Security? What "Security"?

[Sn!pe]

My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

[John McCue]

followups trimmed to: comp.misc

Post by Sn!pe
My pet rock Gordon asserts that every networked device has
a backdoor. and the Therefore, anything viewable in clear
on that device is insecure quality of message encryption is moot.

Well I would say Gordon could be correct. I say that due to
Intel ME and probably AMD SE:

https://en.wikipedia.org/wiki/Intel_Management_Engine

[Sn!pe]

Post by John McCue
followups trimmed to: comp.misc

Post by Sn!pe
My pet rock Gordon asserts that every networked device has
a backdoor. Therefore, anything viewable in clear on that device
is insecure and the quality of message encryption is moot.

Well I would say Gordon could be correct. I say that due to
<https://en.wikipedia.org/wiki/Intel_Management_Engine>

(nothing to add, I've just corrected the garbled quotation)

[Farley Flud]

Post by John McCue
Well I would say Gordon could be correct. I say that due to

The Intel ME can be disabled in the motherboard BIOS. Whenever
I build a new machine it is one of the first things that I
disable.

Also, the Linux kernel can be configured and built without
the MEI driver by disabling CONFIG_INTEL_MEI, which is located
here:

drivers/misc/mei

However, it is almost certain that most distros, and all of the
mainstream distros, have it enabled by default.

If you a Linux distro lackey, as most users are, then your
motherboard and your kernel both include Intel ME and therefore
you have no one to blame but your stupid, idiot, self.

[Scott Dorsey]

Post by Farley Flud

Post by John McCue
Well I would say Gordon could be correct. I say that due to

The Intel ME can be disabled in the motherboard BIOS. Whenever
I build a new machine it is one of the first things that I
disable.

No. The interface that makes the ME visible to the operating system
can be disabled, but the ME is still down there doing whatever
undocumented things it does. If it wasn't, the processor would never
be able to load the microcode in the first place.

Post by Farley Flud
Also, the Linux kernel can be configured and built without
the MEI driver by disabling CONFIG_INTEL_MEI, which is located
drivers/misc/mei

Yes, this keeps the operating system from being able to talk to the
ME... but it doesn't stop the ME from doing whatever it does.
--scott

[Computer Nerd Kev]

Post by Scott Dorsey

Post by Farley Flud
The Intel ME can be disabled in the motherboard BIOS. Whenever
I build a new machine it is one of the first things that I
disable.

No. The interface that makes the ME visible to the operating system
can be disabled, but the ME is still down there doing whatever
undocumented things it does. If it wasn't, the processor would never
be able to load the microcode in the first place.

Indeed. Wikipedia summarises potentially more effective ways of
disabling some IME functions using me_cleaner. Installation is
risky though so I haven't tried it myself.

https://en.wikipedia.org/wiki/Intel_Management_Engine#Disabling_the_ME

[Farley Flud]

Post by John McCue
Well I would say Gordon could be correct. I say that due to

The Intel ME can be disabled in the motherboard BIOS. Whenever
I build a new machine it is one of the first things that I
disable.

Also, the Linux kernel can be configured and built without
the MEI driver by disabling CONFIG_INTEL_MEI, which is located
here:

drivers/misc/mei

However, it is almost certain that most distros, and all of the
mainstream distros, have it enabled by default.

If you a Linux distro lackey, as most users are, then your
motherboard and your kernel both include Intel ME and therefore
you have no one to blame but your stupid, idiot, self.

[%]

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

meet me half way

[candycanearter07]

Post by %

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

meet me half way

Where would that be?

[%]

Post by candycanearter07

Post by %

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

meet me half way

Where would that be?

the north arctic

[%]

Post by %

Post by candycanearter07

Post by %

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

meet me half way

Where would that be?

the north arctic

no , the north atlantic , sorry

[candycanearter07]

Post by %

Post by %

Post by candycanearter07

Post by %

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

meet me half way

Where would that be?

the north arctic

no , the north atlantic , sorry

On it.

[yeti]

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Make computing safe again!

<https://www.spielezar.ch/products/34316-genzo_theme_large_default/the-army-painter-precision-side-cutter.webp>

Post by Sn!pe
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

Nobody wants the data cattle to have access to strong encryption.

[Sn!pe]

Post by yeti

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Make computing safe again!
<https://www.spielezar.ch/products/34316-genzo_theme_large_default/the-army-painter-precision-side-cutter.webp>

Post by Sn!pe
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

Nobody wants the data cattle to have access to strong encryption.

