Root Access

qasdfdsaq

11:00

Yeah I'm just not sure if secure boot is needed to stop people tampering with my bootloader

Hennes

... "No livestock will be included "

I fear techdeals

qasdfdsaq

Supposedly the TPM will refuse to release the keys to the bootloader if it has been modified, similar to secure boot, but without actually needing secure boot

Bob

That sounds odd.

So the TPM is aware enough of the bootloader format to be able to verify it?

Especially since the old BIOS boot was basically a code entry point with no standard format? :S

qasdfdsaq

I dunno. I know very little about TPMs.

All I know is any modifications to the boot loader, boot sector, MBR or partition table will cause the TPM to refuse to decrpyt hte drive

Exactly how is what I'm trying to understand

Bob

@qasdfdsaq It's more the kind of case where you forget your laptop somewhere, someone comes along and does all that, and then you find it the next day. Or things like a kiosk computer left unattended. Those are all vulnerable to that kind of physical attack.

But it also probably won't happen randomly - you'd have to be targeted.

Would take quite a lot of effort.

qasdfdsaq

11:03

Yeah. Or I leave it in a hotel somewhere. Or lose it.

Mainly losing it with saved account passwords and corporate passwords on it. Not good

Bob

@qasdfdsaq All I know about the TPM is you store keys in it -_-

qasdfdsaq

Last time I had to change all my passwords at short notice it took 12 hours, and that was five years ago.

Bob

o.O

Changing all my passwords would be impossible.

Mostly because I don't even remember half the sites.

qasdfdsaq

Gah they could have so easily put a more powerful GPU into this laptop.

But instead they only put in a 940M and for some reason substituted it with an undocumented 920M at high street stores

Bob

@qasdfdsaq ...wut

wouldn't a 920M be on par with the iGPU?

maybe even worse depending on which iGPU you have

qasdfdsaq

11:08

Pretty much

Though arguably would provide a noticeable performance improvement anyway

Primarily because in a puny 15W TDP form factor, the CPU and GPU sharing the same measly TDP means neither can run at full speed during games.

Whereas bunging a same speed dGPU in there doubles the TDP available for the CPU to turbo with

Bob

true

qasdfdsaq

Which is why in GTA V (a fairly CPU-heavy game) switching from iGPU to dGPU in my laptop increases performance over 3x, despite the dGPU being less than 2x as fast

> If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys cannot be accessed until the TPM has verified the state of the computer.

During the startup process, the TPM releases the key that unlocks the encrypted partition only after comparing a hash of important operating system configuration values with a snapshot taken earlier. This verifies the integrity of the Windows startup process. The key is not released if the TPM detects that your Windows installation has been tampered with.

Bob

> important operating system configuration values

I actually have no idea what that could be.

qasdfdsaq

Sounds awfully like secure boot

Bob

If they're system files, does that imply that it can understand NTFS?

qasdfdsaq

11:14

Actually it seems I might need secure boot to protect TPM, rather than the other way round

@Bob Unlikely. I suspect Windows provides a list of drive addresses and hashes

Bob

And knowing the partition structure is useless if you're using legacy boot. Because there is no mandated structure.

@qasdfdsaq But that means defragmentation could lose you your bitlocker key

qasdfdsaq

Windows should update that automatically

Bob

Hm.

qasdfdsaq

> Computers that incorporate a TPM can also create a key that has not only been wrapped, but is also tied to specific hardware or software conditions. This is called "sealing" a key. When a sealed key is first created, the TPM records a snapshot of configuration values and file hashes. A sealed key is only "unsealed" or released when those current system values match the ones in the snapshot. BitLocker uses sealed keys to detect attacks against the integrity of the Windows operating system.

I know that resizing partitions blocks your key, unless you unprotect the key and then re-seal it again after resizing partitions

Bob

Ah.

qasdfdsaq

11:17

Ah fuck TPM I'll just use passworded FDE

Bob

> The hard disk must contain at least two partitions: the operating system partition and the active system partition. The operating system partition is where Windows is installed and will be encrypted. The active system partition must remain unencrypted so that the computer can be started, and this partition must be at least 100 MB in size.

