Hacker News Reader

Comment by 36erhefg | Hacker News Reader

I'm surprised a plain floppy disk is considered secure because it is in an envelope. Even though that envelope requires an id to pick up, I see that similar as a message in plaintext that has a header: private - please don't read.

View on HN

From another perspective, a floppy is also secure because it is a completely dumb storage device: it's just a piece of magnetic media in a plastic case. The drive is equally dumb, and the controller IC is usually a hard-wired logic array. The format has been around for a long time and publicly documented in standards. Contrast this with USB drives which have their own firmware and microcontrollers that can hide maliciousness, or even CD/DVD drives that also have modifiable firmware.

Someone could intercept a floppy and read/write its data, but putting malware on it and getting the receiver to execute it unnoticed is going to be much harder than with a USB drive. Putting a floppy into a drive literally does not cause any code to execute - it's only when commanded to, i.e. when the drive is accessed, that things start happening. There's no AutoPlay for floppies. Contrast this with the whole USB enumeration process.

Most motherboards still prioritize floppy drives when it comes to boot order. The early viruses were transmitted by floppies.

I also wouldn't trust a floppy controller's firmware any more than I would a CD or USB controller's firmware.

Have you ever tried to intercept some one else's snail mail (or even your own wrongly delivered)? Its a lot of work if you don't have an insider at the post office. Requiring major time investments, to visit mail boxes or collect mail. E-mail even encrypted is much easier to permanently monitor than basic post, even for state level actors.

Opening an envelope is easy, doing so without being detected day in day out is hard.

The (East) Germans managed - the Stasi (East German secret police) did so for years on end with any number of suspected citizens.

Actually there was a joke going around here in Germany when the NSA scandal broke, talking about how jealous all the ex-Stasi guys must be that the NSA had beaten them at their own surveillance game...

I keep having the feeling that the west only stayed somewhat sane by having the eastern block as a comparison.

You haven't heard of bootsector virus? The only time I have seen a virus in the wild was a floppy bootsector one.

Our customer had edited a doc on her husbands pc and got infected - the pre boot checks caught it.

On that note, i have gotten the impression that the bootsector trick has been coming back in vogue. This because modern antivirus packages no longer do bootsector checks unless they are set to their most stringent level.

The Supreme Court puts email in the same legal category as postcards: little to no expectation of privacy, because everyone along the way can trivially read it. Certainly an envelope can be trivially bypassed, but the clear signaling of intent may be enough to sway the legal status of eavesdropping on it.

https://en.wikipedia.org/wiki/Tamper-evident_technology

It's quite surprisingly secure because, apart from crazy Norwegian doctors, who on earth can read a floppy disk?

Absolutely anyone who wants to.

http://www.amazon.com/Sabrent-External-Floppy-Drive-FL-UDRV/...

I have this exact drive. Amazon says: "You purchased this item on December 2, 2014."

Reply on news.ycombinator.com