Granted!

ISTM that a secure payload would need to be encrypted on a stand-alone
machine, air-gapped and never to be connected online. Once encrypted,
the payload would go by sneakernet to a networked machine for onward
transmission. When the encrypted payload reached its destination it
would once again go by sneakernet to another air-gapped machine for
decryption. In this way the payload would never be seen in clear on a
networked machine.

To restate in slightly different words:

My pet rock Gordon assumes that every networked device has a back door.
Therefore the pursuit of privacy is futile because anything viewable in
clear on any of those networked devices is observable, regardless of the
quality of encryption used in transmission.

Nice side-cutters, BTW.

[yeti]

***@gmail.com (Sn!pe) wrote:


/!\ The following should be read with a mix of panic and a smile; you
decide, what to apply to which parts.

Post by Sn!pe
ISTM that a secure payload would need to be encrypted on a stand-alone
machine, air-gapped and never to be connected online.

There are many ways even air-gapped systems can or do leak data, that
may leak the keys or partial information about them.

IMO every system that exists on the same side of the singularities as we
do *is* connected with the rest. It just may be harder to get the data
you want.

We had leaking CRTs which could be read over a distance, AM leaks using
rhythms of loops while computing, blinking drive LEDs, RPM modulated
fans, ultrasonic connections between laptops in exams, and additionally
we are in the

__ __ ___ _ _ _____ __ ___ _ _ _
| \/ |_ _| \| |_ _\ \/ / |_ _|_ _ __(_)__| |___| |
| |\/| || || .` || | > < | || ' \(_-< / _` / -_)_|
|_| |_|___|_|\_|___/_/\_\ |___|_||_/__/_\__,_\___(_)


era and I definitely will not bet that ARM and RISCV chips or even FPGAs
don't come "pre-infected" in a comparable way. So who knows which
Gremlins in other chips are able to play e.g. modem over power-line and
whatnot.

So better assume that every system that is not made exclusively from
logic gates[0] you've baked yourself in your kitchen already comes
infected with spy hard- and software. And thinking about this shouldn't
stop without a look at the power supply[1]. Some leaks still may exist
no matter what you use to build the gates, but at least the foreign
gremlins would stay outside.


TL;DR:
__ __ _ _ _ _ _ _
\ \ / /__( )_ _ ___ __| |___ ___ _ __ ___ __| | | | |
\ \/\/ / -_)/| '_/ -_) / _` / _ \/ _ \ ' \/ -_) _` |_|_|_|
\_/\_/\___| |_| \___| \__,_\___/\___/_|_|_\___\__,_(_|_|_)

____________


[0]: Jeri Makes Integrated Circuits
<https://hackaday.com/2010/03/10/jeri-makes-integrated-circuits/#more-22290>

Transistor Fabrication: So Simple A Child Can Do It
<https://hackaday.com/2010/05/13/transistor-fabrication-so-simple-a-child-can-do-it/>

LLTP - Light Logic Transistorless Processor
<https://hackaday.io/project/172413-lltp-light-logic-transistorless-processor>

Mechanical Logic Gates With Amplification
<https://hackaday.com/2024/09/20/mechanical-logic-gates-with-amplification/>

[1]: Charging An Electric Supercar With Lemons, Kids, And The Sun
<https://hackaday.com/2018/06/29/charging-an-electric-supercar-with-lemons-kids-and-the-sun/>

[Sn!pe]

Post by yeti
/!\ The following should be read with a mix of panic and a smile; you
decide, what to apply to which parts.

Post by Sn!pe
ISTM that a secure payload would need to be encrypted on a stand-alone
machine, air-gapped and never to be connected online.

