Hacker News Reader

Comment by sneak | Hacker News Reader

> We’ve also taken other measures to frustrate attackers, for example we have physically removed the hard drive so there is no way to persist data on the laptop itself

This sentence made me believe in the incompetence of the authors.

View on HN

Well you have to start somewhere. You will never get perfect security, however persisting malicious code on disk (and getting the machine to boot from it) is easy and standardized. Doing the same in firmware (or non-volatile storage in other parts of the machine) is going to be very manufacturer-specific and will require knowledge of the exact hardware, versions, etc and because of the air gap you can't even tell whether your attempt worked (and of course if your malware needs to exfiltrate data it still needs to break out of the air gap).

TLDR: it's not bulletproof but increases the effort required from an attacker significantly.

This is covered more here https://news.ycombinator.com/item?id=29266521

Sorry for not being up to your standards I guess :(

competence/incompetence is not a compliment or slur.

I am an incompetent welder, for example.

My point is that if you are removing the hard disk to prevent state storage, that is ineffective, and if you think that it is effective (which you stated), you are objectively factually incorrect.

Why do you think this shows incompetence?

There are about 10 other ways of persisting secret information on a system other than the hard disk. The claim they make is amateur hour.

There are better ways of doing this. There are embedded systems that can run general purpose OSes that cannot store permanent state, such as rpi <=3 that are much better suited to such things.

Reply on news.ycombinator.com