> The operating system and active system partitions must be formatted with the NTFS file system

I forgot about that partition.

qasdfdsaq

Problem with TPM is it lets you boot the computer without entering the password, which is useless to protect against loss.

Bob

That one typically shouldn't be modified.

So it would work.

You could do whatever you want to the encrypted OS partition, and the bootloader ('system') partition would remain static (and unencrypted)

qasdfdsaq

Actually wait I don't need secure boot

Bob

@qasdfdsaq Wouldn't ideal be TPM and passworded?

qasdfdsaq

11:19

Nah, the point of TPM is to not need a password.

Bob

If you just have password without TPM, couldn't they modify/replace the unencrypted bitlocker binaries to save your password?

qasdfdsaq

In theory, authentication is passed over to the OS and deferred by the BIOS

Bob

So you'd need something external (e.g. Secure Boot) to verify the bitlocker binaries

qasdfdsaq

@Bob Only with system-level access from th erunning OS

Oh wait, without TPM. Yeah

But that's where secure boot comes in

Oh gawd we're going in circles

Bob

@qasdfdsaq I'm thinking of the offline attack.

Because that's what FDE protects against.

qasdfdsaq

11:20

So attack vector 1 - Someone nicks the laptop and tries to get at what's on it.

With TPM: The disk is decrypted and booted without password, but a password is required to get into Windows to access the data.

Modifying the Windows install offline is impossible, and modifying it on-line requires getting into the OS - which requires a password

Without TPM: Password required to decrypt disk. Arguably, can be intercepted by sophisticated attacks that replace the bootloader or boot sector.

Modifying Windows install offline becomes possible only after multiple offline attacks

(They'd have to install the boot-level keylogger, wait for me to turn it on and enter the password, then come back to retrieve the data. Pointless in a stolen/lost laptop)

Bob

@qasdfdsaq In the worst case the boot-level keylogger could transmit data over a (wired/public) network. They have >50 MB of space to play with, plenty for some basic TCP/IP code.

qasdfdsaq

With TPM AND Password: TBH the sophisticated attack in the second scenario might still be possible.

Bob

But that would be a highly sophisticated attack.

qasdfdsaq

@Bob They'd still need me to get the laptop back and use it again though. Which won't happen if it's stolen.

And loss/theft is really the most likely scenario here, if the NSA wanted to get me there's far easier ways.

Bob

Ya. It's more if it's temporarily misplaced/forgotten.

qasdfdsaq

11:26

I hope it's small enough to fit in hotel safes.

Bob

But unless you're dealing with really sensitive data...

Most attackers you face are the 'steal, sell on ebay' type

qasdfdsaq

Oh ooh oooooooh

I should get that thing my really geeky Engineering friend has

Bob

> If your computer does not have a TPM, enabling BitLocker will require you to save a startup key on a removable device such as a USB flash drive.

Hm. Is that a key saved on the drive, or the actual bootloader on the drive?

qasdfdsaq

Some sort of encrypted USB key with fingerprint reader that acts as a smartcard authentication device

Bob

Saving the bootloader on a drive you carry around with you would be an interesting way to get around the whole modified startup files problem.

qasdfdsaq

11:28

Yeah. Though TBH I don't carry USB keys around with me while travelling

Grr I wish this laptop just had a damn fingerprint scanner

... like my lsat one

Bob

@qasdfdsaq Heh, my last two HP laptops had fingerprint readers.

qasdfdsaq

It's SOOOOO convenient

I have a 20 character password that takes about a minute to type on a tablet keyboard. If I get it right first time.

Bob

I don't think they were all that secure (and the drivers were shit), but they were easy to use :)

@qasdfdsaq Yup. No need to type the damn password.

