Hacker News Reader

Comment by gizmo686 | Hacker News Reader

IT should be able to revoke any access the machine has, so the only compromise would be what was already on the machine; which would be the case regardless of security policy, as they could just access the harddrive directly regardless of OS security policy.

In practice, it wouldn't suprise me if that computer was locally storing passwords that were not specific to that machine, which might mean needing to revoke a bunch of passwords

View on HN

> as they could just access the harddrive directly regardless of OS security policy.

I think that's wrong if you consider disk encryption.

From what I've read, full disk encryption was optional in the House until very recently. If this was a shared machine it's almost certainly not encrypted.

full disk encryption is also possible with a shared computer. TPM and PBA are some keywords

Possible? Very. Likelihood of the computer's login password and thus hard drive decryption key attached to the computer's screen with a post-it note thus obviating the protection gained from full disk encryption? On a shared computer, high.

For a computer most will use the back of the keyboard :)

reminds me of this xkcd: https://xkcd.com/538/

The user doesn't need to enter a password if they are using a TPM.

If they stole the laptop, they also stole the TPM inside the laptop, so having the key stored there doesn't help.

True. I was thinking they'd be using their centralized accounts once they reach the OS logon screen, thus no post-it necessary, but maybe that's not the case.

Absolutely it's possible, but as it was a shared computer, it's also likely to be one of the oldest in the fleet. It's also likely to be one that no one bothers to ask for specific attention to. As a result, it's likely that no full disk encryption was ever applied.

1st time that laptop reaches out to the internet should be the last time, if security is worth it's own salt.

That assumes it can talk to IT's systems, and it's done before the computer is "inspected". For a corporate laptop, that can easily be unlikely.

I'm not talking about telling the laptop that it's access is revoked; I'm talking about just revoking it's access, so if it every tries to connect to the House's intranet, it would have no more permissions than any other laptop.

If IT wanted to wipe the drive, then they would need the laptop to phone home in some way.

That assumes files weren’t downloaded. Even if access is revoked, saved copies still are accessible.

>which might mean needing to revoke a bunch of passwords

That doesn't help much because many people use patterns to their passwords and use the same passwords elsewhere. Seeing the expired passwords of many important people would have a very high chance of having a few which would be of use in breaking into accounts even if they were already expired.

Reply on news.ycombinator.com