604 reputation
412
bio website
location
age
visits member for 2 years, 8 months
seen Apr 9 at 8:01

Lucky those who have knowledge to help and assist others :)


Mar
29
comment software can be audited, is there an equivalent for hardware?
@cybermike then this is bad luck for me, I have no trust in the manufactorers, and no money either. It anyway suprises me to hear you mention "reverse engineering of hardware" as I thought that is techologically unfeasible for those nice <50nm IC. I will read into what you say, maybe it will eventually allow to provide a definitive answer to this question or at least a good approximation.
Mar
29
asked software can be audited, is there an equivalent for hardware?
Feb
17
revised What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
added 202 characters in body
Feb
3
comment How to minimize the risk posed by Intel AMT/ME's “ring -3 exploits”?
The advice to disable it, is most usable, to avoid exploitation by third parties hacking it. If the threat perception would include also attacks from sides of Intel and or secret agencies with which Intel might be required to cooperate, than of course there is an more puzzling problem of trust. By any chance there is a hardware/physical disabeling of AMT/ME possible? After all an backdoor in Intel's AMT seems imho more yealding than a trickery with the Intel CPUs random number generation via microcode attack? More clear to you think bios disabeling will do?
Feb
2
awarded  Notable Question
Feb
2
asked How to minimize the risk posed by Intel AMT/ME's “ring -3 exploits”?
Jan
31
answered How to trust ICs?
Nov
18
awarded  Tumbleweed
Nov
11
asked Get information about the audit state of software (for OSS)?
Nov
8
comment Can a Javascript - WebGL proof of work system prevent website spam?
To counter the CPU and Javascript less than perfect match, maybe a more memory-bound Proof of Work can help? ....Even though that it is clear that a botnet is also resourceful in memory memory....
Oct
11
comment Encrypt with private and decrypt with public
the second path seems more like signing in which the encryption / chipher does not create secrecy but make sure that the author is indeed the holder of the private key
Oct
10
comment Are there approaches/mechanism to detect hardware backdoors?
thank you! That holds true for certain types of attack scenarios (i.e. those where you seek to get data access). If the goal was simply (and bad enough) to brick the device upon reception of a series of data bytes not much output communication needs to take place. Also there are surely other attack types.
Oct
10
comment Are there approaches/mechanism to detect hardware backdoors?
thanks for the pointing the finger to the more easily detectable hardware backdoors here. I did not expect this but surely a great hint.
Oct
10
answered Detect Different Machine using Browser
Oct
10
asked Are there approaches/mechanism to detect hardware backdoors?
Oct
10
comment Is “HTTPS” ~100% secure?
the compromised CA scenario might not be that unlikely after all considering the relatively high number of CAs out there. This scenario even causes some modern browsers to check if the certificate used is from the usual CA or is suddenly from a totally new CA.
Oct
1
awarded  Yearling
Sep
24
awarded  Autobiographer
Sep
22
comment Linux password changed. Is this an attack or a hardware glitch?
@skytreader thank you! Since you express some reluctance of being attacked, you might consider at least to keep your linux safe from win8 by using encryption. Also another layer of protection by using a linux securtity module to yet again sandbox the browser keeps the worried/paranoid among us happy ;)
Sep
21
awarded  Enlightened