My Clevo doesn't have one :(

qasdfdsaq

Yeah, again though, if someone has the sophisticated capabilities required to skim and duplicate my fingerprint, I've got other issues

Bob

And the company that made them for HP basically disappeared overnight.

So bye-bye driver updates.

qasdfdsaq

11:31

yubico.com/products/yubikey-hardware/yubikey-neo

I think this is what he had

Bob

@qasdfdsaq I recall some Mythbusters attempts and it apparently isn't that hard. Though depends on scanner design.

qasdfdsaq

It'd still have to be a targeted attack

And it's not like I look like any particular famous or high ranking government officials.

Bob

@qasdfdsaq Heh, allq has one. Dunno if his one has a fingerprint reader though. I think he had the first one.

qasdfdsaq

Interesting. I might prod him about it when I next see him

Bob

@qasdfdsaq Yea, a lot of effort required.

@qasdfdsaq I remember looking them up around then, and while the concept was interesting the implementation was ... well, it had a couple weak links, depending on what you used it for.

qasdfdsaq

11:34

Now if only my laptop supported NFC, I'd be able to just implant a chip in my finger

Bob

Especially website authentication.

qasdfdsaq

We have a cat feeder tray that uses reads the ID chip embedded in our cats and open/close according to what cat sticks his head in

DavidPostill

@qasdfdsaq You had better start wearing latex gloves in public then. It is trivial to get a fingerprint from a beer glass ;)

Bob

:26084644 There's probably a stock image of that.

Journeyman Geek

lol

qasdfdsaq

11:35

@DavidPostill While I don't drink beer, someone would still have to specifically target me to get anywhere.

Journeyman Geek

ENTIRELY inappropriate, but oh so funny....

qasdfdsaq

My beer glass and laptop are not usually co-located in the same building

Bob

@DavidPostill ...personally, I'd be more worried about the stalker than the data security

Journeyman Geek

@qasdfdsaq I have a friend with a magnet embedded in his finger

qasdfdsaq

@JourneymanGeek o_0

!!tell 26084653 :-o

ChatBot John Cavil

11:35

@qasdfdsaq Command :o does not exist. Did you mean: no, :-o (note that /tell works on commands, it's not an echo.)

> i.imgur.com/el2EsVb.gif

Bob

@qasdfdsaq Some electricians do that to have a bit of warning when working on maybe-live wires :P

qasdfdsaq

@Bob Yeah, that

Journeyman Geek

Oh, he's one those those hacker types

qasdfdsaq

@Bob Interesting. We have live wire detectors for that...

Bob

@qasdfdsaq It's a last-resort thing if you forget. Or your detector fails.

qasdfdsaq

11:36

@Bob RCD? :-P

Most modern homes have to have all circuits protected know

now*

Bob

reddit.com/comments/tl7pn/…

Journeyman Geek

(and of course, dogs are chipped but you can't use that to log in.)

qasdfdsaq

Though industrial electricians working on outside wiring would be, yeah. Magnetized

Bob

> I'm an electrical engineer. I've always been fascinated by electricity and magnetism. These magnets let me feel the size, shape, frequency, and intensity of any alternating magnetic field (and if strong enough, a static field). This is useful when you're troubleshooting any kind of circuit that involves a charging magnetic field, like power supply design.
I was also able to use it to troubleshoot a bad fuel injector on a car. I also validate it by saying that it might save my life some day be letting me know that a line is live before I touch it.

I misremembered it :P

DavidPostill

instructables.com/id/…

How To Fool a Fingerprint Security System As Easy As ABC

qasdfdsaq

11:39

@Bob Nice

DavidPostill

Thinking Putty defeats Fingerprint Scanners!

puttyworld.com/thinputdeffi.html

qasdfdsaq

I wonder if my laptop supports Windows Hello

TBH that won't be too useful. I mostly use my laptop in the dark, lying sideways in bed

2

Bob

The facial recog?

