Hardware security

[TheOldOne]

What's more scary is I was actually thinking of getting one of those laptops just before that story broke.

 

[stevenc99]

It likely wouldn't be an issue if you installed another OS, or just reinstalled Windows with disk encryption, then the BIOS couldn't inject files in there. Makes you wonder what other nasty things could be hidden in UEFI BIOS though, especially by someone with (more) malicious intent.

 

[rSl]

Don't forget the nubs too... gyros + nubs could yield varying points in a 5th dimensional space. Add compass, barometer, gps... 10 dimensions to generate a seed?

please keep in mind that the non-4g units don't have these sensors, would be great to have some entropy sources that generates also true randomness for them.

maybe we can remix a :zoviet*france: noise-track randomly on the fly for making the noise even more random?

 

[ible]

i never understood why people say we have only 5 senses. we at least have one more (a sixth sense, if you will). it's called the sense of balance. i suppose that's a little less impressive than seeing dead people, though.

 

[rygD]

maybe we can remix a soviet france noise-track randomly on the fly for making the noise even more random?

wish I could "like" this more.

 

[WizardStan]

i never understood why people say we have only 5 senses. we at least have one more (a sixth sense, if you will). it's called the sense of balance. i suppose that's a little less impressive than seeing dead people, though.

We have 5 external senses, our ability to detect the world around us directly. We have a lot of internal senses: sense of balance, sense of direction, sense of time, a bunch of others that I've forgotten; which are indirect senses.
At least that's how it was explained to me.

 

[ible]

well, the "sense of direction" and "sense of time" are probably more internal (in the brain type of thing), but the sense of balance is an actual sensory unit (vestibular system), which, like the accelerometers in the Pyra, does sensing of accelerations. one might argue that's more "internal" or has less to do with the "outside world" than touch, hearing, seeing, etc., but that's not true. all senses have to do with the outside world making an impression on us, and acceleration is one such impression that the world can make (though it is sometimes a mutual agreement); why take accelerations out in favor of photons, various chemicals, sound waves, etc.?

 

[WizardStan]

No, I mean (as was explained to me), like, touch is an external entity applying pressure on your skin; taste and smell are external chemicals bonding to receptors; etc... These are all things you sense directly from external stimuli.
On the other hand, we don't have a "gravity" sense which tells us which way down is and help us keep our balance. Some animals DO, but we don't, we've got no built in compass or mass detector or whatever. What we have is some liquid in our ear that sloshes around and we detect that sloshing to keep us upright: it's basically using our direct sense of touch to indirectly detect acceleration to send signals to our brain.
I'm no anatomologist (I thought I was making this word up as a joke but apparently not), and it's been about 20 years since I was told this distinction so details are fuzzy and may even have changed from new information, so I'm not arguing anything here, just saying "this is what I was told".

 

[Djoga'Ro]

If you look closer, you find indirections in the other senses, too.

 

[ible]

yeah, there's no such thing as "outside world exerts force on human, human does not exert force back". newton's third law and all that.

touch is a good example. me touching something means that a force is exerted on my skin, but likewise i'm exerting a force on that object, too.

as you did, you might be able to say that the vestibular system is just a very refined touch sensor. in that case, i might suggest that internally they're wired up very differently in the brain, to sense different things, although they both boil down to forces.

but, we can technically boil all(?) of our senses down to electromagnetic interactions (photons exciting rods/cones, electrons repelling each other - touch, chemical reactions - smell). so if we want to do the reduction game, we should say we only have one sense... the sense of electromagnetism!

at any rate, since you need different parts for an accelerometer and a force gauge for electronic purposes, we should probably give the sense of balance the benefit of the doubt! i dunno, maybe we should vote about it.

 

[stevenc99]

Unless there's something robust, the user could be challenged to a game of Pong, using the volume control as paddle, while it reads entropy from the ADC attached to that potentiometer...

So... it turns out that the user has to type some things at first boot before the SSH host keys are generated. The timing of keyboard interrupts, and/or by moving the nubs, probably are a source of entropy the kernel can already use, and that may be good enough.

The volume control and readings from some other peripherals may involve polling so, to gather any additional entropy from those might require using of Entropy Gathering Daemon or similar.

 

[ible]

definitely a good idea to challenge any user logging in to some game which you are very good at. probably without any directions/instructions. perhaps there's already "an app for that"™, but it should definitely be a default setting on the Pyra

also, i really came here to complain about equal and opposite forces in the LOTR. spoiler alert. when Sam takes on the giant spider, the book says something like this: the belly of the beast comes down with a crushing force which none have ever been able to strike with, and that's how Sam manages to pierce its hide with his upheld sword. this always bothered me.

the physics of a piercing sword, Sam's stance, etc. are certainly important, but look at it like this: Sam would also have to be able to hold up the sword through some fraction of the force exerted by the spider (some of the force is mitigated if the sword pierces the hide). but if none have been able to exert that kind of force to pierce the hide of the spider, then Sam won't be able to hold the sword up while the spider comes down, thus the sword will accelerate downwards (net force down), and Sam will be crushed. best case scenario, the pommel hits a rock and manages to stay upright, and the spider is probably toast, but so is Sam (unless the spider stops before hitting the hilt).

 

[Djoga'Ro]

Easy, the belly was awefully fast and couldn't stomache the force needed to accelerate the not massless sword to get it up to speed before breaking the skin. And the skin was overstressed in such a short timespan, that the acceleration of the sword was basically neglectable. So Sam was merely holding it in place and properly oriented only fighting gravity and the wind or something.

 

[Orbstheorem]

What do we do, when quantum computing becomes a thing, rendering passphrases useless? Will the Pyra user be prepared? What comes after qc? Can we get there first, before qc?

I'll try adding a "self destruct" by writing 2M from /dev/urandom into my luks header, that should to the work...

 

[Silent-Hunter]

I'll try adding a "self destruct" by writing 2M from /dev/urandom into my luks header, that should to the work...

Quantum computer could likely just decrypt the whole drive without the header.

Maybe? I don't actually know what they're able to do.

 

[Plume]

Basically, QC is able to solve most crypto problems that don't use a bijection from the origin set into the target set (or in general sets of the same size).

 

[comradekingu]

It likely wouldn't be an issue if you installed another OS, or just reinstalled Windows with disk encryption, then the BIOS couldn't inject files in there. Makes you wonder what other nasty things could be hidden in UEFI BIOS though, especially by someone with (more) malicious intent.

Let it be said though, that supporting this kind of behaviour, is a HUGE issue.

 

[Silent-Hunter]

Basically, QC is able to solve most crypto problems that don't use a bijection from the origin set into the target set (or in general sets of the same size).

I guess we better start using bijection then, if we're not already.

 

[Plume]

That's called one-time pad and doesn't work with public-key crypto. If there is a public-key crypto that can't be (theoretically easily) broken by QC, I would like to know myself.

 

[levi]

So it wouldn't be able to solve the enigma machine for example? That's perhaps not surprising, since a conventional computer with a little prompting is able to break that.

My limited understanding of quantum computing is that it will make factoring big numbers very easy. Public key crypto works my multiplying two big prime numbers together, such that the receiver can easily divide by the one prime number they know to discover the other, but a user only presented with the multiple will have a hell of a time working out what both the numbers are. Quantum computers can solve this problem easily though, assuming they have enough qbits to make the two prime numbers.