Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #185735

Re: Wireless devices and cryptography in practice (Was: USB wireless keyboard in stretch)

Show all headers | View raw

On 08/22/2017 01:17 PM, Mario Castelán Castro wrote:
> On 22/08/17 10:22, Jape Person wrote:
>> Hence, why I suspect that they are vulnerable. I bought these
>> things because my wife trips over her cables 3 or 4 times a day,
>> and wireless ones are just easier to deal with from a workstation
>> logistics standpoint.
> 
> Wireless things do not solve the problem of having to cope with
> wires. They just replace this with the bigger problem of unauduitable
> firmware directly exposed to the attacker (via radio or sometimes
> infrared communication).
> 
> My suggestion is to instead address cabling directly. If your wife
> trips because cables are in the floor, then use some wire to coil the
> excess length so that it does not hang. If your cables have to go
> through a walkway, then pass them through the bottom of the ceiling,
> so that the floor will be clear and thus avoid the “tripping hazard”.
> Use a cable extension if required. You may need to go to a hardware
> store to buy a cable tray or a wall-mountable cable clamp.
> 

There's no fix for my wife and the presence of cables. In this case, the 
cables for keyboard and mouse run from the Intel NUC computer nestled in 
a table beside her recliner to the keyboard on her lap and the mouse on 
her arm rest. She has yanked the cables free of the computer, pulled the 
computer out of its shelf, dropped the keyboard and then tripped over it 
when she tried to retrieve it, and actually toppled the table while 
"arguing" with the keyboard and mouse cables. Wireless devices were a 
ploy to reduce the likelihood of her causing damage to the various 
devices because of her interaction with things that were tied together 
physically.

Her clumsiness doesn't reduce her charm a bit. But you do have to be 
careful not to stand next to her in the kitchen. She gestures a lot with 
her hands -- even when holding knives. Ever seen a Fellini movie?

Kindest, sweetest person I've ever known. Over 60 years together, and 
she hasn't killed me yet. If she does, everyone can rest assured that it 
was an accident.

>> I'll look into getting the test suite from Bastille to see if I
>> can figure out how to do some testing on these things to see if
>> they look vulnerable. Do you really think that this is unauditable?
>> Bastille claims to have produced Open Source tools for doing just
>> that.
> 
> If the device firmware is secret, then it is unauduitable. Of
> course, this applies to wired keyboards too. The problem is that
> wireless keyboards are exposed to possible attackers, while wired
> keyboards are not.
> 
> I have not heard about Bastille. Apparently they sell a
> vulnerability scanner for wireless devices. I can easily be wrong
> here because I just took a quick glance at
> “https://www.bastille.net/product/introduction/”.
> 
> By doing vulnerability scanner, one can only test the device for a 
> limited set of *known* vulnerabilities (the test suite must know what
> to look for). I would not trust any wireless device just because a 
> vulnerability scanning found nothing on it. Without seeing the
> firmware source code, one can not tell if it has vulnerabilities
> previously unknown.
> 

Point taken. Saves me the time of fiddling with it. I just won't use the 
wireless stuff on my computers. I live in a large condominium which 
houses everything from script kiddies to DoD security folks.

>> Maybe I'll just use the wireless keyboards and mice to control
>> TVs.
> 
> Ugh? I did not know that TVs that have any use for keyboard and mice 
> input existed. I guess it's just yet another class of devices with 
> “walled-garden type” proprietary software providing an incountable 
> number of fancy but completely useless bells and whistles.
> 
> What is next? A toaster that makes a Twitter post when the toasts are
> ready?
> 

Actually, the LG OLED TVs we have use an OS and application software for 
which source is readily available. Firmware for the bluetooth and / or 
usb wireless connectors may be another thing. But I haven't checked 
because I don't care if someone sends keystrokes to the TV. Yeah, good 
place for the wireless keyboards and mice. The Web browser on the TV 
actually works pretty well, though I hardly ever use it. The keyboards 
make entering search terms or passwords for connection to things like 
Hulu and Netflix a ton easier than doing such things with a "smart" remote.