@qasdfdsaq isn't that most people? :P

qasdfdsaq

> If you want to log in with your face, you need to either get a new notebook or all-in-one PC that has the Intel RealSense camera built in

Fudge

Journeyman Geek

lol

least it ain't voice recognition.

Bob

11:43

o.O

qasdfdsaq

Voice recognition would actually work better

Since I can use my voice in the dark...

Journeyman Geek

@qasdfdsaq I break most voice recognition

DavidPostill

@qasdfdsaq I would guess it is easier to record your voice than it is to clone your fingerprint ...

Journeyman Geek

Must be cause ~~most of them don't do dog~~ I have an odd accent.

DavidPostill

@qasdfdsaq You can't use your finger in the dark? How sad ;)

qasdfdsaq

11:46

@DavidPostill Not without something to use it on

I wonder why nobody makes micro/nano USB fingerprint readers like the size of those nano USB wireless receivers

I should start a kickstarter or something

Bob

@qasdfdsaq send me a link when you do :P

qasdfdsaq

@Bob Well there's a small one here: it-sp.eu/…

Not quite small enough though, I'm thinking a flat one that can be always left in the laptop

Bob

Hm. It's close, but juuuuust big enough that I'd be scared of damaging the port.

qasdfdsaq

Yeah.

Bob

> AuthenTec

...isn't that the now-defunct HP supplier?

> On 27 July 2012, AuthenTec was acquired by Apple Inc. for $356 million.

qasdfdsaq

11:53

Something like that, with a swipe type reader where the Logitech writing is

Bob

It is (was) the HP supplier!

qasdfdsaq

I mean they manage to fit a non-swipe reader into the home button of a Galaxy S6...

Bob

h30434.www3.hp.com/t5/Notebook-Hardware-and-Upgrade-Questions/…

> HP SimplePass by AuthenTec

qasdfdsaq

Well they're not just HP (My fujitsu had one). And they're apparently now working for Apple, rather than defunct

Bob

@qasdfdsaq Well, last I heard they stopped updating the drivers and software. Which is close enough IMO.

They basically stopped around the time (shortly before?) I got my previous laptop.

qasdfdsaq

11:57

That's just the size of a normal sensor, so it can be done

Bob

eww

amazon.com/Digital-Privacy-Manager-Fingerprint-Reader/dp/…

that thing is giant

and expensive

gizmag.com/authentec-eikon-mini-usb-fingerprint/22833

> US$10 launch price

except the store is gone: store.authentec.com/en-us/products/passwordmanagement/…

qasdfdsaq

:(

$10 is nice though

Bob

the entire bloody website is gone

the domain is now hosting ads

qasdfdsaq

Yay Aooke

*Apple

They have a habit of doing that when buying companies

Bob

I think when I looked them up back in 2013 they basically said they no longer supported anything

qasdfdsaq

11:59

"Your previous existence no longer exists"

Bob

that must be why I thought them to be defunct. because they basically are. Apple got the patents, employees, etc., but didn't want the products.

qasdfdsaq

idkey.com/purchase-idkey-x-series

Bob

now the domain's gone too

qasdfdsaq

I think that's sorta what my friend here has

Bob

@qasdfdsaq why the hell is that text in an image?

qasdfdsaq

12:01

@Bob Huh?

Oh

Bob

@qasdfdsaq all the text on that site

qasdfdsaq

Fuck knows. Retarded web design?

Ah fuck it I'll just use the Android proximity shit

Bob

lol

unlock the laptop with your phone?

qasdfdsaq

If I'm passed out in the same room as my laptop while someone is hacking it, I probably deserve it.

Nah, smartwatch

Or phone

Bob

I didn't know WIn10 could do that

qasdfdsaq

12:05

With the phone in turn being unlocked by the watch

Bob

I have the same thing on my phone

...might have to try Win10 on my laptop sometime

@qasdfdsaq Now you have me wondering if I could do NFC unlock with my transport card. Or my credit card.

