Father, Hacker (Information Security Professional), Open Source Software Developer, Inventor, and 3D printing enthusiast

  • 7 Posts
  • 109 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle
  • This is a, “it’s turtles all the way down!” problem. An application has to be able to store its encryption keys somewhere. You can encrypt your encryption keys but then where do you store that key? Ultimately any application will need access to the plaintext key in order to function.

    On servers the best practice is to store the encryption keys somewhere that isn’t on the server itself. Such as a networked Hardware Security Module (HSM) but literally any location that isn’t physically on/in the server itself is good enough. Some Raspberry Pi attached to the network in the corner of the data center would be nearly as good because the attack you’re protecting against with this kind of encryption is someone walking out of the data center with your server (and then decrypting the data).

    With a device like a phone you can’t use a networked HSM since your phone will be carried around with you everywhere. You could store your encryption keys out on the Internet somewhere but that actually increases the attack surface. As such, the encryption keys get stored on the phone itself.

    Phone OSes include tools like encrypted storage locations for things like encryption keys but realistically they’re no more secure than storing the keys as plaintext in the application’s app-specific store (which is encrypted on Android by default; not sure about iOS). Only that app and the OS itself have access to that storage location so it’s basically exactly the same as the special “secure” storage features… Except easier to use and less likely to be targeted, exploited, and ultimately compromised because again, it’s a smaller attack surface.

    If an attacker gets physical access to your device you must assume they’ll have access to everything on it unless the data is encrypted and the key for that isn’t on the phone itself (e.g. it uses a hash generated from your thumbprint or your PIN). In that case your effective encryption key is your thumb(s) and/or PIN. Because the Signal app’s encryption keys are already encrypted on the filesystem.

    Going full circle: You can always further encrypt something or add an extra step to accessing encrypted data but that just adds inconvenience and doesn’t really buy you any more security (realistically). It’s turtles all the way down.





  • It’s like everything else conservatives think they want: “We want illegal immigrants out of the country! But we’re not willing to fund more immigration courts/judges. Let those court cases back up forever so they can stay here indefinitely! Oh wait…”

    Conservative: “Tesla chose Texas for their new whatever, yeeeee fuckin’ haw yo! That’s a lot of money that will come into the state!”

    Bystander: “But don’t they have to settle that case with the EPA before they can proceed? I mean, they totally fucked that river and will have to pay for cleanup.” (note: this is hypothetical river fucking)

    Conservative (and Libertarians, oddly): “Yeah yeah whatever. That’s why we have the courts!”

    Bystander: “Except that court case won’t be heard for years because the courts are backed up. Apparently there’s not enough money in the Federal budget this year to pay for more judges, courthouses, and lawyers to handle cases like that”

    Conservative: “Then they need to increase taxes! Oh wait…”


  • Congratulations conservatives! With this ruling, you just drastically increased the size of the Federal government.

    Simple administrative rulings are gone so now we’re going to end up with five zillion more expensive lawyers, a lot more judges, and a gazillion more cases before the courts.

    It’ll also increase the cost of doing business! Because now instead of just having to occasionally deal with an administrative body full of technical people who know what matters and what doesn’t every company is now going to have to hire teams of lawyers to defend themselves in court and explain every little thing to a jury of total laymen.

    The companies that violate the law regularly with the intent to “just pay the fines” will now have to defend themselves in court over and over and over again. You think immigration courts are overloaded? Now every federal court will be!

    Perhaps they thought this would just result in businesses no longer having to comply with regulations? Hell no. Next year’s Federal budget is going to balloon in order to pay for all these new inefficiencies.

    They are insane.

    Of course, this is conservatives modus operandi: Don’t bother looking at real outcomes and real consequences of their actions! Instead, look towards tradition and religion and only that which is right in front of their face.








  • Electric vehicles. Did you forget?

    Also, the reason why walking, running, or even biking to get around 99% of the US isn’t feasible is because the distances are too vast. The average commute time for people in the US is 26.7 minutes and most of that will be on a highway. Covering the same distance on a bike would take 3-10x longer (why 10x? Because of soooo many bridges that don’t allow bikes or pedestrians!).