Hacker News Reader

Comment by jedberg | Hacker News Reader

People like to tear apart Echos because of the privacy fear a lot of people have around them. But in this case, I'm sure many devices have the same problem. It's just a matter of not wiping the NAND memory and instead just invalidating pages. I'll bet you could get a bunch of Wifi and Netflix credentials by buying up used TVs too (another place where people have privacy fears).

Apple at least gets this right by encrypting everything in memory and then just rotating the key (and I think Android does this now too?). But that is complicated and expensive.

I guess those of us super concerned with privacy either shouldn't sell these devices used, or get a powerful magnet that can cause bit flips (or not buy these in the first place, but good luck living in a modern world without buying a device with NAND memory in it)!

View on HN

I don't believe magnets cause bit flips in NAND - they're tiny little capacitors. If you're able to induce enough current with the magnetic field to scramble that, you've probably also induced enough current to fuse open an awful lot of important conductors elsewhere in the device. Which, of course, also accomplishes the goal, just without the "reuse" option.

> But that is complicated and expensive.

Complicated, maybe, but expensive? Once the software is written, there should be no more cost.

> a powerful magnet

A simpler approach is, before recycling electronics, a couple blows with a hammer on the circuit board ought to take care of it. Sure, a well-funded actor may still be able to retrieve something from the memory, but unless you are a very valuable target, nobody will find it worthwhile to reconstruct a shattered circuit board.

It's why I was always amused by people worrying that an electron microscope could retrieve data from a hard disk drive rewritten 6 times. Yah, nobody's going to do that.

The trouble with using a hammer is that you'll need to break the flash chips themselves. Breaking just the board isn't enough if the contents are not encrypted. The chips are easy for an adversary to identify, but difficult for an average consumer.

I have no idea what a magnet is supposed to do to flash chips, though. I thought that only affects magnetic media like hard drives.

People buying your stuff on ebay or from the thrift store are not going to desolder the flash chip and solder it into an identical board.

They'll just move on to an easier target.

It's like locking the door on your house. Sure, someone really wanting to get in will bypass it. Opportunistic criminals, which are the vast majority, will just move on. You just have to not be the slowest guy in the herd running away from the leopard.

> Once the software is written, there should be no more cost.

You'd need to include a Secure Enclave chip or something like it in each device. That adds cost. I've worked with IOT hardware vendors before. They will argue with you over 128K of RAM because of the cost. Every extra chip, every ounce of weight hurts their profitability at scale.

> A simpler approach is, before recycling electronics, a couple blows with a hammer on the circuit board ought to take care of it.

But then you can't reuse it. The whole point is to resell it to avoid e-waste.

> It's why I was always amused by people worrying that an electron microscope could retrieve data from a hard disk drive rewritten 6 times. Yah, nobody's going to do that.

The NSA would do that to a recovered Russian or Chinese hard drive.

Recycling is not the same as reselling.

> a recovered Russian or Chinese hard drive

Bit by bit with an operator and an electron microscope, how long will it take to recover a 1 terabyte drive?

An encryption key not stored on a secure enclave would still enable a robust factory reset, no?

It just wouldn't protect against some physical attacks to an unreset device.

Yes, it could be done without a Secure Enclave. In which case the data would be vulnerable in the case of theft or resale without a reset, but would be protected if it were reset, as long as the storage of the old key was actually properly wiped.

> a couple blows with a hammer

First, put it in a heavy-duty freezer ziplock bag and then place on concrete. This allows you to nicely pulverize the chips into many tiny pieces without making a mess. A hammer works well, but a few taps with a sledge hammer is even better and somehow more satisfying.

> I'll bet you could get a bunch of Wifi and Netflix credentials by buying up used TVs too (another place where people have privacy fears).

And smart light bulbs

https://www.commitstrip.com/en/2019/02/04/open-door/?

But that is complicated and expensive.

Could you elaborate? I'm not an expert in this area:

What makes this so complicated? As a non-expert in any moderate cryptography, it seems like it should be straightforward?

When you say expensive, do you mean computationally, dev time, or specialized hardware?

To to whoever answers for helping my curiosity.

> What makes this so complicated?

Making sure all data access goes through an abstraction layer that transparently encrypts and decrypts data has some complex bits to it, especially the part about storing the encryption key safely and rotating it properly. It also complicates all the hardware programming because nothing gets direct access to storage anymore, which a lot of IOT devices assume they have.

> When you say expensive, do you mean computationally, dev time, or specialized hardware?

All three. Computationally it's not expensive per se, but it requires adding a few more chips and making the CPU a little more powerful to handle all of the encryption and decryption. In IOT devices, every chip and every KB of RAM counts, so adding that overhead to every device could be a deal breaker on its own. I've worked with IOT vendors and they push back on even small increases in RAM, because it hurts their profitability at scale.

Dev time of course is required to make all the software support the abstraction layer, and specialized hardware would be required to securely store the encryption key (maybe depending on how hard core you wanted to get).

WiFi credentials maybe but I can't imagine the devices hold Netflix user passwords, I've never encountered it but surely the Netflix API just negotiates an API key tied to the user?

Reply on news.ycombinator.com