Initial support for guided disk encryption in OpenBSD installer

Re:Initial support for guided disk encryption in OpenBSD ins... by jmclnx on Wednesday March 08, 2023 @02:21PM (#35073521)

>Hiding filesystems is security via obscurity more than anything else, and probably won't hold up if someone has root.

That statement indicates you do not fully understand pledge(2) and unveil(2).

For example, if you are running Firefox using the default settings as root on OpenBSD. Firefox will not be able to see anything outside of the directories allowed by unveil(2). So an errant JS will not be able to peruse "veiled" Directories. For instance, Firefox cannot see any data in ~/.ssh no matter what ID you are using.

[ Parent | on HN ]

Re:Initial support for guided disk encryption in OpenBSD ins... by Zurrrrr on Wednesday March 08, 2023 @02:35PM (#35073697)

> That statement indicates you do not fully understand pledge(2) and unveil(2).

Not so, not so at all. You have to take my statement in context.

The point was those technologies, while nifty, are entirely irrelevant if an attacker gains remote root.

[ Parent | on HN ]

Re:Initial support for guided disk encryption in OpenBSD ins... by bentley on Wednesday March 08, 2023 @02:41PM (#35073769)

OpenBSD’s heavy use of pledge, unveil, privilege separation, unprivileged processes, chroot, and strong memory protections do an excellent job of keeping attackers from gaining root.

[ Parent | on HN ]

Re:Initial support for guided disk encryption in OpenBSD ins... by Zurrrrr on Wednesday March 08, 2023 @03:06PM (#35074053)

A car can have all the tech in the world to avoid an accident, but I still expect it to have seatbelts.

[ Parent | on HN ]