>>> That is why opaque cryptographic systems can not be trusted. This
>>> is covered in any practical cryptography book.
>> 
>> Practical cryptography -- isn't that an oxymoron, for most users
>> at least? [...]
> I was referring to *books* that address the issues related to 
> *deploying* cryptographic systems as opposed to theoretical issues
> or cryptanalysis (for example, the mathematics of elliptic curve 
> cryptography, hash constructions “probably secure” based on the
> random oracle model, and other details that are not relevant to the
> end users). The question of whether cryptography can be practical is
> a very different matter.
> 
> I believe that cryptography is already practical. For example, 
> encrypting e-mail with Enigmail and Thunderbird is very easy. Many 
> distributions have graphical installers (lay users are allergic to 
> ncurses-type interfaces) with which an encrypted volume can be set
> up easily. Many web sites use TLS transparently to the user, et
> cetera.
> 
>> In a day when people post their most personal experiences and
>> thoughts on Facebook or Twitter for everyone to read [...]
> 
> But about the huge amorphous mass of typical Facebook users, those
> are a lost case. The fact that they couldn't be made to properly
> secure their information –even if their despicable lives depended on
> it– is not a fault of the cryptography systems. It is a fault of
> their indolence and incompetence. Related: 
> <https://web.archive.org/web/20140329180453/http://eatliver.com/i.php?n=4043>.
>
>  Personally I do not care about “privacy” in the normal sense,
> because I do not care about the opinion of people about myself
> (However, I do care about *arguments* that I am doing something
> wrong). However, I care abut encryption because I do not want to
> leave through the Internet personal information that maybe can be
> used *against* me.
> 
> Regards.
> 

Precisely. Governments and other entities have proved many times over 
how untrustworthy they are when they get their hands on personal data. 
Political and monetary motivations often tempt them to weave fascinating 
narratives based upon the slimmest of coincidental associations. Once 
the narratives are created, they are tempted to act upon them -- 
especially if they need a scapegoat on short notice.

Them: "Don't worry, if you drown when we dunk you, we'll know you 
weren't a witch! You'll be exonerated!"

Me: glub, glub, glub

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: USB wireless keyboard in stretch Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 04:50 +0200
  Re: USB wireless keyboard in stretch Jape Person <japers@comcast.net> - 2017-08-22 06:10 +0200
    Re: USB wireless keyboard in stretch Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 15:40 +0200
      Re: USB wireless keyboard in stretch Jape Person <japers@comcast.net> - 2017-08-22 17:30 +0200
        Re: USB wireless keyboard in stretch Zoltán Herman <zoltanhbz@gmail.com> - 2017-08-22 18:20 +0200
          Re: USB wireless keyboard in stretch Zoltán Herman <zoltanhbz@gmail.com> - 2017-08-22 21:10 +0200
        Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 19:20 +0200
          Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 19:40 +0200
            Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 19:50 +0200
              Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Nicolas George <george@nsup.org> - 2017-08-22 20:10 +0200
            Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Nicolas George <george@nsup.org> - 2017-08-22 20:00 +0200
          Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Nicolas George <george@nsup.org> - 2017-08-22 20:00 +0200
          Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Jape Person <japers@comcast.net> - 2017-08-22 20:10 +0200
            Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 20:50 +0200
              Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Jape Person <japers@comcast.net> - 2017-08-22 22:20 +0200
                Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 23:20 +0200
                Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Jape Person <japers@comcast.net> - 2017-08-23 00:10 +0200
                Re: Wireless devices and cryptography in practice (Was: USB wireless  keyboard in stretch) Jape Person <japers@comcast.net> - 2017-08-23 00:10 +0200
          Re: Wireless devices and cryptography in practice (Was: USB wireless keyboard in stretch) Fungi4All <fungilife@protonmail.com> - 2017-08-22 23:40 +0200
  Re: USB wireless keyboard in stretch Darac Marjal <mailinglist@darac.org.uk> - 2017-08-22 11:20 +0200
    Re: USB wireless keyboard in stretch Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 15:50 +0200
  Re: USB wireless keyboard in stretch Dominic Knight <dominicknight@gmx.com> - 2017-08-22 12:30 +0200
    Re: USB wireless keyboard in stretch <tomas@tuxteam.de> - 2017-08-22 12:30 +0200
      Re: USB wireless keyboard in stretch Zoltán Herman <zoltanhbz@gmail.com> - 2017-08-22 14:40 +0200
    Re: USB wireless keyboard in stretch Ben Caradoc-Davies <ben@transient.nz> - 2017-08-23 00:40 +0200
      Re: USB wireless keyboard in stretch Ben Caradoc-Davies <ben@transient.nz> - 2017-08-23 00:40 +0200

csiph-web