Comment by capital@lemmy.world on Secure Boot is completely broken on 200+ models from 5 big device makers

Yes, surely randoms on Lemmy know better than Microsoft and the NSA in regards to security.

Oh anyone who doesn’t trust Microsoft with their life is a complete idiot. And the NSA only illegally spied on everyone until Bush the II made it legal! So of course we should unquestioningly follow their configuration guides. I mean - haha - we don’t wanna get disappeared! Haha ha. Not. Not that that’s ever happened. That we know of. For sure. Probably.

in regards to security

in regards to security

Just wanted to make sure you saw it this time because you went off on a tangent there.

It doesn’t matter if they know about security (which they do). A burglar could know about locks and home security systems, would you take his advice?

Their positions on security of others is dismissed on grounds of trust not of competence.

The NSA has two jobs.

The first is to break into any computer or communications stream that they feel the need to for “national security needs”. A lot of leeway for bad behavior there, and yes, they’ve done, and almost certainly continue to do, bad things. Note that in theory that is only allowed for foreign targets, but they always seem to find ways around that.

The second, and less well known, job is to ensure that nobody but them can do that to US computers and communications streams. So if they say something will make your computer more secure, it’s probably true, with the important addition of “except from them”.

I won’t pretend I like any of this, but most people are much more likely to be targeted by scammers, bitcoin miners, and ransomware than they are by the NSA itself, so in that sense, following the NSA’s recommendation here is probably better than not.

Exploits don’t care if you are actually the NSA or not. The NSA certainly knowns that yet they keep exploits secret at least from the public.

They have argued for key escrow for God’s shake.

They are primarily an intelligence agency. If you are not likely to be targeted by the NSA you are also unlikely to be targeted by any of their adversaries. They don’t give a shit if you get scammed, they are not the FBI, who also keep secret exploits and are anti-encryption.

Additionally using their “best” exploits on more simple targets still poses a risk to them being discovered and fixed. Therefore it’s beneficial to them for everybody’s security to be compromised. It also provides deniability.

Right. Their advice for the general public is a mix of “best practice” and risk. If an exploit is not actively exploited in the wild, they’ll probably sit on it for intelligence purposes and instead recommend best practices (which are good) that doesn’t impact their ability to use the exploit.

So trust them when they say do X, but don’t take silence to mean you’re good.

A burglar could know about locks and home security systems, would you take his advice?

Literally, yes. There was even a TV show about it.

Do you have any evidence those two people are still committing burglaries? The NSA is not an ex-intelligence agency.

I get my advice from LockPickingLawyer on YouTube. He’ll demonstrate the weaknesses of various locks, and say which to avoid and which are probably okay (“okay” is a really strong recommendation from him). He’ll still break into really secure locks in <2 min, but he’ll describe the skills necessary to break in and let you decide on what your threat level.

Basically, as long as it’s bump and bypass resistant, you’re good. Burglars aren’t going to pick locks, they’ll either break a window or move on if the lock stops them. A good lock doesn’t keep out a burglar, it just slows them down enough that they’ll give up.

So yes, get advice from people who have the skills to break the protection they’re recommending, they’ll be able to separate things into threat categories. If you want OPSec advice, visit black hat hacking forums and whatnot, you’ll get way better advice than sticking with the normie channels.

A burglar could know about locks and home security systems, would you take his advice?

If they were an expert burglar, I might

Source: I’m an expert burglar and all of the others on my burglar crew are very helpful when people ask about home security stuff.

Exactly, they have a clear conflict of interest

Hey what is that, some kinda tangent

Security is the last thing NSA and Micro$oft care about. NSA wants to be sure they can do all they need to with your devices, and M$ just wants to discourage you from switching to linux.

This is obviously insane

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Secure Boot is completely broken on 200+ models from 5 big device makers(arstechnica.com)

in regards to security

in regards to security

in regards to security

Technology

!technology@lemmy.world

Our Rules

Approved Bots

Community stats

Community moderators