Re: Tor exit nodes

[Andrey Rahmatullin <wrar@debian.org>]

On Mon, Oct 09, 2017 at 06:59:34PM +0200, Adam Borowski wrote:
> > > Let's discuss the threat model.  If I would be a three letter agency, I'd
> > > order Yubico (there's so many ways to force a company to do something) to
> > > introduce a backdoor: when a secret handshake (cryptographically signed :p)
> > > is entered, the keycard spills its storage.  This can be programmed into the
> > > kit low-paid goons on the border have, and instruct them to apply to all
> > > storage devices they search on a person.  Such an instruction is already a
> > > part of their orders, thus no knowledge or skills on the side of the goons
> > > are required.  Your secret key will then stay on file, without you being
> > > aware of this.
> > Is it really specific to the non-free hardware?
> 
> A free piece of hardware+software will have no such backdoor.  
Only if actually audited, I guess (and even then not guaranteed).

> Good policies would also recommend reflashing the firmware with a
> version compiled from sources or shipped by Debian (thus reproducibly
> built) before use;
Doesn't help if the sources are evil.

-- 
WBR, wRAR

Attachment: signature.asc
Description: PGP signature