There are many ways even air-gapped systems can or do leak data, that
may leak the keys or partial information about them.
IMO every system that exists on the same side of the singularities as we
do *is* connected with the rest. It just may be harder to get the data
you want.
We had leaking CRTs which could be read over a distance, AM leaks using
rhythms of loops while computing, blinking drive LEDs, RPM modulated
fans, ultrasonic connections between laptops in exams, and additionally
we are in the
__ __ ___ _ _ _____ __ ___ _ _ _
| \/ |_ _| \| |_ _\ \/ / |_ _|_ _ __(_)__| |___| |
| |\/| || || .` || | > < | || ' \(_-< / _` / -_)_|
|_| |_|___|_|\_|___/_/\_\ |___|_||_/__/_\__,_\___(_)
era and I definitely will not bet that ARM and RISCV chips or even FPGAs
don't come "pre-infected" in a comparable way. So who knows which
Gremlins in other chips are able to play e.g. modem over power-line and
whatnot.
So better assume that every system that is not made exclusively from
logic gates[0] you've baked yourself in your kitchen already comes
infected with spy hard- and software. And thinking about this shouldn't
stop without a look at the power supply[1]. Some leaks still may exist
no matter what you use to build the gates, but at least the foreign
gremlins would stay outside.
__ __ _ _ _ _ _ _
\ \ / /__( )_ _ ___ __| |___ ___ _ __ ___ __| | | | |
\ \/\/ / -_)/| '_/ -_) / _` / _ \/ _ \ ' \/ -_) _` |_|_|_|
\_/\_/\___| |_| \___| \__,_\___/\___/_|_|_\___\__,_(_|_|_)

Yes, exactly so; I agree that we're doomed (just like always...) ≈:o(

I suppose I'll just have to invest in a sound-proofed anechoic chamber
inside a Faraday shield and power my stand-alone 'puter with batteries
using only left-handed electrons.

On the other hand I may just shrug my shoulders and accept that
privacy is dead, long dead, and it ain't coming back.

As I said at the outset: anything viewable in clear on a networked
device is vulnerable to observation and the quality of message
encryption is moot, not to say futile.

Post by yeti
____________
[0]: Jeri Makes Integrated Circuits
<https://hackaday.com/2010/03/10/jeri-makes-integrated-circuits/#more-2229
0>
Transistor Fabrication: So Simple A Child Can Do It
<https://hackaday.com/2010/05/13/transistor-fabrication-so-simple-a-c
hild-can-do-it/>
LLTP - Light Logic Transistorless Processor
<https://hackaday.io/project/172413-lltp-light-logic-transistorless-p
rocessor>
Mechanical Logic Gates With Amplification
<https://hackaday.com/2024/09/20/mechanical-logic-gates-with-amplific
ation/>
[1]: Charging An Electric Supercar With Lemons, Kids, And The Sun
<https://hackaday.com/2018/06/29/charging-an-electric-supercar-with-lemons
-kids-and-the-sun/>

[Sylvia Else]

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

An initial question is what exactly is meant by "backdoor". Any
networked device that is capable of remote update by the vendor can
presumably be updated by the vendor to do anything that any device on
your network can do. But this does not imply that anyone else can do
that. Of course it does mean that you security depends on the security
of the vendor, which is an unknown quantity. This is partly why the few
remotely updatable devices that I do own are fire-walled off from the
rest of my internal network.

Few networked devices accept incoming connections, for the simple reason
that they're unlikely to get past a gateway router. Most work by making
outgoing connections to the vendor's server. The better implementations
require an authenticated server certificate, which makes impersonation
of the vendor pretty much impossible. Without a certificate the
intending intruder may engage in something like a DNS cache poisoning
attack, but they have become more difficult over the years.

If one is to worry about back-doors, the main vulnerability is the
router itself, and this has indeed been a problem in the past,
especially where the ISP has the ability to update firmware or change
settings, because now one is dependent on the security of the ISP, which
is not always been up to the task.

Commercially supplied routers have a bad record of vulnerabilities. I
use a small single board computer as a gateway instead.

Sylvia.

[%]

Post by Sylvia Else

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

An initial question is what exactly is meant by "backdoor". Any
networked device that is capable of remote update by the vendor can
presumably be updated by the vendor to do anything that any device on
your network can do. But this does not imply that anyone else can do
that. Of course it does mean that you security depends on the security
of the vendor, which is an unknown quantity. This is partly why the few
remotely updatable devices that I do own are fire-walled off from the
rest of my internal network.
Few networked devices accept incoming connections, for the simple reason
that they're unlikely to get past a gateway router. Most work by making
outgoing connections to the vendor's server. The better implementations
require an authenticated server certificate, which makes impersonation
of the vendor pretty much impossible. Without a certificate the
intending intruder may engage in something like a DNS cache poisoning
attack, but they have become more difficult over the years.
If one is to worry about back-doors, the main vulnerability is the
router itself, and this has indeed been a problem in the past,
especially where the ISP has the ability to update firmware or change
settings, because now one is dependent on the security of the ISP, which
is not always been up to the task.
Commercially supplied routers have a bad record of vulnerabilities. I
use a small single board computer as a gateway instead.
Sylvia.

