Hacker News Reader

Comment by Hizonner | Hacker News Reader

A "diode" is not an air gap. If there is any flow in either direction, you don't have an air gap. This isn't hard to understand.

View on HN

Whether you want to define it as a true air gap or not, this is effectively how most "air gapped" clouds work, with diodes.

There's only a couple of cases where this can go wrong. Either the contents of what is being sent out could be wrong, or the hardware itself could be tampered with to extract extra information on another optical or radio channel. Both of these require extensive software tampering. In the simple case where you trust the software on both sides, and the hardware, this can be practically as good as it gets (with the requirement that the inside be monitored automatically somehow).

Last I checked, light does indeed cross gaps of air, so "air gapped" is at least more appropriate than your comment.

By that logic, an open wifi router would be considered air gapped, n’est pas?

yes, but if your adversary is capable of exploiting a one-way diode to RCE, you might as well just give up.

Prepare to give up I'd say[1][2].

[1]: https://arxiv.org/abs/1503.07919

[2]: https://arxiv.org/abs/2012.06884

both of these require the isolated machine to be heavily compromised to begin with.

there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,

Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.

In many industrial applications, the concern is mostly control of the isolated side, like because that could physically destroy stuff. Exfiltration is a smaller or nonexistent concern, since you're already sending most data out deliberately.

So there's still an attack surface, but it's a lot smaller. Any side channel exploit would need to work (at least in some initial form) without changes to the software on the isolated side, since you otherwise can't bootstrap your way to installing it.

If I gave away a PC with perfect RF isolation and a rock solid supply chain it wouldn’t improve most user’s overall security because their operational security is so poor. There is no need for any organization to snoop your RF when you’re leaking everything they care about in your metadata.

Intercepting metadata requires a different type of surveillance which may not be possible. The metadata is not at all equivalent to what can be sniffed via RF, which can include your actual keystrokes and the pixels on your screen.

Yes, this is about as secure as any network connection can be made.

I don’t see what diving into pointless semantics adds to the discussion here.

Because a company advertising security solutions who misunderstands basic terminology is highly suspect.

Good thing it's only important semantics that are being dived into then

Unless the mossad is after you one way light based coms may as well be

Reply on news.ycombinator.com