I'll have to try it later.

Back in a bit.

qasdfdsaq

You probably can

Journeyman Geek

hmm

I'm trying to figure out if a question on bias lighting would be on topic

qasdfdsaq

Probably no

Unless on electronics

Wait no

I'm confused

Hennes

Anyone here ever RMA'd an item to Amazon ?

qasdfdsaq

12:09

Many times

Hennes

How?

qasdfdsaq

Website

Hennes

I can find the return items, but no RMA or 'it broke' in the reasons.

qasdfdsaq

Also depends if it's faulty outside 28 days or a normal return

Faulty outside 28 days goes through the "Contact us" link

Journeyman Geek

@qasdfdsaq Well its something that's essentially a computer accessary

qasdfdsaq

12:10

AKA you have to email them

DavidPostill

@JourneymanGeek

2

A: Where do we draw the line on questions involving human interfaces?

To me any problem that is not a fault with hardware or software but is a problem centered entirely on a human rather than a computer is off topic. Ergonomics such as "how do I arrange my workplace?" or "how do I stop typing things wrong" are purely wetware problems that are not concerned with p...

That covers bias lighting, no?

qasdfdsaq

@JourneymanGeek Yeah think I was thinking DC bias or something

Hennes

it was faulty after about 2 months.

DavidPostill

@JourneymanGeek @Mokubai said "Ergonomics such as "how do I arrange my workplace?" or "how do I stop typing things wrong" are purely wetware problems that are not concerned with problems on the computer itself. They have almost nothing to do with the computer."

Hennes

I used the amazon 'contact seller' first.

------------- Anfang der Nachricht -------------

Dear reader,

A few months ago I bought a lovely ebook reader from you via Amazon. The device
is great and I was very happy with it. Unfortunately the top part of the screen
stopped working. What is the warranty procedure? Do I contact kobo directly o
r (given the recent purchase) does this go though your shop?

------------- Ende der Nachricht -------------

qasdfdsaq

12:13

Oh was it a marketplace seller, not Amazon itself?

Hennes

This was the answer:

------------- Anfang der Nachricht -------------

Please follow the authorised Amazon returns procedure.

--- Urspr?ngliche Nachricht ---

Bestellnummer 302-5460913-6718718:
1 von Kobo N204-KBO-B Aura HD 17 cm (6,7 Zoll) eBook Reader (ARM Prozessor, 1,1G
Hz, 500GB RAM, 4GB HDD, kein Betriebssystem, Touchscreen) schwarz [ASIN: B00CFV4
5KS]

------------- Anfang der Nachricht -------------

Yes.

allquixotic

Morning/afternoon/evening

DavidPostill

@allquixotic You are missing Night ;)

allquixotic

Night ~~owls~~ foxes know who they are

Hennes

Pondering this

Journeyman Geek

12:19

@DavidPostill its a wee bit of a grey area to me still... which is why I'd mention such things here first ;p

Hennes

qasdfdsaq

Well if you can use the returns centre that should be your first port of call

Journeyman Geek

I'm looking at the antec kit and its just white LEDs (though at 5V) and its cool (not warm) white...

allquixotic

> The Marine Society

Hennes

With as text RMA request. Broke down within 6 months.
Need to check waarenty, but 1 year seems normal for these items)

allquixotic

12:20

That's what you get for buying a tablet from fish

qasdfdsaq

> Your Legal Warranty
If a product you’ve purchased on Amazon Marketplace turns out to be faulty after delivery or not as advertised (i.e., non-conformant), the Seller has to give you a free of charge (including return costs) repair, replacement or refund for a “reasonable time” following the sale. That time will vary depending on the product and its value. However, if you make such a claim more than 6 months from delivery, you may need to prove that the fault existed at the time of delivery of the product and wasn’t caused by, for example, an accident, misuse, liquid damage, etc.

