1

Hi I have recently started to learn about data protection. After the snowden events it seems pretty certain that intelligence agency may have planted backdoors in hardware. I have got a few questions relating to this topic and hope it is not too much ;) and someone with enough patience will help a newbie.

  1. libreboot offers laptops that run only on "free" software. Do you know/think that a librelaptop does also provide for no backdoors? On their website they are only mentioning the intel processor backdoors but what about harddrive backdoors or other relevant components?
  2. If there is no device which is backdoorfree with 100% certainty available right now, do you think that there will be one one day? (I do not think so)
  3. I have read a comment in which someone asserts that these backdoors are not used by intelligence since all the data they would pick up must be sent to them over your router so that anyone would know about it and it would be too easy to find out. What do you think about this argument?
  4. My next question relates to internet anonymity. Does it really matter to try hiding all your information, protect yourself and try to use as much "secure" (open-source) software as possible when people spying on you just could use the hardware backdoors?
  5. My last question: what do you think about parallel vpns: https://thesafety.us/en/parallel_vpn ? does it seem like a good idea or would you prefer proxychains? Tor?....

closed as too broad by Steffen Ullrich, schroeder Jan 11 '17 at 7:38

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Your are basically asking in a major part of this too broad question if you can trust somebody 100%. Unless you believe in fairy tales you should see that each person and institution has their own interest first and that you cannot trust anybody 100% to work in exactly your interest. Maybe you can get 99% trust, maybe even 99.9% trust but never 100%. This is not restricted to computer security but this is just real life. – Steffen Ullrich Jan 11 '17 at 7:31
  • You have combined way too many unrelated questions into one. Please have a look at our FAQ about how to frame questions. – schroeder Jan 11 '17 at 7:38
2

A key part of information security is risk analysis.

It is not possible to completely secure everything, everywhere, at every point in time.

Example, you download a file. Can you be aware that someone has tampered with it? Can you be sure someone hasn't inspected this content before you downloaded it? How much of a 'risk' is this for you?

On the case of the libreboot, while it may be open source, have you compiled it yourself? Do you understand what is going on? What is the risk of using default, "from the factory" firmware/boot loaders?

Depending on how paranoid or concerned you are about your own security, the only true way to have complete trust over a system is to build it yourself, with your own chips. This is unlikely to happen until individuals can buy and manufacture chips in their basement. There is implicit trust in what you use, and with anything such as a car. Can you trust the people who work on your car, or do you work on it yourself?

Backdoors that work at the hardware layer and inserted into firmware are hard to detect unless you are able to compare the factory's image to yours. While a joke, the story about a HP printer containing a modified chip and firmware is completely possible. How would a user be able to detect such a change? You may find this article of interest: https://en.wikipedia.org/wiki/Logic_bomb and this about the "joke" http://www.theregister.co.uk/2003/03/10/one_printer_one_virus_one/ .

Another assumption made is that open source = secure. This is not the case, as demonstrated by Heart bleed in the very popular open source OpenSSL library. Microsoft's implementation was not effected by such an attack, but is closed source.

Tor will guarantee "perfect forward privacy", but a destination must still be known. In theory, users can still be tracked through tor if the entry and/or exit nodes for your connection are compromised.

Not the answer you're looking for? Browse other questions tagged or ask your own question.