« first day (3692 days earlier)      last day (40 days later) » 

12:09 AM
@forest Luckily, the people who use quantum computers to attack crypto aren't the people who like reading my messages.
It's all just shitposts anyways
When I get banned from Twitter and the DMZ, I'll shitpost my memes via pirated ham radio
2 hours later…
2:14 AM
@reed Sadly, for business that ain't going to be easy. Even if you have such an OS, all your users want to use Office. And the marketing team wants Photoshop. And then a bunch of industry-specific software runs on Windows only. So we're stuck using Windows for everybody and trying to manage the risks as best we can.
I'm probably going to give in and use AV for my users for a year or two until we can afford doing something more useful (maybe DeepFreeze?)
2:33 AM
Hey, I have an idea of something, but I'm not sure what the terminology is for it.

Essentially, I'm looking for something where:

1. A trusted server issues a token to a person. The idea here is that this server has real-world checks to make sure that a human only gets 1 token, period.
2. When the person wants to authenticate with a website, they use their token. The server has a guarantee of uniqueness, while the person's token remains private unable to be associated with accounts on other websites.
What's your goal?
That kind of sounds like an authentication cookie.
The primary goal is to prevent user creating anonymous accounts
each person only gets 1 account
while also preventing keeping privacy for that person
So read-world checks would involve actually verifying the legal identity of the person?
right. The goal is not privacy to the trusted server, but privacy towards the server authenticating
I can't think of any way that that could be automated. You'd need human intervention, since there's really no way a computer could perform a background check on a person on its own.
2:38 AM
Right, I'm not talking about the "Ensuring 1 token for 1 person" part. Assume that that is solved
Then I might be misunderstanding your question.
3:36 AM
@FireQuacker deepfreeze has its own issues - your uses will want persistant files
3:54 AM
Essentially, this is authentication that requires 3 parties:

1. A trusted server that issues 1 token per person. How the server actually manages to ensure that each person only gets 1 token is out of scope.
2. A website that wants to ensure that each person can only sign up once.
3. A person that wants to sign up to the #2 website, but also doesn't want to reveal his token to the website.
@NathanMerrill Oh, so proving to the server that you have the token, without proving who specifically they are, despite them needing to provide personal info to get the token?
There are a number of ways to do that. Direct Anonymous Attestation is a way to do it with hardware (TPM), so it could be a solution. Cloudflare's "Privacy Pass" might be a good resource, too.
The terminology you'd be looking for would be zero-knowledge proofs of ownership, oblivious transfer, anonymous attestation... Just a few off the top of my head for further reading.
4:41 AM
@forest I find the URL misleading :D
heh it really is
1 hour later…
6:01 AM
@JourneymanGeek True that. For office users, it might not make much sense. But most of my users are technicians who are frequently at construction sites. We have laptops get broken or stolen from time to time. In my perfect world, nothing important stays on the laptop for very long.
2 hours later…
7:41 AM
@forest I guess case-insensitive would raise the bar for script kiddies. That's the only threat against which I consider AVs atleast partially effective.
@forest Since you seem to have lots of knowledge about these sort of things, what's your take on this?
Q: Can Google access data in their Confidential Computing VMs?

Ole TangeA cloud operator such as Google can take a snapshot of a normal VM. This includes CPU state, RAM and disk. This can then be copied to another physical and resumed there. Or it can be analyzed off-line, and any cryptokeys in memory or in the CPU state can be extracted. This means that if you do no...

1 hour later…
9:14 AM
@FireQuacker the world isn't perfect.
Stolen and people stupiding are different threat models
You deal with stolen with robust encryption and identification
11 hours later…
8:39 PM
@nobody Unfortunately I don't know much about SEV. My hunch is that it's good against passive attacks, but the implementation is probably vulnerable to active attacks.
2 hours later…
10:36 PM
Does anyone here have a copy of public Belkasoft forensic articles?
never heard of it before...
I'm curious because I'm doing some research to build on my answer to a forensics question:
A: Does formatting an SSD securely delete all data?

forestIn theory, yes. In reality, it depends on the SSD's implementation of TRIM. TRIM is an optimization. Its actual implementation is left up to the manufacturer. Currently, most SSD manufacturers will queue a block for erasure by the garbage collector when it is discarded by TRIM, and this erasure i...

And e.g. belkasoft.com/ssd-2016-part3 seems to be partially behind a paywall (?)

« first day (3692 days earlier)      last day (40 days later) »