Hennes

They also sell a lot of ebook about seamanship

allquixotic

Aww I was hoping for a SOOC (Star out of context) ;p

Tom Wijsman

@JourneymanGeek Now someone is sending fake password reset mails, great.

qasdfdsaq

@TomWijsman Ermagerd

Tom Wijsman

12:22

They don't understand how password resets work though... :-P

allquixotic

Someone is really griefing you @TomWijsman :(

Tom Wijsman

It only really works if the mail comes from Super User. >_<

Journeyman Geek

@TomWijsman again?

I'm pretty sure for this guy the point is annoyance

Tom Wijsman

Yeah, but this time the form isn't used.

The contents of the password reset mail have been copied and sent from a non-SE e-mail address.

Journeyman Geek

Oh?

That's new

qasdfdsaq

12:25

Lmao

Should be easily able to trace him from the email source IP and report him to his ISP

Tom Wijsman

No, it's easier than that. :)

Journeyman Geek

@TomWijsman wait. He used a non throwaway email address?

qasdfdsaq

Enter his email address into SE's password recovery?

Tom Wijsman

The links are invalid, meh, otherwise I'd had access to his account...

Journeyman Geek

@TomWijsman If its who I think it is... wouldn't do you much good anyway.

hmm

howtogeek.com/213464/…

That answers most of the stuff I was wondering

DavidPostill

12:34

@JourneymanGeek I would say it very much depends on the question. Many questions about "ergonomics" could be "opinion based". However, if it was about software such as f.lux it might be on topic. Did you have a particular question in mind?

qasdfdsaq

@JourneymanGeek Huh, my monitor has a built-in bias light then

But I can also use my Philips Hue bulbs

Tom Wijsman

@JourneymanGeek team.stackexchange@... >_<

Journeyman Geek

@DavidPostill primarily whether there's a point, and what colour temperature to use.

@TomWijsman cute.

@DavidPostill f.lux dosen't count

Its more of a chat topic

Hennes

Why is pom.xlm still on the star list? Wrong kemning ?

Journeyman Geek

That and dyslexia I suppose.

Tom Wijsman

12:43

@qasdfdsaq If only webmail services didn't exist...

Journeyman Geek

@DavidPostill Its probably kinda subjective

I do have a set of multicoloured dioders we use during festivals so I might dig it up and try ;p

My desk's probably going to be totally re-configured next week so... prolly after/around that

DavidPostill

@JourneymanGeek Did I already say: could be "opinion based"? ;)

Did you manage to sort out your sagging desktop?

Journeyman Geek

@DavidPostill not really

I'll be moving stuff around to try to mitigate that when I reconfigure

.... (I totally forgot about the sagging desktop)

DavidPostill

Can you attach anything to the wall?

Journeyman Geek

Not easily

and I might be moving my stuff over to my brother's former room once he eventually clears out

so I don't want to vesa mount anything to the wall ;p

DavidPostill

12:53

Ahh. The obvious solution is to screw a piece of 2x4 wood to the wall at the right hight. That would stop the deskktop bowing. If you put the desktop back upside down it would flatten over time. You can also moisten one side of the desktop (I forget which side) which would expand the wood fibres on one side to counteract the curve.

Journeyman Geek

I can't turn over the tabletop

Its got... well I have a bunch of shelving at the bottom for cable and power ;p

also its particleboard

I might just add another threstle

and I figure all the weight is on the right so adding another monitor on the left might help....

Or so I tell myself ;p

DavidPostill

Hmm. More weight would make it bend more, no?

Journeyman Geek

unbalanced weight tho

so it would bend more evenly ;p

I might be getting another desk, there's this really thick ex-office conference table

If I can move it (into the other room) It would ~~fill up half the room~~ probably give me a better desk

Its kinda deep tho

DavidPostill

I was reading a crime novel a couple of days ago where the detectives desk were deliberately sloping so piles of paper would slide/fall over. The idea was to encourage a "clean desk" policy ;)

Hennes

next was a clean floor policy ?

Transcript for