Comment on Secure Boot is completely broken on 200+ models from 5 big device makers

• freeman@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

  It doesn’t matter if they know about security (which they do). A burglar could know about locks and home security systems, would you take his advice?

  Their positions on security of others is dismissed on grounds of trust not of competence.

  source

  • mriguy@lemmy.world ⁨1⁩ ⁨month⁩ ago

    The NSA has two jobs.

    The first is to break into any computer or communications stream that they feel the need to for “national security needs”. A lot of leeway for bad behavior there, and yes, they’ve done, and almost certainly continue to do, bad things. Note that in theory that is only allowed for foreign targets, but they always seem to find ways around that.

    The second, and less well known, job is to ensure that nobody but them can do that to US computers and communications streams. So if they say something will make your computer more secure, it’s probably true, with the important addition of “except from them”.

    source

    • freeman@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

      Exploits don’t care if you are actually the NSA or not. The NSA certainly knowns that yet they keep exploits secret at least from the public.

      They have argued for key escrow for God’s shake.

      They are primarily an intelligence agency. If you are not likely to be targeted by the NSA you are also unlikely to be targeted by any of their adversaries. They don’t give a shit if you get scammed, they are not the FBI, who also keep secret exploits and are anti-encryption.

      Additionally using their “best” exploits on more simple targets still poses a risk to them being discovered and fixed. Therefore it’s beneficial to them for everybody’s security to be compromised. It also provides deniability.

      source

      • sugar_in_your_tea@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

        Right. Their advice for the general public is a mix of “best practice” and risk. If an exploit is not actively exploited in the wild, they’ll probably sit on it for intelligence purposes and instead recommend best practices (which are good) that doesn’t impact their ability to use the exploit.

        So trust them when they say do X, but don’t take silence to mean you’re good.

        source
  • capital@lemmy.world ⁨1⁩ ⁨month⁩ ago

    A burglar could know about locks and home security systems, would you take his advice?

    Literally, yes. There was even a TV show about it.

    source

    • freeman@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

      Do you have any evidence those two people are still committing burglaries? The NSA is not an ex-intelligence agency.

      source
    • sugar_in_your_tea@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

      I get my advice from LockPickingLawyer on YouTube. He’ll demonstrate the weaknesses of various locks, and say which to avoid and which are probably okay (“okay” is a really strong recommendation from him). He’ll still break into really secure locks in <2 min, but he’ll describe the skills necessary to break in and let you decide on what your threat level.

      Basically, as long as it’s bump and bypass resistant, you’re good. Burglars aren’t going to pick locks, they’ll either break a window or move on if the lock stops them. A good lock doesn’t keep out a burglar, it just slows them down enough that they’ll give up.

      So yes, get advice from people who have the skills to break the protection they’re recommending, they’ll be able to separate things into threat categories. If you want OPSec advice, visit black hat hacking forums and whatnot, you’ll get way better advice than sticking with the normie channels.

      source
  • Emerald@lemmy.world ⁨1⁩ ⁨month⁩ ago

    A burglar could know about locks and home security systems, would you take his advice?

    If they were an expert burglar, I might

    source
  • Cosmicomical@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Exactly, they have a clear conflict of interest

    source
  • homesweethomeMrL@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Hey what is that, some kinda tangent

    source