i have nothing to hide so i don't do anything

[Sylvia Else]

Post by %

Post by Sylvia Else

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

An initial question is what exactly is meant by "backdoor". Any
networked device that is capable of remote update by the vendor can
presumably be updated by the vendor to do anything that any device on
your network can do. But this does not imply that anyone else can do
that. Of course it does mean that you security depends on the security
of the vendor, which is an unknown quantity. This is partly why the
few remotely updatable devices that I do own are fire-walled off from
the rest of my internal network.
Few networked devices accept incoming connections, for the simple
reason that they're unlikely to get past a gateway router. Most work
by making outgoing connections to the vendor's server. The better
implementations require an authenticated server certificate, which
makes impersonation of the vendor pretty much impossible. Without a
certificate the intending intruder may engage in something like a DNS
cache poisoning attack, but they have become more difficult over the
years.
If one is to worry about back-doors, the main vulnerability is the
router itself, and this has indeed been a problem in the past,
especially where the ISP has the ability to update firmware or change
settings, because now one is dependent on the security of the ISP,
which is not always been up to the task.
Commercially supplied routers have a bad record of vulnerabilities. I
use a small single board computer as a gateway instead.
Sylvia.

i have nothing to hide so i don't do anything

Not even information that could be used in identity theft?

Sylvia.

[%]

Post by Sylvia Else

Post by %

Post by Sylvia Else

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.
Therefore, anything viewable in clear on that device is insecure and the
quality of message encryption is moot.

An initial question is what exactly is meant by "backdoor". Any
networked device that is capable of remote update by the vendor can
presumably be updated by the vendor to do anything that any device on
your network can do. But this does not imply that anyone else can do
that. Of course it does mean that you security depends on the
security of the vendor, which is an unknown quantity. This is partly
why the few remotely updatable devices that I do own are fire-walled
off from the rest of my internal network.
Few networked devices accept incoming connections, for the simple
reason that they're unlikely to get past a gateway router. Most work
by making outgoing connections to the vendor's server. The better
implementations require an authenticated server certificate, which
makes impersonation of the vendor pretty much impossible. Without a
certificate the intending intruder may engage in something like a DNS
cache poisoning attack, but they have become more difficult over the
years.
If one is to worry about back-doors, the main vulnerability is the
router itself, and this has indeed been a problem in the past,
especially where the ISP has the ability to update firmware or change
settings, because now one is dependent on the security of the ISP,
which is not always been up to the task.
Commercially supplied routers have a bad record of vulnerabilities. I
use a small single board computer as a gateway instead.
Sylvia.

i have nothing to hide so i don't do anything

Not even information that could be used in identity theft?
Sylvia.

nothing

[Lawrence D'Oliveiro]

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

[candycanearter07]

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

[Sn!pe]

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have a direct P2P
telepathic link for a shorter ping.

[Joel]

Post by Sn!pe

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have a direct P2P
telepathic link for a shorter ping.

So, you hated on me for liking trans women, but you're talking about a
rock as if it's alive. OK.
--
Joel W. Crump

Amendment XIV
Section 1.

[...] No state shall make or enforce any law which shall
abridge the privileges or immunities of citizens of the
United States; nor shall any state deprive any person of
life, liberty, or property, without due process of law;
nor deny to any person within its jurisdiction the equal
protection of the laws.

Dobbs rewrites this, it is invalid precedent. States are
liable for denying needed abortions, e.g. TX.

[%]

Post by Joel

Post by Sn!pe

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have a direct P2P
telepathic link for a shorter ping.

So, you hated on me for liking trans women, but you're talking about a
rock as if it's alive. OK.

did he make friends with you first

[Sn!pe]

Post by Joel

Post by Sn!pe

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have a direct P2P
telepathic link for a shorter ping.

So, you hated on me for liking trans women, but you're talking about a
rock as if it's alive. OK.

I don't know you well enough to hate you but I will say this:
Gordon talks more sense than you do. [fu2: adn]

[Joel]

User-Agent: MacSOUP/2.8.6b1 (ed136d9b90) (Mac OS 10.13.6)

Post by Joel

Post by Sn!pe

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have a direct P2P
telepathic link for a shorter ping.

