Re: [tor-talk] WSJ- Google- Sonic Mr. Applebaum

[Jeroen Massar <jeroen@xxxxxxxxx>]

On 2011-10-11 17:29 , Eugen Leitl wrote:
> On Tue, Oct 11, 2011 at 02:30:01PM +0200, Jeroen Massar wrote:
> 
>> Of course you are raising the bar, 
> 
> That's the main idea.
> 
>> but that is the only thing you are
>> doing, as the adversary can still walk in, be that with a warrant making
> 
> If they have to dispatch a warm body to a remote physical
> location my job is done already. If it has to be a warm sentient
> body who has to analyze an unfamiliar situation and attempt an
> undetected physical layer attack I've already succeeded wildly 
> beyond all expectations. 

I fully agree, it is all about delay and cost.

From that perspective the cheapest way in is to send that not so
sentient warm body directly to you though. But we are running in circles
here don't you think ;)

[..]
>> How exactly does that matter? It will already be too late and your full
[..]
>> hardware will be off site in a location that you don't control, still
> 
> Do you see the difference between Gmail or Amazon cloud rendering upon
> Caesar what is his and my logless postfix running on you own hardened box,
> with mail residing client-side on a crypto filesystem? 

The only difference is that for your hardened box it is way more
expensive (your hardware+hosting costs money and gmail costs nothing),
very noticeable as being 'special' as you likely don't share it too much
with others and especially not the 'sheep' that are so good to hide
traffic in.

Yes, your setup will be way more secure, but at which cost and to
protect exactly what?

The original thread & threat point was about 'is gmail safe for email',
where my point was 'if you do GPG then they can only see the src/dst
email address' (and obviously other SMTP headers).

Your threat point seems to be to safeguard every single bit at a very
high price, while that is completely valid, that is not for everybody
though.

>> running fully and no way for you to stop them from doing what they want
>> to do with it, be that freeze the memory or any component needed.
> 
> Do you have the slightest idea how much that would cost, especially if
> I'm not to notice?

The fact that you will have such a hardened box is already easily
noticeable and it will cost you a lot too.

The gmail + PGP setup is free, and if they compromise one, well, just
set setup a new one. Heck, jump to Yahoo or GMX or every other one.

>> Or do you watch that video screen 24/7 like in the movies with the
>> guards on duty being shown a replay? :)
> 
> My thinking is that I wouldn't hire you as a security consultant.

You are clearly thinking of hiring one, I guess you need one too.

Note that I am not a security consultant in any way, thus I can't help
you with even if you wanted me to.

>>> If there's a convenient temporal lacune on multiple probes, you know 
>>> your hardware is no longer trusted.
>>
>> I am surprised if you are that paranoid that you trust the hardware in
> 
> You seem to have poor reading comprehension and security analysis skills.

Ever considered that you are the one who diverted completely from the
original subject? ;) I'll skip over the even more silly bits which have
no technical merit at all.

[..]
>>> They are welcome to tap the network. It's what they already can do,
>>> by mirroring the incoming switch port and packet capturing there.
>>> This is not relevant to accessing secrets locked in hardware, or
>>> present at runtime.
>>
>> Nope, but that is why a vampire tap can also do power, so they can
>> remove the box from the rack/location that you have as 'secure' and then
> 
> My boxes are already on an UPS.

And then there is a cable between the UPS and your hardened box, that
cable can be clamped too. Or did you cement that all in? :)

> That's the whole point, or provider
> can simply cut power, and simulate an outage. The point is that they
> would have to physically approach the rack, at which point there will
> be a triggered recording. You have no idea where the recording goes 
> and which out of band channels it might use. If you're smart, you'll
> back off when you see the LED glow. If you can see NIR, I mean.

Must be an awesome datacenter that nobody ever approaches that rack of
yours.

> We can play this game ten times to Sunday, and I can assure you 
> that with a minimal amount of planning you can make the traceless
> extraction of tamper-proof hosted secrets arbitrarily difficult. 

Difficult and very expensive. I don't think that is what people who just
want to have a bit of privacy for their email want to go all the way for.

>> they can do whatever time consuming things you want.
>>
>> Unless you have a full remote kill switch in there packed with some C4
>> or so.
> 
> It's lead azide, actually. I see you've been reading my stolen design documents.

Every 10 year old who watched a silly movie can come up with that one.

[..]
>> Did you build that TPM token? I am just trying to give obvious hints
>> here and above etc...
> 
> You're being out ouf your depth and not realizing it.

Right back at ya! ;)

[..]
>> For most people though, unless you are doing super secret evil stuff,
>> just using a Gmail account with PGP in combo with SMTP/IMAP is good
>> enough(tm) a security measure.
> 
> By not using a Gmail account or Amazon cloud you don't even have 
> to use GPG.

So you mean you don't use E-mail at all and everybody is using the same
crypto system as you, or they drop "mail" all on that hardened box?

Is an option, not very workable on a large scale, especially when you
introduce more people to use that system as then the trust system starts
breaking down.

[..]
>> likely know who is footing the bill, just follow the money and thus
>> where your bed lives.
> 
> You should avoid mixing uppers and downers with your psychoactives.
> It's really bad for your health.

Thanks for the tip! Fortunately I am a completely drug-free person.

[..]
>>> Why do you bother breathing? You'll die, anyway.
>>
>> I don't have to bother breathing, not everybody is Darth Vader, it
> 
> See, I don't have to bother using cloud or Gmail for private 
> purposes, either.

Everybody their own thing.

Obviously your threat model is a lot more paranoid than that of the
original message.

>> happens automatically more or less as a reflex for most people and there
>> is so much fun in the world without having to consider conspiracy
>> theories ;)
> 
> If you ever ran a Tor exit, you know there's no need for theories.

Always good to hear that I don't run any, then I don't have anything to
worry about that either ;)

Greets,
 Jeroen
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk