that this isn't assumed.