So, you hated on me for liking trans women, but you're talking about a
rock as if it's alive. OK.

Gordon talks more sense than you do. [fu2: adn]

OK, Mac user.
--
Joel W. Crump

Amendment XIV
Section 1.

[...] No state shall make or enforce any law which shall
abridge the privileges or immunities of citizens of the
United States; nor shall any state deprive any person of
life, liberty, or property, without due process of law;
nor deny to any person within its jurisdiction the equal
protection of the laws.

Dobbs rewrites this, it is invalid precedent. States are
liable for denying needed abortions, e.g. TX.

[Sn!pe]

Post by Joel
OK, Mac user.

<giggle> ≈:o)

[Joel]

Post by Joel
OK, Mac user.

<giggle> ?:o)

Seriously, though, you right-brained weirdoes can keep your overpriced
goofyware. ARM computers in the "PC" realm are now emerging, Apple
was first out of the gate, and I credit them for that, but I could put
openSUSE on a laptop, not made by Apple, and laugh at the suckers who
rely on them.
--
Joel W. Crump

Amendment XIV
Section 1.

[...] No state shall make or enforce any law which shall
abridge the privileges or immunities of citizens of the
United States; nor shall any state deprive any person of
life, liberty, or property, without due process of law;
nor deny to any person within its jurisdiction the equal
protection of the laws.

Dobbs rewrites this, it is invalid precedent. States are
liable for denying needed abortions, e.g. TX.

[Lawrence D'Oliveiro]

Post by Sn!pe

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have a direct P2P
telepathic link for a shorter ping.

So he is a networked device. And according to his statement, every
networked device has a backdoor. Therefore Gordon has a backdoor.

Is Gordon still to be trusted?

[Sn!pe]

Post by Lawrence D'Oliveiro

Post by Sn!pe

Post by candycanearter07

Post by Lawrence D'Oliveiro

Post by Sn!pe
My pet rock Gordon asserts that every networked device has a backdoor.

Is Gordon a networked device? How did it communicate that message to you?

A networked rock?

Gordon is a primary node on the Extranet but he and I have
a direct P2P telepathic link for a shorter ping.

So he is a networked device. And according to his statement, every
networked device has a backdoor. Therefore Gordon has a backdoor.
Is Gordon still to be trusted?

Of course, he's as solid as a rock; not that we worry about lack
of privacy. As everybody should know, privacy is utterly dead
and security is naught but an illusion.

In any case, life is just a dream. (# sh-boom, sh-boom)

[Scott Dorsey]

Post by Sn!pe
Of course, he's as solid as a rock; not that we worry about lack
of privacy. As everybody should know, privacy is utterly dead
and security is naught but an illusion.

And a rock feels no pain. And an island never cries.
--scott

[Sn!pe]

Post by Scott Dorsey

Post by Sn!pe
Of course, he's as solid as a rock; not that we worry about lack
of privacy. As everybody should know, privacy is utterly dead
and security is naught but an illusion.

And a rock feels no pain. And an island never cries.
--scott

True, that, although Gordon is quite empathetic. To expect
sympathy is going a bit far though, he's seen it all before.
Anyway, he is my rock. ≈:o)

[candycanearter07]

Post by Sn!pe

Post by Scott Dorsey

Post by Sn!pe
Of course, he's as solid as a rock; not that we worry about lack
of privacy. As everybody should know, privacy is utterly dead
and security is naught but an illusion.

And a rock feels no pain. And an island never cries.
--scott

True, that, although Gordon is quite empathetic. To expect
sympathy is going a bit far though, he's seen it all before.
Anyway, he is my rock. ≈:o)

Pet rocks are always cute :)

[Kerr-Mudd, John]

On Wed, 16 Oct 2024 18:10:04 -0000 (UTC)

Post by candycanearter07

Post by Sn!pe

Post by Scott Dorsey

Post by Sn!pe
Of course, he's as solid as a rock; not that we worry about lack
of privacy. As everybody should know, privacy is utterly dead
and security is naught but an illusion.

And a rock feels no pain. And an island never cries.
--scott

True, that, although Gordon is quite empathetic. To expect
sympathy is going a bit far though, he's seen it all before.
Anyway, he is my rock. ≈:o)

Pet rocks are always cute :)

Petroc is a popular name is some areas.