On Sep 19, 2007, at 08:16:30, Satyam Sharma wrote:
Well no duh. I think most of the 4-year-olds I know could have told
you that. What sense does it make to give a spy all sorts of fancy
electronic listening and monitoring equipment and then rely on the
physical security of your average Dell? You _can_ make a laptop
sufficiently secure that its data is encrypted and it cannot be
physically compromised to install a hardware keylogger without
virtually destroying the enclosure, but that's completely unnecessary
for 99.99999% of the users on the planet.
We would be much better off if all the companies getting their data
stolen out from under them on company laptops would just use basic
drive encryption and implement basic physical-security training.
*THAT* is where protecting the laptop is easy; all the bullcrap about
foreign intelligence is just drawing focus off of how easy it is to
achieve *adequate* physical protection where it matters.
From a practical standpoint, an identity thief trying to determine
which company to attack will just steal a few laptops from a company
which doesn't encrypt them instead of going through all the very
risky steps of trying to break into the laptops of one that does.
Of course, this also relies on being able to teach the stupid lusers
with the laptops not to give their boot password to the "service tech
on the phone"
Yes I did and I wanted to make it *really* clear that with average
hardware you can properly protect against virtually all of the
*common* attack vectors. The pretty standard problems of "somebody
stole the company laptop with a bunch of credit-card info on it" or
"my personal financial data was on the laptop I left in the airport",
are pretty easy to make safe. Furthermore, that is *EXACTLY* the
initial example I gave (my laptop with my personal data on it).
On the other hand, I made this point in my original email, so if this
is what you were arguing about you've been preaching to the choir.
To quote myself again:
Cheers,
Kyle Moffett
-
