Comment by anonym29 | Hacker News Reader

Comment by anonym29 | Hacker News Reader

I assume it is, per Intel ME / AMD PSP's ability to read everything - memory, CPU registers, disk, inspect all network traffic, directly utilize onboard GbE for bidirectional communication.

For adversaries below the level of the US intelligence agencies, I run everything virtualized and compartmentalized with Qubes, the installation image for which I verified the dev-provided cryptographic signature matches. I try to rigorously avoid any software operated by Google, Amazon, Microsoft, Apple, Facebook, disable all JS by default in my LibreWolf browser, refuse to connect directly websites protected by cloudflare, audit source code for almost everything I run in userland, etc etc etc.

This is all for my personal machine. For work devices, I assume they're pwned even worse and I do nothing but actual work on them.

On the mobile side, GrapheneOS on a Pixel for my first phone, and a linux phone with hardware killswitches for bt/wifi, cam/mic, and baseband for my second phone.

All of this in addition to solid fundamentals like network traffic monitoring, very restrictive firewall, offline encrypted hardware password manager with no password reuse, etc.

May I ask what necessitates this level of security? E.g. work, or personal preference in terms of security and privacy?

Personal preference + knowing how the sausage is made (red team).

> refuse to connect directly websites protected by cloudflare

What do you do in case you want to use a website protected by cloudflare?

There are many ways to do this, most utilizing some kind of proxy-like architecture for all requests, or just to retrieve cookies. My personal favorite for retrieving cookies is FlareSolverr.

For strictly reading public webpages, public paywall bypass tools and archive sites work pretty well.

Thank you!

Since this is a ridiculous troll, so generally speaking the only way to address this to visit the site from a local library, then immolate the computer with thermite and explode the remainder with TNT.

Not trolling, just extremely conscientious about privacy and security, far outside cultural norms / overton window, though frankly, that's not saying much in an age where almost everyone has smart assistants all over their house, insurance companies tracking accelerometer/gyro/gps data from every drive they take, and exclusively chat on systems produced by major corporations that are logging everything indefinitely and eaglerly cooperating with law enforcement / intelligence community without even requiring warrants for data requests - almost all closed source and with a client-server architecture with no way of even auditing how much is being recorded, whether any of these companies are actually honoring their privacy policies or not, etc.

I understand that trust by default is an enormous aspect of our economy, and trust may be characterized as the single most valuable commodity, but my work involves adopting a strict zero trust mindset, and it can be difficult to turn that off after so many years.

Isn't a (non-Android) Linux phone a security downgrade unless you get Qubes running on it or something? (And secure boot, and an HSM of some sort, and...)

Yes in some ways, for sure. Unfortunately, there are not a lot of options if you want hardware baseband killswitch that doesn't kill your wifi too.

Did I misunderstand or do you really have a baseband hardware killswitch? That's some dedication.

Check out Purism's Librem 5. It's extremely expensive for the specs you get, but for me personally, the peace of mind is worth it.

https://puri.sm/products/librem-5/

They also have a "made in USA" version (though the case is made in China and the wifi chip is made in India). It's even more expensive, and I certainly don't trust that USG/IC hasn't attempted to backdoor this either - we know a lot of ARM processors have the TrustZone, which is very similar to ME/PSP (I believe an ARM TrustZone core is actually how PSP is implemented), but the lead time is much shorter.

https://shop.puri.sm/shop/librem-5-usa/

Note that I'm not formally endorsing them, just sharing what I use.

Reply on news.ycombinator.com